Privacy

What is kept, and for how long

RSVP replies and the floor plan (if the couple uses it) are kept for 90 days after that wedding’s date, and are then deleted. The invitation and the album photos stay for as long as the plan the couple bought: 12 months after the wedding with Essential, 24 with Complete and 36 with Turnkey, or longer if the couple renews it. At the end, the invitation is taken down — its address only shows a closing page, with no names or photos — and the invitation, its photos and the album are deleted. The visit count for each invitation (whether the link was opened, whether the seal was tapped, and how many times) stores neither IP address nor browser. Photos are stored without the camera’s internal data (place and device); a video, on the other hand, keeps them as the phone recorded them, sometimes including the place.

The host’s technical log. Every time a page of this site is opened or one of its photos is requested, the host (Vercel) records the request: the IP address, the browser and what was requested, which, if it is an invitation link, contains that group’s code. Any web server does this; it is used for the site’s security and to find faults, and it is deleted automatically after one hour. Separately, to curb abuse — a form sent a hundred times, attempts to get into an account — the application remembers the IP address in the server’s memory, never in a database, and forgets it when that server shuts down. None of this is used to find out who you are, nor does it go into the shop’s visit counter.

If the couple has not entered the date of their wedding, both periods start on the day the invitation was created. And if the invitation was created after the wedding, they also start on that day, so that nothing is deleted on the invitation’s first day.

The guest list is written by the couple: the name of each group and of the people in it and, if the couple adds them, one phone number per invitation, some labels to keep organised and a private note that never reaches the invitation. Only the couple and anyone they add to their dashboard see it (and our support, only in the cases under “Support access” below). It is used to send out the links (the phone number, to open their own WhatsApp chat with you; nobody writes to you from here), and it is deleted along with the replies, after 90 days.

Shared links. If the couple shares a read-only link to the playlist, the seating plan or a selection of the responses with the DJ or the venue, that link never carries allergies or any other health data. It expires after 30 days, or sooner if the couple revokes it from their dashboard; while it is live, anyone who has it can open it, with no password needed.

Accounts and unfinished purchases. If you have an account — because you bought a template or because a couple added you to their dashboard — we keep your email address, your name, your password (only its fingerprint, a hash, never the password itself) and, if you sign in with Google, that Google account’s identifier and email address. They are kept while you have a wedding online here, and deleted the night the last one is taken down. If the couple removes you from their dashboard and you have no wedding left, the account is deleted at the next clean-up if it is more than 24 months old. If you start a purchase and do not get as far as paying, what you typed to create the account is deleted after 30 days at most. Both can be deleted sooner if you ask us at info@alkitu.com.

Shop contact and alerts. If you write to us through the contact form — to ask something, to be told when a template comes out, or to ask for a bespoke one — we keep your name, your email address and the reason and, if you give them, the template, your wedding date and your message. They are used to reply to you and, only if you asked for it, to tell you about a new template; we do not sign you up to any newsletter. They are kept with the rest of the shop’s data and passed to no CRM and to nobody else: by email, through Resend, we only receive an alert with the reason, without your name, your email address or your message. They are deleted 36 months after you write to us, or sooner if you ask us.

Photos the couple asks for when you reply. The couple can ask, in the RSVP, for one or more photos of you (for instance, one of you as a baby) for activities at the wedding and to print them. Each photo is kept in two sizes for the web and in one copy for printing, all three on Cloudflare R2 and without the camera’s internal data. Your name next to the photo is only seen by the couple and by anyone they add to their dashboard (and by our support, in the cases under “Support access”); if the couple decides to show the photos on the website, the other guests see them without a name. You can remove them yourself from your link; otherwise they are deleted from this site with the rest of the album, when the invitation is taken down. The copy the couple downloads to print stays with them, and the couple is responsible for it. Whoever uploads a photo of someone else declares they have that person’s permission and, for a child under 14, that of their mother, father or guardian (Art. 7 of Spain’s data protection act, the LOPDGDD). Photos of children are not shown on the public website even if the couple opens the collection: only the couple, anyone they add to their dashboard and, if the couple chooses, the guests with the labels they pick can see them.

Support access. Nobody on the Alkitu team enters a wedding’s dashboard — where the guest list, the replies, the allergies and the photos with their names are — unless the couple allows it from their dashboard so that we can help them with a problem. That permission lasts 7 days and the couple can withdraw it sooner. Each access lasts at most 24 hours, never longer than the permission, carries a written reason, is notified to the couple by email and stays in a log that the couple sees in their dashboard and that is deleted with the replies, after 90 days. Without that permission we only enter for a security incident or because the law requires it, with the same notice and the same log. Whoever enters is bound by confidentiality and uses what they see only to solve the problem.

On your device

This site stores a few things on your own device, none of them to track you and none of them leaving here: a session cookie, which keeps you signed in when you use a password; a cookie remembering that you already opened this invitation’s envelope, so the envelope animation is not replayed on every visit; your language and day-or-night preferences, stored in the browser itself — the latter also in a short cookie, so that the error screen can respect it without reading anything else; and, while you fill in your reply, a draft of what you are writing — allergies included — so that it is not lost if you close the page. That draft lives only in your browser, is deleted when you send, and, if you never send, expires after 30 days; on a shared device the form itself tells you it has recovered the draft and lets you discard it. If you ask us not to count your visits to the shop, a marker remembering it is also stored: the same for everyone who asks, and it never leaves your device. None of this is used to follow you across other sites.

Allergies and intolerances

If you write down an allergy or an intolerance, that is health data: a special category under Art. 9 of the GDPR. It is processed only with your explicit consent — the box you tick when you confirm — and for one thing only: so that the kitchen knows what you cannot eat. It is used for nothing else, cross-referenced with nothing, and deleted along with the rest of your reply after 90 days.

It is seen by the couple who invited you and by whoever they put in charge of the food and, only in the cases under “Support access” (in “What is kept, and for how long”), by our support for the duration of that access, bound by confidentiality. Exactly what you write is stored, and nothing more: if you leave the box empty, there is no health data to process.

Visits to the shop

What is counted. When you open a page of the shop — the home page, how it works, pricing, the FAQ, the templates and their pages, bespoke or contact — your browser sends us a small notification and we add one to that day’s counter. The counter records the page, the language you read it in, where you came from and whether it was a phone, a tablet or a computer. Where you came from means the campaign tags of the link (utm_source, utm_medium and utm_campaign) if it carries them; otherwise the name of the site that linked you, only its domain and never the full address; and otherwise, “direct”. Nothing else.

Nothing that identifies you. The counter keeps neither your IP address, nor your browser, nor the time (only the day), nor any cookie, and it leaves nothing on your device to recognise you: each visit is added to a total and no row is yours. It is cross-referenced with nothing and does not leave here: no third-party tags, no pixels, no Google Analytics. Your browser’s notification goes, like any other request, through the host’s technical log (under “What is kept, and for how long”), deleted after one hour, and abuse protection looks at your IP address in the server’s memory so that nobody inflates the counter, without keeping it. Wedding invitations, the dashboards and the checkout are not counted.

Why we do not ask for your consent. It is audience measurement done by us alone, only to know which pages are read and where people come from, with anonymous statistics: the kind the Spanish and French data protection authorities (AEPD and CNIL) exempt from consent when those conditions are met, with notice and a right to object. Its basis is our legitimate interest in improving the shop (Art. 6(1)(f) GDPR). The counters are deleted 25 months after their day.

How to object. If your browser sends the do-not-track signal (Global Privacy Control or “Do Not Track”), we do not count your visits. And you can ask for it right here for this browser: the button below stores a marker in it, the same for everyone who asks and which never leaves your device; while it is there, your browser does not send the notification. If the browser does not allow it to be stored, your visits are not counted either. The marker goes away if you clear this site’s data, or with “Count my visits again”.

Why we are allowed to process your data

• Buying a template — performance of the sales contract: without an email address and a password there is no account with which to sign in and edit the invitation that has just been paid for.
• The billing country of a purchase — a legal obligation (Art. 6(1)(c) GDPR): Stripe passes it to us with the payment and we keep it with the purchase, because it is what tells us which VAT applies.
• Where a purchase comes from — our legitimate interest (Art. 6(1)(f) GDPR) in knowing which channel works for us, and nothing else: with the order we keep the campaign tags of the link you arrived through (utm_source, utm_medium and utm_campaign) and, if you answer it, your reply to “How did you hear about us?”. No cookies and no tracking anywhere: they are kept with the purchase record, here and at Stripe.
• Counting visits to the shop — our legitimate interest (Art. 6(1)(f) GDPR) in knowing which pages are read and where people come from, with anonymous counters and no cookies: it is the audience measurement the AEPD and the CNIL exempt from consent, and you can object under “Visits to the shop”.
• Confirming your attendance — your consent: you give it by sending the form, and you can withdraw it at any time by writing to info@alkitu.com.
• The allergy or intolerance you write down — your explicit consent, the one Art. 9 requires and the section above explains.
• Knowing whether the link was opened — the legitimate interest of the couple who invited you in checking that their invitation arrived. No IP address, no browser: only the group that link was sent to.
• The technical log and abuse protection (IP address, browser and page requested) — our legitimate interest in the site being secure and working.
• The guest list the couple keeps (names and, if they add them, each invitation’s phone number, labels and private note) — the couple’s legitimate interest in organising their wedding and getting the invitation to you.
• Writing to us through the contact form, or asking to be told — your consent: the box you tick when you send it. You can withdraw it at any time by writing to info@alkitu.com; we then stop writing to you and delete what you sent us.
• The photos the couple asks you for when you reply — your consent (Art. 6(1)(a) GDPR): the box you tick when you send them. You can withdraw it by removing them from your link or by writing to info@alkitu.com.
• Support access to a wedding’s dashboard — with the couple’s permission, the performance of their contract with us: helping them with a problem is part of the service. Without their permission, only our legitimate interest in handling a security incident (Art. 6(1)(f) GDPR) or a legal obligation (Art. 6(1)(c) GDPR). Your allergy is never used for anything other than the meal: support only sees it if it is on the screen that needs fixing.

Sub-processors

• Vercel — hosting and functions
• MongoDB Atlas — documents
• Cloudflare R2 — files
• Stripe — shop payments
• Resend — transactional email
• Google — sign-in, only if you choose to sign in with Google (we receive your email and an account identifier; never your password)

Every typeface is served from this same site: the browser never asks Google Fonts for anything.

WhatsApp is not on the list because it processes nothing on our behalf, but two paths do go through Meta, which runs it. If you write to us on WhatsApp, the conversation is under its own terms and we only use it to reply to you; if you would rather it did not go through Meta, write to info@alkitu.com. And if the couple sends you the invitation with the button in their dashboard that opens WhatsApp, that button opens a WhatsApp web address (wa.me) that already carries your phone number and the written message (the greeting with your name, the couple’s names, the date and your personal link), so that data may pass through Meta’s web servers when it opens, before the conversation’s end-to-end encryption. The WhatsApp button in the list of replies carries only your phone number. If you would rather your link did not go that way, tell the couple: they can copy it and send it to you however they like.

International transfers

• Vercel — United States (Washington, D.C.). Everything sent to this site goes through its functions, your reply and your allergy included; and the photos, videos and song of the invitation reach you through them, even though they are stored with Cloudflare R2. Safeguard: EU-U.S. Data Privacy Framework
• MongoDB Atlas — United States (the east of the country, region us-east-1). This is where replies, the guest list, accounts and contacts are stored. Safeguard: EU-U.S. Data Privacy Framework
• Cloudflare R2 — a US company; it stores the files (album photos and videos among them) wherever its network chooses. The sample videos on the home page are requested directly from its network, so it receives your IP address if one of them plays. Safeguard: EU-U.S. Data Privacy Framework
• Stripe — United States. Shop payments only: nothing to do with guests. Safeguard: EU-U.S. Data Privacy Framework
• Resend — United States. The email this site sends: accounts, purchases and alerts to the couple and to the shop. Safeguard: EU-U.S. Data Privacy Framework
• Google — United States. Only if you choose to sign in with Google. Safeguard: EU-U.S. Data Privacy Framework

They are all US companies, so what they process on our behalf may leave the European Economic Area, and with Vercel and MongoDB Atlas it always does, because the functions and the database are there. The United States has no adequacy decision from the European Commission as a country; there is one for companies that have joined the EU-U.S. Data Privacy Framework (decision of 10 July 2023). With a company that has not joined it, the transfer rests on the standard contractual clauses adopted by the Commission (Art. 46(2)(c) GDPR), included in its processing agreement.

You can ask for a copy of those safeguards by writing to info@alkitu.com.

Your rights, and data breaches

• Access — to know whether we process data about you and to receive a copy.
• Rectification — to correct what is wrong or incomplete.
• Erasure — to have it deleted before the period ends: your reply, your allergy, your account or your invitation.
• Restriction — to have it kept without being used while something you raised is checked, for example whether it is accurate or whether your objection holds.
• Portability — to receive what you gave us (your reply, your account) in a format a computer can read, to take it elsewhere.
• Withdrawing consent — the one for your reply, the one for your allergy, the one for your photos or the one for the contact form, at any time and without giving reasons. What was done before stays valid; whatever depended on it is deleted.

Objection. You can object to anything based on legitimate interest (the list under “Why we are allowed to process your data”), and in particular to the counting of opens of your link and to the guest list the couple keeps, on grounds relating to your particular situation. If you do, that data about you stops being processed, unless there are compelling legitimate grounds that override yours; in that case, we tell you what they are. For the counting of opens, it is enough to ask the couple: from their dashboard, the times you open your link stop being recorded and what was already recorded is deleted. For visits to the shop there is no need to write to us: your browser’s do-not-track signal or the button under “Visits to the shop” is enough.

To exercise any of these rights, write to info@alkitu.com and, if it is about a wedding, tell us which one. It costs nothing. If you are a guest, you can also ask the couple who invited you directly: from their dashboard they can correct or delete your reply and your invitation.

A personal data breach is reported to the Spanish Data Protection Agency (AEPD) and to info@alkitu.com.

If our answer does not satisfy you, or never arrives, you can complain free of charge to the Spanish Data Protection Agency: www.aepd.es. You do not have to write to us first, although it is usually quicker.