Privacy

In short

We process only what we need in order to plan your wedding. We do not sell data, we run no advertising networks, and we collect no statistics about your guests. The pages your guests see contain no analytics — not one.

Who processes the data

The controller of your personal data is the operator of WeddinGlad. Use the same address for requests under Articles 15 to 22 GDPR — when you want to know what we hold about you, or to have it corrected or erased.

What we process about you

• Your account — the email address and name from your Google account or sign-in link. We do not store a password, because we do not use one.
• Your wedding — names, date, venue, budget, suppliers, tasks. Whatever you write into the app.
• Activity records — who changed what, and when. They exist so you can see what your partner did. They are deleted after 90 days.

What we process about your guests

Names, sometimes an email address or phone number, their answer to the invitation, their meal choice and dietary requirements. You enter this, or the guest fills it in themselves on the RSVP form.

Your guest never signed up with us, and that governs how we treat their data: the page they see carries no measurement, no cookies and no tracking scripts. Dietary requirements can say something about health, so they are shown only to you and to the people you give access to the guest list.

Cookies and measurement

On the marketing pages we use cookieless, EU-hosted measurement. That is why there is no consent bar here — there is nothing to consent to.

Inside the app we measure which features get used, so we know what to improve. Signing in uses strictly necessary browser storage, without which you would have to sign in on every page load.

Where the data sits

In Google Firebase, in the europe-west3 (Frankfurt) region. Google Ireland Limited is the processor and the data stays in the EU.

For how long

• The wedding and its guests — until you delete it.
• A deleted wedding — 30 days in the bin, then irreversibly. You can restore it until then.
• Activity records — 90 days.
• Guest photographs you rejected — 7 days, so the decision can be undone.

On what legal basis

• Performance of a contract — account, wedding, guests, payment. Without this data the service cannot be provided.
• Legitimate interest — activity records, so a couple can see what the other did, and protection against abuse. You may object to this processing.
• Consent — measurement inside the app. You can withdraw it at any time; withdrawal does not affect processing before it.
• Legal obligation — accounting and tax records for a payment, for as long as the law requires.

We do not make automated decisions about you and we do not profile you.

Your guests’ data: who answers for it

You compile the guest list. In relation to that data you, as the couple, are the controller and we are the processor — we process it on your instructions, use it for nothing else, and delete it when the wedding is deleted. In practice a guest who wants to know why we hold something about them asks you first; we will help you answer.

Your rights

You have the right of access, rectification, erasure, restriction of processing, portability, and the right to object. You can delete your account, along with every wedding you own, directly in settings — you do not have to write to us.

A guest who wants their data deleted can come to you as the couple, or to us. Unsubscribing from invitation emails is in every email and is irreversible: neither you nor we can subscribe them again.

If you believe we are handling your data badly, you have the right to complain to the supervisory authority: the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz. We would rather you wrote to us first — but you do not have to.

Who we pass data to

• Google Firebase — hosting, database, sign-in.
• Resend — sending invitation emails.
• Stripe — payment for the full version.

Nobody else. We do not sell, lend or aggregate guest data into any “comparison with other weddings”.

Wedding data sits in the EU. Some of these processors are international, though, and part of the processing may happen outside the EU — in which case it relies on standard contractual clauses approved by the European Commission. Payment details are processed by Stripe as a separate controller under its own terms; your card number never reaches us.