Privacy policy

1. Who is responsible

[to be completed] ([to be completed], [to be completed]) is responsible for the data of Zaffy's users (couples, co-organizers, wedding planners, people who contact us).

For the data of guests added by a couple, the couple decides what is collected and why; Zaffy processes it on their behalf, only to send their invitations and collect replies.

2. What we collect

• Account: e-mail address, name, language, and the weddings you organize.
• Weddings: names of the couple, dates and places, texts, photos, videos and music you upload.
• Guests (added by the couple): names, number of seats, and optionally phone number, e-mail and notes; their replies and messages to the couple; when their invitation was sent and opened.
• Messages you send us with the contact forms, and any file you attach.
• Payments: what was bought (a size or a planner plan), the amount and currency, the activation code used, and the payment references from Stripe. Card details are entered on Stripe's page and never reach us.
• Technical data: IP address and browser information, kept briefly for security (for example to limit abuse).

3. Why we use it

• To provide the service you asked for (contract): accounts, invitations, replies, notifications.
• To answer your messages (legitimate interest).
• To keep the service secure and prevent abuse (legitimate interest).
• To keep accounting records of payments (legal obligation).

We don't sell your data and don't use it for advertising.

4. Who receives it

Only the people you give access to (co-organizers, and each guest for their own invitation), and the providers that run Zaffy for us:

• Supabase (database, sign-in and file storage);
• Vercel (hosting of the website);
• Resend (sending e-mails);
• Sentry (error reports: the page and browser where an error happened, without your IP address, personal links or what you typed);
• Stripe (card payments: Stripe receives your card details, e-mail and country to process the payment and prevent fraud).

Some of these providers may process data outside the European Union; in that case they offer the safeguards required by the GDPR (such as the European Commission's standard contractual clauses).

5. How long we keep it

• Weddings and guest lists: while the wedding exists. Invitations go offline 6 months after the wedding; you can delete a wedding and everything in it at any time.
• Accounts: until you ask us to delete yours.
• Contact messages: up to 3 years.
• Payment records: 10 years, as required by French accounting law.

6. Cookies

Zaffy only uses cookies needed to run: keeping you signed in and remembering your language. There are no advertising or tracking cookies, so no consent banner is needed.

7. Your rights

You can ask to access, correct, delete or receive a copy of your data, to limit its use, or object to it, by writing to [to be completed]. Guests can ask the couple who invited them, or us, and we'll pass the request on.

If you think your rights aren't respected, you can complain to the CNIL (www.cnil.fr), the French data protection authority.