Privacy policy

1. Controller

Controller within the meaning of the GDPR for Wedding Buddy (weddingbuddy.at):

2. What data we process

2.1 Account data (authentication)

When you register and sign in, the following data is processed:

• Email address, and whether it has been confirmed
• Name and, optionally, a profile picture
• Password (stored as a bcrypt hash, never in plain text)
• If you sign in with Google: the identifier of your Google account (see section 5)
• If you set up a passkey: its public key and the name you give it
• Time of registration and of the last sign-in
• Preferred language of the app, and whether the introductory tour has been shown to you

2.2 Wedding planning data

While using Wedding Buddy, the following data — including personal data of third parties — may be entered:

• Names, email addresses and phone numbers of wedding guests
• Guests' postal addresses
• Photos (contact pictures, photo album)
• Information on table assignment, meal choice, allergies and intolerances, and acceptances or declines, also per event (e.g. registry office, party)
• Budget data, payments and vendor information
• Appointments, tasks, notes, documents, schedules and song wishes
• The texts of your wedding website and your gift list; if you offer a money gift, also the bank details you enter for it
• Which gifts you received from whom and whether you have thanked them yet, if you write that down

This data is used solely to plan your own wedding and is not passed on to third parties, marketed or analysed.

2.3 Guests' data

Guests do not need an account. Someone who opens a personal invitation link, a wedding website, a gift list, the page for song wishes or a photo album leaves only what they enter there themselves:

• Acceptance or decline, meal choice, allergies or intolerances, number of children and a remark
• When reserving a gift without an invitation link: the name the guest gives for it
• Song wishes and uploaded photos

These details are seen by the couple and the people they have invited to their planning team. Other guests do not see them — for a gift, only that it has been taken. The bank details for a money gift are shown only to guests who open the page through their personal invitation link.

2.4 Payments

When you unlock a wedding or buy extra seats or storage, the payment is handled by Stripe (see 4.4). Card and payment details are entered on Stripe's page and never reach us; we only learn whether and what was paid.

2.5 Technical data

• IP address (temporarily, for security purposes such as protection against abuse)
• Browser and device type
• Access times
• Feedback you send us through the app – together with your email address and the page you were on, so that we can ask back
• Error reports: if a technical error occurs in the app, we receive the error message, the page concerned (without a link's parameters, such as those of an invitation) and the browser type — nothing of your wedding's content

Wedding Buddy uses no analytics or advertising services and builds no usage profiles.

3. Legal bases for processing

Personal data is processed on the following legal bases under Art. 6 GDPR:

• Art. 6(1)(a) GDPR — consent (e.g. when you connect your Google account or have a map shown)
• Art. 6(1)(b) GDPR — performance of a contract (providing the service you register for)
• Art. 6(1)(f) GDPR — legitimate interests (security, preventing abuse)

You can withdraw consent at any time with effect for the future, for instance by disconnecting in the settings.

4. Processors & third-party providers

4.1 Fly.io (hosting & database)

The application and the database (self-operated PostgreSQL) run on servers of Fly.io (Fly.io Inc., San Francisco, CA, USA) in the EU region Frankfurt. No separate database or authentication provider is used — we operate the database and the sign-in system ourselves. More information: fly.io/legal/privacy-policy.

4.2 Tigris (file storage)

Uploaded files — photos, documents and profile pictures — are stored with Tigris (Tigris Data, Inc., USA), the object storage built into Fly.io. The storage is not publicly accessible; files are only delivered through links that expire. More information: tigrisdata.com.

4.3 Resend (email delivery)

Emails from Wedding Buddy — the confirmation of your address, password resets, invitations to your planning team, notifications and reminders, and the save the dates, invitations and reminders you send to your guests or have sent automatically — are delivered through Resend (Plus Five Five, Inc., USA). Resend receives the recipient's address and the content of the email, including the names it contains. More information: resend.com/legal/privacy-policy.

4.4 Stripe (payments)

Payments are processed by Stripe Payments Europe, Ltd. (Dublin, Ireland). We pass Stripe your email address and which wedding the purchase is for; everything you enter on Stripe's payment page goes to Stripe only. For fraud prevention and its legal obligations, Stripe acts as a controller in its own right. More information: stripe.com/privacy.

4.5 Spotify (optional, playlist feature)

If you use the Spotify integration, a connection to Spotify AB (Stockholm, Sweden) is established. Spotify's privacy policy applies: spotify.com/privacy. The connection is optional and can be disconnected at any time.

4.6 Google (optional: sign-in and calendar)

You can sign in with your Google account and connect your Google Calendar. The provider is Google Ireland Limited (Dublin, Ireland). Both are voluntary; Wedding Buddy can be used in full without a Google account. What data we receive from Google and what happens to it is set out in section 5.

4.7 Google Maps (optional, on a wedding's website)

A couple can publish a website for their guests. Where it names a place, it offers links to Google Maps and OpenStreetMap, and a map that is shown on request. Nothing is loaded from either until you follow a link or choose "Show map"; only then does your browser connect to Google (Google Ireland Limited) and pass on your IP address, and Google's privacy policy applies: policies.google.com/privacy.

Where a provider is based in the USA, data is transferred on the basis of the EU Standard Contractual Clauses or, where the provider is certified under it, the EU–US Data Privacy Framework.

5. Google user data

This section describes how Wedding Buddy handles data it receives from your Google account through Google's APIs. That happens only if you choose "Continue with Google" or connect your Google Calendar, and only to the extent you agree to on Google's screen.

5.1 What data we access

We do not access emails, contacts, files or any other content of your Google account.

5.2 How we use it

• Sign-in: to create an account for you and to recognise you the next time.
• Reading the calendar: to show you your own events next to the wedding's appointments and to warn you when a new appointment overlaps with one of them. Your events are seen only by you — not by your partner and by no one else in the planning team.
• Writing to the calendar: to enter the wedding's appointments into the "Wedding Buddy" calendar in your account and keep them up to date. We change nothing in your other calendars and events.

We use Google user data for nothing else: not for advertising, not for analytics or profiles, and not to develop, train or improve artificial intelligence or machine learning models.

5.3 What we store and how we protect it

• For sign-in: email address, name and the identifier of your Google account, with your account.
• For the calendar: the email address of the connected Google account, which access you agreed to, and the key for the connection (refresh token) — which is stored encrypted.
• For appointments written to Google: only the record of which entry in the "Wedding Buddy" calendar belongs to which appointment of the wedding.
• We do not store the events of your own calendars. They are fetched while you look at the calendar in the app, shown to you, and then discarded.

Storage is in our database in the EU (Frankfurt). Every transfer to Google and to you is encrypted with TLS.

5.4 Sharing

We do not share Google user data with anyone and do not sell it. It leaves our systems in two cases only: where we are legally required to disclose it, and in technical operation by our hosting provider (4.1), which stores it on our behalf. No human reads this data — unless you expressly ask us to (for instance to investigate a problem), or it is necessary for the security of the service or for legal reasons.

5.5 Retention and deletion

• Disconnect: under Settings → Calendar. This removes the "Wedding Buddy" calendar from your Google account, deletes the key on our side and revokes it at Google.
• Delete your account: under Settings → My account. This also deletes the identifier of your Google account and any calendar connection.
• Revoke at Google: you can also withdraw Wedding Buddy's access directly in your Google account at any time: myaccount.google.com/permissions.
• On request: write to luka@benzia.com and we will delete the data for you.

Remaining copies in backups are deleted within 30 days (see section 7).

5.6 Limited Use

Processing by Google itself is governed by Google's privacy policy: policies.google.com/privacy.

6. Cookies & local storage

Wedding Buddy uses no tracking cookies and no advertising cookies. Only technically necessary cookies are set:

• Sign-in cookie (httpOnly) — holds a session token that extends your sign-in; it cannot be read by JavaScript and serves authentication only
• Session indicator (wb_session) — contains no personal data, only the information that this browser is signed in, so the address weddingbuddy.at opens the app instead of the start page
• Language (wb_lang) — remembers the language you picked on the start page
• Sign-in with Google (wb_oauth_…) — only for the few minutes in which you sign in at Google or connect your calendar; makes sure Google's answer belongs to your request

In addition, we use local storage (localStorage) for settings that stay on your device:

• Theme (light/dark/system)
• Language of the app
• Order and visibility of the sidebar modules and of the guest list's columns
• Optional Spotify connection (only if the integration is enabled)
• As a guest without an invitation link: which gift you reserved in this browser, so that you can take the reservation back

For signed-in users the browser also remembers the content of the app that was loaded last, so that it appears at once after a reload (sessionStorage). It applies to the open tab only and is deleted when the tab is closed and when you sign out.

If you choose “Make available offline” under Check-in, this device additionally stores your guests' names and tables, whether they have arrived, and your schedule for the day (localStorage) — so that check-in and the schedule work on the wedding day without an internet connection. The copy stays until you remove it there or sign out. Arrivals you record without a connection are noted on the device and sent to the server as soon as the connection is back. So that the app itself starts without a connection, the browser of a signed-in user also keeps its program files (service worker); they contain none of your wedding's data.

This data does not leave your device and is not analysed. Wedding planning data — including the wedding date — is stored on the server and is visible to all members of your wedding, not only locally on one device.

7. Retention period

Your data is stored for as long as your account is active. You can delete your account yourself at any time under Settings → My account. Weddings you own are deleted with it right away, including everything in them (guest lists, budgets, files); in weddings you were invited to, your membership ends. Remaining copies, for example in backups, are deleted completely within 30 days.

Photos in the gallery of a wedding are deleted 12 months after the wedding day entered, after 24 months in the largest size; where no wedding day is entered, 24 months after the wedding was created. Before then we remind the members of the planning team three times by e-mail, the first time at least 30 days ahead. We also tell them by e-mail when a wedding's storage is running out. The rest of the wedding's data stays.

Statutory retention periods (e.g. 7 years for billing data) remain unaffected.

8. Your rights (GDPR Art. 15–22)

You have the following rights regarding your personal data:

• Right of access — you can ask at any time what data is stored about you (Art. 15)
• Right to rectification — incorrect data is corrected on request (Art. 16)
• Right to erasure — you can delete your account yourself under Settings → My account, or ask us to delete your data ("right to be forgotten", Art. 17)
• Restriction of processing — you can have processing restricted (Art. 18)
• Data portability — you can download your data in a machine-readable format (Art. 20)
• Right to object — you can object to the processing of your data (Art. 21)
• Withdrawal of consent — at any time, with effect for the future (Art. 7(3))

If you are a guest of a wedding and would like to know what has been entered about you, or have it deleted, it is best to ask the couple — they manage their guest list themselves. You can also contact us.

To exercise these rights, contact: luka@benzia.com

You also have the right to lodge a complaint with the Austrian Data Protection Authority: www.dsb.gv.at

9. Data security

All data transfers are protected by TLS/HTTPS encryption. Passwords are stored only as a bcrypt hash, the keys for connected Google accounts encrypted. Authentication uses short-lived JSON Web Tokens (JWT) together with a secure session cookie that JavaScript cannot access. We carry out regular security reviews and keep our software up to date.

10. Changes to this privacy policy

We may update this privacy policy when needed. Signed-in users are informed of significant changes. The current version is always available at weddingbuddy.at/en/privacy.