What we hold about you, what for, and how you get rid of it. · Last written: 17 October 2026
Controller
The controller under Art. 4(7) GDPR is:
The controller's details are not configured for this environment yet. Until they are, placeholders stand here:
[Company name and legal form] [Address] [Email address] [Register court and registration number]
Send questions about data protection and requests to exercise your rights to the email address above – as a couple, a guest or a supplier.
[Data protection officer: insert name and contact if one is appointed – otherwise delete this paragraph.]
What we hold about you
Only a name and an email address are required – for an account or to send requests – and, for a booking, the billing address; without them we cannot open an account, deliver a request or issue an invoice. Everything else you give voluntarily.
What for, and on what legal basis
Every processing has one purpose and one legal basis under Art. 6 GDPR.
| Purpose | Legal basis |
|---|---|
| Keeping your account and signing you in | Art. 6(1)(b) — contract |
| Showing what you consented to – with the wording, its version and the time | Art. 6(1)(c) with Art. 7(1) GDPR |
| Sending requests to suppliers and carrying their answers back | Art. 6(1)(b) — contract |
| Settling the booking and collecting the brokerage fee | Art. 6(1)(b) — contract |
| Issuing and keeping invoices | Art. 6(1)(c) — § 147 AO, § 14 UStG |
| Telling you about requests, answers and deadlines – by email and, if you allow it, by push | Art. 6(1)(b) — contract |
| Letting the AI search and the planning assistant answer, when you use them | Art. 6(1)(b) — contract |
| The guest list and your guests' replies | Art. 6(1)(f) GDPR; intolerances only with consent, Art. 9(2)(a) GDPR |
| Receiving your guests' photos, keeping them for you and letting you download them | Art. 6(1)(b) — contract with the couple; for guests and people pictured, point (f) — legitimate interest |
| Publishing reviews of booked suppliers | Art. 6(1)(b) — contract; for the supplier reviewed, point (f) |
| Verifying suppliers, publishing their profiles and ranking them by disclosed criteria | Art. 6(1)(b) — contract |
| Helping with questions and disputes, and logging changes made by our team | Art. 6(1)(f) — legitimate interest in helping and in an audit trail |
| Preventing abuse and running the service | Art. 6(1)(f) — legitimate interest in running the service securely |
| Tips and offers by email, where you agreed to them | Art. 6(1)(a) — consent, withdrawable at any time |
Who else processes it
Processors under Art. 28 GDPR, who work only on our behalf and on our instructions. Each receives what its task needs, and no more. [Confirm a data processing agreement is in place with each service.]
| Service | For what |
|---|---|
| Vercel Inc. | Running the website and the API, including the server logs. [Insert the server region from the project settings.] |
| Supabase Inc. | Database, sign-in and file storage – including your guests' photos and the suppliers' documents. The data is held in the EU (Ireland). |
| Stripe Payments Europe, Ltd. | Payments. We pass on your email address, name, the amount and the date of the celebration. On the payment page your browser loads the payment form directly from Stripe, and in the app Stripe opens it itself, with Apple Pay or Google Pay too; card or account details are entered only there. |
| Resend (Plus Five Five, Inc.) | Sending every email: sign-in codes, notifications, and the emails a couple sends to their guests. [Confirm the EU sending region.] |
| MapTiler AG | The map: your browser and the app load its tiles directly from MapTiler whenever a map is shown – always on a supplier's page, and in the search when you open the map or have a wide screen. MapTiler sees your IP address when they do. MapTiler also completes, on our server, what you type into the place field, and finds the place for “My location”. |
| [Language model provider] | Answers the AI search and the planning assistant, and translates suppliers' profile texts; receives neither names nor contact details (see below). [Insert the provider's seat and where processing takes place.] |
| Expo (650 Industries, Inc.) | Passes the app's push notifications to Apple and Google, who deliver them to your phone, and delivers updates of the app; Expo sees your phone's IP address when it does. |
Some of these services are based in the United States or access data from there. The transfer relies on [insert per service: an adequacy decision, such as the EU-US Data Privacy Framework, or standard contractual clauses under Art. 46(2)(c) GDPR].
Who else receives something
AI search and planning assistant
The AI search turns a sentence into a search for suppliers – without an account, and it writes nothing into anyone's planning. The planning assistant is there for signed-in members of a celebration: it knows your plan and adds things to it when you ask. Both answer with a language model. Which suppliers appear, whether they are free and what they cost comes only from our own data; that an AI writes the answers is stated under the input box.
For each answer of the AI search, we send the language model provider your message, the latest messages of the conversation, the key facts of your last search – place and radius, date, number of guests, categories, price limit – and the language of the page.
For the planning assistant we add the key facts of your celebration (date, place, number of guests, country, currency, budget), which suppliers you have asked or booked, from the checklist the number of tasks and the titles of the next two, from the budget only the totals, the first points of your running order, and from the guest list only numbers per occasion – invited, attending, declined, children, meal preferences – never a name. For proposals of a whole celebration, we add the public details of the suppliers that could fit.
We do not send your names, email address, phone number, your account, your guests' names or your IP address. Whatever you write yourselves into a message, a task or your running order does, however, reach the model word for word – so please do not put names or contact details there.
A place you name is looked up by our server in Nominatim, the place directory of the OpenStreetMap Foundation; only the place name is sent.
The language model is run by [insert provider, seat and where processing takes place] as our processor.
AI search conversations are tied to no account; we delete them 30 days after the last message. “New search” starts a new conversation but does not delete the old one any sooner. The planning assistant's conversations and proposals belong to your celebration and are deleted with it. For the daily allowances we store, instead of your IP address, a hash made with a secret key, and remove it after 24 hours, at the next conversation with either assistant.
The legal basis is Art. 6(1)(b) GDPR, because you ask for the answers; the allowances rest on our legitimate interest in limiting abuse (Art. 6(1)(f) GDPR).
Voice input and read-aloud
In the browser, your browser's speech recognition turns what you say into text. To do so, the browser sends the audio to its maker's speech service – Google for Chrome, Microsoft for Edge, Apple for Safari and for every browser on iPhone and iPad. Other browsers may use a service of their own; where there is none, we show no microphone. What the maker does with the audio is governed by its terms, not by us.
We say so the first time you tap the microphone, before anything is recorded. The browser only listens once you start voice input there; “Not now” declines, and nothing is recorded. Only your browser remembers that you acknowledged the note.
In the browser, answers are read aloud only in a voice that runs on your device; if your language has none there, there is no read-aloud button. In the app, your phone's own speech output reads them.
In our app the phone recognises speech itself, without passing the audio on. On Android from version 13, with the on-device speech recognition and only in a language installed there. On the iPhone the app shows the microphone only when Apple confirms that the app's language – or another regional variant of it – is recognised on the phone itself; the request is then pinned to the device, and if the phone cannot recognise it there, it fails rather than send the audio to Apple. The keyboard's own dictation belongs to the operating system, not to us.
The audio is recorded or stored nowhere, and it reaches neither us nor the language model provider. All we receive is the text you see in the box, can change, and send yourselves – just like typed text.
Videos and music from YouTube and Spotify
Suppliers can show videos from YouTube and music from Spotify on their profile. Of these we keep only the link and the title. Our server fetches the preview picture from the service — for it, your browser asks only us.
Only when you press play does the page load YouTube's player (through youtube-nocookie.com) or Spotify's. From then on the service receives your IP address, details of your browser and device and the page you came from, and may store cookies or similar data on your device — on its own terms. We do not remember the press: every play is a decision of its own.
YouTube is run by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Spotify by Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden. Google also transfers data to the United States, on the basis of the adequacy decision for the EU-US Data Privacy Framework. Their privacy policies: policies.google.com/privacy and spotify.com/legal/privacy-policy.
The legal basis is your consent, which you give by pressing play (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You withdraw it by closing or reloading the page; what the service already stored you delete in your browser.
In the app nothing plays inside the app: a tap opens the YouTube or Spotify app, or your browser. There too the preview picture comes from our server.
What we do not do
No third-party tracking, no ad networks, no audience measurement, no fonts from somebody else's CDN — ours sit on our own server. A video from YouTube or music from Spotify loads only when you press play. And there is nothing in the suppliers' ranking that can be bought.
If you have been invited as a guest
A couple is planning their wedding with Eventadore and has put you on their guest list. From the couple come the name of your invitation, your names and, where given, age group and age, meal preference, table, group and side, which occasions you are invited to or whether you are on a wish list, answers the couple enters for you, a gift and whether they have thanked you, and – optionally – your postal address, email address and phone number. From you come what you give through your personal invitation link: yes or no for each occasion, your companion's name, your meal preference, a message for the couple and, if the couple asks for it, your postal address.
Your link is your key: we store only a hash of it, and whoever has the link sees and changes what your whole household has given. Only the couple can hand it out; if they renew it, the old one stops working. We store when the link was last opened and show it to the couple – that one moment only, no IP address and no device. The invitation page sets no cookies and loads nothing from third parties.
We process this information so the couple can plan their celebration: managing invitations, counting replies, planning the meal and the seating, and sending thank-you cards. The legal basis is the couple's legitimate interest in this and our legitimate interest in providing them with the tool (Art. 6(1)(f) GDPR). You can object to this processing at any time (Art. 21 GDPR).
An intolerance or allergy is information about your health. We store it only when you enter it yourself and tick the box for your explicit consent (Art. 9(2)(a) GDPR) – together with the wording you saw, its version and the time. Giving it is voluntary. Only the couple sees it – not whoever helps them plan. The kitchen receives it only when the couple sends it: as a message in their conversation with the caterer, with numbers and without names; everyone planning with the couple can read that conversation. You can withdraw your consent at any time through the same link; the information is then deleted at once. A message the couple has already sent to the kitchen stays there – without your name. Processing before the withdrawal remains lawful (Art. 7(3) GDPR).
Your information is seen by the couple and by the people they invited to plan with them – but information about your health, and your personal link, by the couple alone. We pass no names to the couple's suppliers, and the planning assistant receives only numbers from the guest list. Technically, the services listed above process it for hosting, the database and sending email.
The guest list is deleted six months after the celebration – with every reply, detail, link and the record of emails sent – sooner if the couple deletes an invitation or the whole list; we remind the couple 30 days before. Two things remain for as long as the celebration itself is stored: our notice to the couple that an invitation has answered (with the invitation's name and the number of yeses and noes), and messages the couple has already sent to the kitchen. Photos you send the couple have a period of their own (below).
Only when the couple expressly triggers it do we send your invitation by email to the address they entered – as plain text, under the couple's name, from our sending address; replies go to the couple. If the couple has scheduled it, a second email with your photo link arrives on the day of the celebration, an hour before the occasion they chose – not if you declined everything. Every such email has a link to stop all further ones; the invitation itself stays valid. We record when an email went to which address. We do not measure whether you open an email, and we never send you advertising.
The rights listed above – access, correction, erasure, restriction, objection and a complaint to a supervisory authority – are yours as a guest too. Ask the couple or contact us directly (details above).
If you send the couple photos
Besides its invitation link, each invitation has a photo link of its own. The couple gives it to you as a link, on a card with a QR code – the code is made by our own server – or by email on the day of the celebration, an hour before the occasion they chose. Through the page behind the link you send the couple photos and videos. Whoever has the link can upload there; all they can see there is the couple's names and how many files have already arrived through that link.
Only the couple sees the photos – the two people planning their celebration with us. Nobody who helps them plan sees them, nor do other guests – nor do you, once sent – and nothing is public. The files sit in non-public storage; to view and download them we create links that expire after one to two hours.
If you type a name, we keep it with your photos so the couple knows who they are from. Without one, the gallery shows the name of your invitation for as long as the guest list exists. We do not store your IP address, your device or the file names. The couple sees whether an invitation has opened its photo link and how many files have arrived.
We keep every file exactly as you send it – with everything your phone wrote into it, such as the time taken, the camera model and, if location was switched on, the place where it was taken (EXIF data). We do not remove this; that is a deliberate decision of ours. If you do not want to send the location, switch it off in your camera or remove it before sending. From a HEIC photo or a video, your browser also makes a small preview image for the couple's gallery and sends it along; it carries none of this data.
You can send photos from the day of the celebration (midnight, local time) for six months: photos as JPEG, PNG, WebP, HEIC or HEIF and videos as MP4, MOV or WebM, each file up to the size the page tells you – currently 50 MB. There is no limit on the number of photos; against abuse we accept at most 20 files at a time per invitation and 100 GB in all per celebration.
We keep the photos for two years after the day of the celebration. 30 days before, we remind the couple by email and in the app to download them; after that we delete them. They go sooner if the couple deletes a photo or the celebration is deleted. When the guest list goes after six months, only the photo links go with it, not the photos.
If you want a photo removed, ask the couple – they can delete any single photo – or write to us (contact above). A photo already sent cannot be deleted from the photo page itself.
The photo page sets no cookies. Your files go from your browser directly to our storage provider (Supabase). So that an interrupted upload can resume, the page stores an entry with the file's name, size and type in your browser's storage: it is deleted once the file is sent, and after an interruption it stays until you delete it in your browser.
The legal basis is the couple's legitimate interest in collecting the photos of their celebration, and ours in providing them with this tool (Art. 6(1)(f) GDPR). That applies to the people pictured too; they may object (Art. 21 GDPR). Please send only photos you took yourselves.
Wedding websites
A couple can publish a website for their wedding at eventadore.com/wedding-invite/…. The couple writes what it says; we publish it for them and translate it into our eight languages with a language model. Whether it is public, has a password or is open only to invited guests, and whether search engines may find it, is the couple's choice. Bank details appear only after a click and never in the page's source.
To find your invitation you type your first and last name. We compare it with the couple's guest list; only an exact match opens your household, for an hour, through a cookie that exists for that alone. This page never shows anything you gave earlier about intolerances or your address. If you reply anyway, we add your name and your reply to the couple's guest list for them.
Photos you send through the website go into the couple's photos, as through a photo link, and — while the couple leaves it switched on — appear on the website for everyone who opens it, under the name you give. We keep your agreement with the words you saw. Anyone in a photo can ask on the page for it to come down: it leaves the website at once, and the couple decides.
Against guessing, we count name searches, password attempts, requests for the bank details and reports per visitor. For that we keep, instead of your IP address, a value computed with a secret key, and delete it after seven days. The website sets no advertising or analytics cookies; a password opens it for you with a cookie for 30 days.
A website stays online until two years after the day of the celebration; then we take it offline, and its address is never given to anybody else. The couple can take it offline or delete it at any time; a deleted website's address is never given to anybody else either.
The legal basis for the couple is our contract (Art. 6(1)(b) GDPR); for guests, the couple's legitimate interest in informing their guests and collecting their replies, and ours in providing them with this tool (Art. 6(1)(f) GDPR).
If you are a supplier with us
About your business we store the legal and display name, address, place and service radius, contact email and phone, tax number or VAT ID, trade register entry or trade licence, whether you charge VAT and which payment methods you accept; along with your services, packages, prices and calendar, your photos and messages, and the names and email addresses of the people who run your profile. We collect no bank details.
Your profile is public: display name, category, place and a point on the map where you chose, description, photos, the links and titles of your videos on YouTube and your music on Spotify, services, price range, payment methods and whether you are a small business, reviews with your answers, response time, acceptance rate, the number of paid bookings and an Eventadore Heart you have earned. We publish your photos as you upload them – with what your camera writes into them (EXIF); only the reduced previews are made without it.
Documents for verification – such as a trade licence, the ID of the person who signs for the business, or insurance – are kept with their file names in non-public storage; only our staff open them, through links that expire after five minutes. If we reject a verification, we store the reason and show it to you.
If you connect a calendar through an iCal address, our server fetches it regularly and takes over the busy days with the title of each appointment; we do not read attendees, alarms or attachments. Couples are shown only that a day is taken.
What you write on your profile – the short description, the description, your packages and add-ons and the note on how couples pay – is sent to our language-model provider when you save it, to be translated into the other languages of the site. Nothing else about you is sent with it. Couples see that a text is translated and can read your original.
If you answer through the link in our email, we store the time and your IP address with it, as evidence for later disputes. Until a couple has paid, you see only their first name, the date, the number of guests and the packages asked for; after that their name, email address, phone number and billing address.
We calculate the order in the search automatically from published figures: reviews 30%, response time 25%, acceptance rate 20%, calendar upkeep 15%, profile completeness 10%. None of it can be bought, and you see your own values alongside.
When our team approves, pauses or corrects your profile, we log who changed what and when, with the state before and after. For an Eventadore Heart or a pin we send you, we store the shipping address.
Before you are with us, we may know your business from public directories – OpenStreetMap and Overture Maps: name, address, phone, email address and website – in order to approach you by phone. That list is not part of the product. The legal basis is our legitimate interest in winning suppliers for the marketplace (Art. 6(1)(f) GDPR); if you object, we will not call again. [Insert how long the list is kept.]
The legal basis is the contract with you (Art. 6(1)(b) GDPR); the documents, the change log and the IP address of an answer rest on our legitimate interest in keeping out false suppliers and settling disputes (Art. 6(1)(f) GDPR). You cannot delete a supplier profile yourselves – write to us for that.
If somebody invited you
Someone who registers through another person’s link or code is recorded as that person’s referral. That person receives from us a share of our fee on your bookings, and for that sees that someone joined, from which country, in which month a celebration takes place and what amount they earned, never names, contact details or the supplier booked. Of a business they see its name, how far its profile is, and the number and value of its bookings.
If you refer others, your display name is shown to the people you invite. We keep the terms you accepted, word for word.
An ambassador can prepare an invitation for a business or a couple they have spoken to. For that we keep a business’s name, trade and town, or for a couple only the ambassador’s own note, and never an address: the ambassador sends the message themselves. No account exists until the person invited confirms. Declining deletes the entry at once; otherwise it is deleted after 30 days.
At the ambassador’s request we send that one invitation by e-mail — in their name, with replies to them, after they affirmed the business expects the message. We keep the address only until the answer; declining deletes everything, and one click on the unsubscribe link is enough.
The legal basis is our legitimate interest in settling the referral (Art. 6(1)(f) GDPR). You can object at any time: in your account, under “Privacy & data”, one click ends the referral. We keep the settlement lines for as long as commercial and tax law require.
How long
In principle, for as long as your account exists. Some things we delete sooner, by ourselves; for some there is no fixed period yet:
You delete your account yourselves – under “Account” in the browser, on the same screen in the app – as long as no booking is open. Your name, email address and phone number are then removed, and signing in is no longer possible. We delete your celebration with it if nobody else plans with you and nothing has been paid; otherwise it remains for the other members and as a record of the booking. A review stays up and may still carry your first name.
Issued invoices stay for ten years (§ 147 AO). They carry the address that applied when they were issued and do not read the deleted account row.
Your rights
You may ask at any time for:
Much of this you can do yourselves: change your account details, untick the box for tips, delete the account, and as a guest change your replies through your link. For everything else – including a copy of your data – write to us; we answer within one month (Art. 12(3) GDPR).
Complaining
You may complain to a data protection supervisory authority — the one where you live, or the one where we are established.
The authority responsible for us is [insert name and address of the data protection supervisory authority where the company has its seat].
Changes
If what we process changes, this page changes. The date above says when it was last written.