Legal document
Privacy Policy
Last updated
This notice describes how Wedira processes the personal data of users of the site and the service, pursuant to EU Regulation 2016/679 (“GDPR”).
1. Data controller
The data controller is Wedira, with registered office at [full address], VAT/Tax ID [VAT number]. For any request regarding personal data, you can write to [privacy contact email].
2. Categories of data processed
- Account data: the organiser's email address and login credentials.
- Event data: title, date, location, texts, images and invitation content uploaded by the organiser.
- Guest data: name and any email, phone number, menu preferences, notes and RSVP responses, entered by the organiser or provided by the guest through the response form. If the organiser activates an AI-based feature (see point 3), a subset of this data may be processed as described in point 5.
- Payment data: handled directly by the payment provider (Stripe). Wedira does not store full card details.
- Technical and usage data: browsing data and technical cookies necessary for the site to function (see Cookie Policy). In addition, through PostHog: (a) with no cookies and regardless of consent, the key steps of the service recorded by our server (views of certain pages, such as the catalogue, template previews and the Design Studio; starting the Design Studio; event created; payment started and completed; subscription updated; RSVP response sent), with the page path, the internal event ID, the plan, the amount and currency, the subscription status and any campaign parameters (utm), linked to the account's internal ID if the user is logged in, otherwise to a random ID generated for that single step; (b) only with the user's consent, analytics on how the site is used (pages visited, where visitors come from, type of browser, operating system and device, browser language), linked to a random browser ID and, if the user has an account and is logged in, to the account's internal ID. Names, email addresses and guest data (names, menus, allergies, messages) are never sent to PostHog; we do not collect what is typed and we do not record the screen.
- Contact/support request data: name, email, request category and message text, entered through the Contact form. If the sender is already a registered user, the request is linked to their account.
3. Purposes and legal bases
- Providing the service (creating invitations, collecting RSVPs, managing guests) - legal basis: performance of a contract.
- Payment processing - performance of a contract and legal obligations.
- Transactional emails (RSVP confirmations, notifications, reminders) - performance of a contract and legitimate interest.
- Security and abuse prevention - legitimate interest.
- Handling contact and support requests - legitimate interest.
- Legal obligations (e.g. tax) - legal obligation.
- Site usage analytics using tools that store information on the device (PostHog, see point 2, letter b) - legal basis: consent (Art. 6(1)(a) GDPR and the ePrivacy rules on storing information on the device). Consent is optional and can be withdrawn at any time with the “Cookie preferences” button in the Cookie Policy; withdrawal does not affect the lawfulness of processing carried out before it.
- Server-side measurement of the key steps of the service (PostHog, see point 2, letter a), with no cookies and no name or email - legal basis: Wedira's legitimate interest in understanding how the service is used and improving it. You can object to this processing at any time, on grounds relating to your particular situation (Art. 21 GDPR), by writing to the address given in point 1. Steps recorded while the user is not logged in are not linked to any account and each receives a different random code.
- AI-based features (automatic translation of invitation content, generating text variants for the couple's story, personalised opening lines for each guest, seating suggestions) - legal basis: performance of a contract. These features are optional and are activated only by the organiser's explicit action; they are never started automatically.
4. The organiser's role
When an organiser enters their guests' data, they act as an independent data controller for that data and undertake to process it in compliance with applicable regulations, having informed the data subjects. Wedira acts as a data processor on their behalf.
5. Providers and data processors
To provide the service, we rely on providers who process data on our behalf:
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication and content storage |
| Stripe | Payment processing |
| Resend | Sending transactional emails |
| Vercel | Hosting and distribution of the application |
| Anthropic | AI-based processing of invitation content and some guest data, only for events where the organiser activates one of the AI features listed in point 3 |
| PostHog | Analytics on the use of the site and the service (data hosted in the European Union, in Frankfurt): server-side key steps of the service and, only with consent, analytics on how the site is used. It receives no guest data |
When activated by the organiser, the AI features send Anthropic only the data strictly necessary for that specific feature: the invitation's free-text content (the couple's story, schedule, FAQ) for automatic translation and text variant generation; the guest's name, relationship with the couple and any personalisation note for personalised opening lines; names, relationships between guests and seating arrangement for seating suggestions. Payment data, email addresses and phone numbers are never sent. Anthropic is based in the United States: the transfer takes place on the basis of the safeguards described in point 7.
6. Data retention
Data is retained for as long as necessary for the stated purposes and, for event data, for the publication period included in the chosen plan, unless otherwise required by law. The organiser may request deletion of their account and related events at any time. Contact/support request data is retained for 24 months from the closing of the ticket, after which it is deleted. Analytics data recorded in PostHog is retained for 12 months, after which it is deleted.
7. Transfers outside the EU
Some providers may process data outside the European Union. In such cases, the transfer takes place on the basis of appropriate safeguards (e.g. Standard Contractual Clauses) as provided by the GDPR. In particular, PostHog stores data in the European Union (Frankfurt), but its parent company is based in the United States: any access to the data from the United States takes place on the basis of the data processing agreement (DPA) and the Standard Contractual Clauses.
8. Data subject rights
Data subjects may exercise the rights of access, rectification, erasure, restriction, objection and portability, and may lodge a complaint with the competent data protection authority. In particular, you can object at any time to processing based on legitimate interest (Art. 21 GDPR), including the server-side measurement of key steps, and withdraw your consent to analytics at any time with the “Cookie preferences” button in the Cookie Policy. To exercise these rights, you can write to [privacy contact email].
9. Changes
This notice may be updated over time. The date above indicates the most recent revision.