Privacy Policy

Last updated: 17 September 2026

This Privacy Policy explains what personal data Wedify (wedify.fun) collects, why, on what legal basis, how long we keep it and what rights you have under Regulation (EU) 2016/679 (the “GDPR”).

1. Who is responsible for your data

The controller is the operator of Wedify — a private individual resident in the Republic of Lithuania. For anything concerning your data or this policy, write to info@wedify.fun.

We have not appointed a Data Protection Officer, because we are not required to under Article 37 GDPR. Your requests come to the address above and we handle them ourselves.

2. What data we collect

• Account data — your email address, your password (stored only as a bcrypt hash), your name if you give it, and, if you sign in through an external account, the basic profile that provider sends us.
• Invitation content — the names of the couple, the date, time and venue of the event, your texts, photographs, colour choices and anything else you put into the invitation.
• Guest data — the names and contact details you add to your guest list, plus the RSVPs, meal choices and messages your guests send through the invitation.
• Order data — the plan you bought, the amount and currency, the date and time, the order and payment references and any promo code used. Card numbers are handled by Stripe and never reach our servers.
• Support correspondence — the messages you send to info@wedify.fun and our replies.
• Technical data — IP address, browser and device type, pages visited, timestamps, error logs and the identifier of the anonymous builder session that holds your draft before you register.

We do not ask for special categories of data within the meaning of Article 9 GDPR. Please do not put health, religious or similar sensitive details into an invitation unless you really need to: a question about dietary preferences is fine, a medical diagnosis is not.

3. Why we use your data and on what legal basis

• Running your account, building, publishing and hosting the invitation, collecting RSVPs and keeping the guest list — performance of the contract, Article 6(1)(b) GDPR.
• Taking payment, confirming the order and handling refunds — performance of the contract, Article 6(1)(b), and a legal obligation for the bookkeeping part, Article 6(1)(c).
• Keeping accounting and tax records — a legal obligation, Article 6(1)(c).
• Transactional email: order confirmation, password reset, a warning that the invitation is about to be archived — performance of the contract, Article 6(1)(b).
• Security, abuse prevention, rate limiting, error diagnostics and aggregated usage statistics — our legitimate interest in a service that works and is not abused, Article 6(1)(f).
• Marketing email and any non-essential cookies — your consent, Article 6(1)(a), which you can withdraw at any time.
• Establishing, exercising or defending legal claims — our legitimate interest, Article 6(1)(f).

For the personal data of your guests it is you who decides what is collected and why. Organising your own wedding is normally a purely personal activity, which under Article 2(2)(c) GDPR falls outside the scope of the Regulation for you; we process that data as a service provider, on your instructions, only in order to run the Service.

4. How long we keep it

• Account data — for as long as your account exists, then up to 30 days after deletion in the live system and up to 90 days in backups.
• Invitation content and guest lists — for as long as the event exists in your account; you can delete an event yourself at any time. A published invitation stops being publicly accessible 5 days after the event date.
• Order and accounting records — for the period required by the accounting and tax law of the Republic of Lithuania, as a rule up to 10 years from the end of the financial year.
• Support correspondence — up to 3 years, so that we can follow up on a complaint.
• Technical and security logs — up to 12 months.

When a retention period ends we delete the data or irreversibly anonymise it.

5. Who else processes the data

We do not sell personal data and we do not share it for anyone else's marketing. We work with a small number of processors, each bound by a data-processing agreement under Article 28 GDPR:

• Stripe — payment processing, fraud prevention and payment records. For card data and its own anti-fraud obligations Stripe acts as an independent controller under its own privacy policy.
• Our hosting and storage provider — servers, database and photo storage.
• Our email provider — sending transactional email and running the info@wedify.fun mailbox.
• Sign-in providers — only if you choose to sign in with an external account, and only to the extent needed to identify you.

We also disclose data where the law requires it, for example to a court or a competent authority, and, if the business is ever sold or reorganised, to the acquirer, after telling you in advance.

Remember that a published invitation is public by nature: anyone holding the link can see what you have put on it. Your guest list, the RSVPs and your account data are not public.

6. Transfers outside the EU/EEA

We keep data within the European Economic Area wherever we can. Some providers may process data outside the EEA. Where that happens, the transfer is covered either by an adequacy decision of the European Commission or by the Commission's Standard Contractual Clauses together with additional technical and organisational safeguards.

You can ask us for details of the safeguards for a specific transfer at info@wedify.fun.

7. Your rights

As a data subject you have the right to:

• access your data and receive a copy of it — Article 15;
• have inaccurate data corrected — Article 16;
• have your data erased, including by deleting your account — Article 17;
• restrict processing while a dispute about the data is resolved — Article 18;
• receive the data you gave us in a structured, machine-readable format and have it transmitted to another controller — Article 20;
• object to processing based on our legitimate interests, and at any time to direct marketing — Article 21;
• withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal — Article 7(3).

We do not take decisions with legal effects about you by automated means and we do not profile you within the meaning of Article 22 GDPR.

To exercise any of these rights, write to info@wedify.fun. We reply within one month; if a request is complex we may extend that period by a further two months and we will tell you why. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.

You also have the right to lodge a complaint with a supervisory authority: the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, L. Sapiegos g. 17, 10312 Vilnius, ada@vdai.lrv.lt), where we are established, or the authority of the EU country where you live or work. Contact details of all national authorities are published by the European Data Protection Board.

• State Data Protection Inspectorate (vdai.lrv.lt)
• List of national supervisory authorities (EDPB)

8. Cookies and similar technologies

We keep this simple and use only what the Service needs:

• Strictly necessary cookies — your sign-in session and refresh token, protection against request forgery, the NEXT_LOCALE language cookie, the anonymous builder session that keeps your draft before you register, and the note that you have dismissed the cookie banner. These do not require consent, because without them the Service cannot work.
• Optional cookies — analytics or marketing cookies are set only after you agree to them. You can change your mind at any time by clearing cookies in your browser.

Most browsers let you block or delete cookies. Blocking the strictly necessary ones will break signing in and the builder.

9. Security

Passwords are stored only as bcrypt hashes. All traffic runs over HTTPS. Access to production data is limited to the people who need it, sensitive endpoints are rate-limited, and we keep backups and monitor for errors and abuse.

If a personal data breach ever puts your rights and freedoms at high risk, we notify the supervisory authority and you within the deadlines of Articles 33 and 34 GDPR.

10. Children

The Service is not aimed at children, and you must be at least 16 to open an account. If you believe that a child has given us personal data, write to info@wedify.fun and we will delete it.

11. Changes to this policy

We may update this policy, for example when the Service changes or a new provider is added. The current version is always on this page with its “last updated” date. If a change materially affects you, we tell you by email before it takes effect.

12. Contact

For any question about personal data, or to exercise your rights, write to info@wedify.fun.

• Controller: the operator of Wedify — a private individual resident in the Republic of Lithuania
• Email: info@wedify.fun