Privacy
In force since .
This notice is published in Spanish, French and English. If you need to read it in another language, write to info@alkitu.com and we will explain anything you want to know about your data.
The data controller is Alkitu (info@alkitu.com). This notice covers each wedding’s invitation and the template store. The processor agreement (Art. 28) is signed by a human; what is published here is the notice and the list of sub-processors, not a notarised PDF. What is being bought, and on what terms, is separate — see the Terms of sale.
What is kept, and for how long
RSVP replies and album photos are kept for 90 days after that wedding’s date, and are then deleted. The visit count for each invitation (whether the link was opened, whether the seal was touched, and how many times) stores neither IP address nor browser.
That period runs from the later of two dates: the wedding’s, and the day the invitation was created — so that an invitation put online after the ceremony is not deleted on its first day.
On your device
This site stores a few things on your own device, none of them to track you and none of them leaving here: a session cookie, which keeps you signed in when you log in with a password; a cookie remembering that you already opened this invitation’s envelope, so the ceremony is not replayed on every visit; your language and day-or-night preferences, stored in the browser itself — the latter also in a short cookie, so that the error screen can respect it without reading anything else; and, while you fill in your reply, a draft of what you are writing — allergies included — so that it is not lost if you close the page. That draft lives only in your browser, is deleted when you send, and, if you never send, expires after 30 days; on a shared device the form itself tells you it has recovered the draft and lets you discard it. None of this is used to follow you across other sites.
Allergies and intolerances
If you write down an allergy or an intolerance, that is health data: a special category under Art. 9 of the GDPR. It is processed only with your explicit consent — the box you tick when you confirm — and for one thing only: so that the kitchen knows what you cannot eat. It is used for nothing else, cross-referenced with nothing, and deleted along with the rest of your reply after 90 days.
It is seen by the couple who invited you and by whoever they put in charge of the food. Exactly what you write is stored, and nothing more: if you leave the box empty, there is no health data to process.
Why we are allowed to process them
- Buying a template — performance of the sales contract: without an email address and a password there is no account with which to log in and edit the invitation that has just been paid for.
- Confirming your attendance — your consent: you give it by sending the form, and you can withdraw it at any time by writing to info@alkitu.com.
- The allergy or intolerance you write down — your explicit consent, the one Art. 9 requires and the section above explains.
- Knowing whether the link was opened — the legitimate interest of the couple who invited you in checking that their invitation arrived. No IP address, no browser: only the group that link was sent to.
Sub-processors
- Vercel — hosting and functions
- MongoDB Atlas — documents
- Cloudflare R2 — files
- Stripe — store payments
- Resend — transactional email
- Google Fonts — typefaces, only if the wedding uses one that is not a default
- Bunny Fonts — typefaces, on the same terms
With the default typefaces — Cormorant, Montserrat and Luxurious, served from this same site — neither of the two is contacted: the browser never asks them for anything.
Your rights, and data breaches
To access, rectify or delete: info@alkitu.com. A security breach is reported to the AEPD and to info@alkitu.com.
If our answer does not satisfy you, or never arrives, you can complain free of charge to the Spanish Data Protection Agency: www.aepd.es. You do not have to write to us first, although it is usually quicker.