Privacy

Who we are and what this document covers

Effective from: 1 November 2026

The Czech version of this document is the binding one. This English text is provided for convenience; if the two differ, the Czech version prevails.

This document explains what personal data the Svatební Pozvánka service processes, why, for how long and what rights you have. The service is operated by Osmanthus s.r.o., with its registered office at Dlouhá 730/35, Staré Město, 110 00 Praha 1, Czech Republic, company ID (IČO) 22257861 ("we" or "the operator"). Contact for personal data matters: info@svatebni-pozvanka.cz. We have not appointed a data protection officer because the nature of the service does not require one; please contact us directly.

The processing is governed by Regulation (EU) 2016/679 (GDPR) and Czech Act No. 110/2019 Coll., on the processing of personal data.

Two roles: the couple and the guests

Two groups of people appear in the service, and our role differs for each. Put simply:

The couple who created the invitation. We process the couple's data, including the e-mail address the couple sign in with, as the controller: we decide how the invitation is stored and shown.
The guests, whose names the couple entered into the invitation and who replied to the invitation. The guest list is the couple's list: the couple decide whom to invite and what to enter about them, and so they are the controller of this data. We process it on behalf of the couple and on their instructions as the processor. This document is also our data processing agreement with the couple.
Administrators added by the couple, that is people to whom the couple have entrusted editing the invitation together, for example a sibling. As with the guest list, the couple decide whom to add, so they are the controller of those e-mail addresses and we process them as the processor.
Technical records of operation (hosting access logs, security records) we keep as the controller, because they serve to keep the service running and secure.

A guest who has a question about their data can contact either us or the couple; we will help in both cases.

What data we process

About the couple: everything the couple put into the invitation — the names of the engaged couple and their families, the dates and places of the ceremonies and the reception, photographs, a music recording, texts, the account number and QR code for wedding gifts — and earlier versions of this content that the couple saved. Also the private link to the editor.

About the invitation's administrators: the e-mail address they sign in with, through Google or with a code sent by e-mail. For each address we store only that it is an administrator of a particular invitation, who added it and when. We store no password, nor any name or photograph from the Google account. When someone signs in with a code, we keep a hash of that code and the e-mail address for at most 24 hours, then delete them. To protect accounts we count failed sign-in attempts for each address per day — counts only, with the address kept only as a one-way hash and no IP address at all — for 90 days, and if somebody keeps trying, we send that address one warning e-mail at most once every 24 hours. When you confirm a sign-in on another device, we keep the requesting browser family, operating system and country on the sign-in record for at most 24 hours, so that the other device can show them to you. For each address we also remember the language it last used on our website, in the editor or when ordering, so that we can write to it in that language.

About the trial invitation: If you ask for the link to a trial invitation to be e-mailed to you, we store that address, send the link to it and at most one reminder, and delete the address together with the trial invitation, or as soon as you save the invitation to your account.

E-mails from the service: we send e-mails connected with the service to the e-mail addresses of an invitation's administrators: a welcome, a notice that the personal links your plan allows are running out, a purchase confirmation (to the buyer) and, after the event, a congratulation. You can unsubscribe, with the link in the e-mail, from the congratulation and from the reminder about a trial invitation, which the service does not need in order to run; we then stop writing to you and keep only a record that you unsubscribed.

About the guests: the name and form of address as the couple entered them, possibly a group (family, table), the side of the family, the language, the guest's personal link, when the link was sent to them and when they first and last opened the invitation. From the guest's reply: whether they will come, with how many people, dietary needs, choice of meal and a message if the guest wrote one. Also a record that the guest opened the gifts section, copied the account number or displayed the QR code — only that it happened, not any amount or payment.

Photo album from guests: the photos guests upload to the invitation's album, the name of whoever uploaded the photo (the guest's name on a personal link, or the name entered on the shared link, if one was entered) and the time of upload. Guests are shown only reduced-size versions created by the server, without EXIF data (for example GPS location); only the couple can download the originals.

Photo upload log: for every attempt to upload a photo to the album, accepted or rejected: the time, the invitation, the e-mail addresses of its administrators at that moment, the guest or the name entered, the IP address (in its original form and as a one-way hash), browser details, the size and type of the file and the result.

Result of the automated check: the score the checking model running on our server gave each photo, and whether the photo was flagged.

Technical data: the IP address and browser details in the hosting access logs, for a short time, as is usual in running a website.

The invitation guide: we record which steps of the guide a couple saw, confirmed or skipped and where they left it (the step's code, the kind of event, the time and the invitation's internal identifier), without any content the couple entered, in order to improve the guide.

Visitors to the public pages: before you make a choice in the cookie bar, and if you refuse, Google's measuring tools still load on the public pages, but with every kind of storage switched off: they send Google a request without cookies (a "cookieless ping") saying that a page was viewed, with the technical details any request to a server carries (the IP address, the browser). Nothing is stored on your device and the request carries no identifier of you; Google uses such requests only to estimate overall statistics (modelling). If you accept analytics cookies in the cookie bar, Google Analytics measures your visit to the home page, the blog, the legal documents and the page shown after payment: which pages you opened, where you came from, the type of device and browser, and an approximate location that Google derives from the IP address (Google Analytics does not store the IP address itself). If you accept advertising cookies, we keep the Google ad click identifier (gclid, gbraid, wbraid) and the campaign tags of the link (UTM), and attach them to an order you place, so that we can tell Google that an ad led to a purchase. We pass Google only the order number, the kind of plan and the amount, never an e-mail address, a name or anything from the invitation. Google Tag Manager, the tool through which we load further measuring and advertising tags of Google, loads only with your consent and only on the public pages (not on the page shown after payment). Invitations and guests' pages, the editor, the account and the administration are never measured. The home page may be shown in one of several versions of its text; we count only, in aggregate and anonymously, how many times each version was shown and how many of those led to an invitation being created or paid for, without cookies and without an IP address or any other identifier.

If you consent to analytics cookies, Microsoft Clarity also runs on the public pages (except the page shown after payment): it records how a page is used (movement, clicks, scrolling, the type of device and browser, an approximate location derived from the IP address) and builds recordings of visits and aggregate heatmaps from it, which we use to improve the pages. Text you type into forms is not recorded: it is hidden in the recording. Without your consent Clarity does not load at all; it never runs on invitations, guests’ pages, the editor, the account or the administration.

We do not collect payment data. A bank transfer takes place between the guest and the couple; a card payment takes place on the page of Stripe under its own terms, and we receive no card details.

Payments for plans: a plan is bought on the page of Stripe, which processes the payment; we receive no card details. A buyer who buys for a business also enters the details for the invoice on Stripe's page (company name, VAT number, address), and Stripe issues the tax document from them. We store the buyer's e-mail address, the amount paid including VAT and the document number.

Why and on what legal basis

The couple's data, including the e-mail address the couple sign in with, we process so that we can create, store and show the invitation and let only the right people into the editor — that is, to perform the contract with the couple (Article 6(1)(b) GDPR).
The guests' data we process on the couple's instructions as the processor. The couple rely on their legitimate interest in inviting guests to their own wedding and finding out who will come (Article 6(1)(f) GDPR); this is the ordinary situation of somebody keeping a guest list for a family celebration.
The e-mail addresses of administrators added by the couple we likewise process on the couple's instructions as the processor. The couple rely on their legitimate interest in preparing the invitation together with those close to them (Article 6(1)(f) GDPR).
A guest's message is voluntary. By writing and sending it, the guest agrees that the couple will see it (Article 6(1)(a) GDPR). The guest can change or delete the message at any time by replying again, or by asking us.
Technical records we keep out of a legitimate interest in the secure and working operation of the service (Article 6(1)(f) GDPR).
Photos in the album we process on the couple's instructions as the processor, in the same way as the guest list.
The upload log and the automated check we carry out out of a legitimate interest in preventing unlawful content, handling reports, protecting the people affected and cooperating with law enforcement authorities (Article 6(1)(f) GDPR). The automated check only flags a photo for a person to review; no decision is made purely automatically. The model runs on our own server and photos are never sent to third parties for checking.
Measuring visits and advertising (Google Analytics, Microsoft Clarity, Google Ads) with cookies and identifiers we do only with your consent (Article 6(1)(a) GDPR and Section 89(3) of Czech Act No. 127/2005 Coll., on electronic communications). You can change or withdraw your consent at any time through the "Cookie settings" link in the footer of the pages; withdrawal does not affect processing before it. The cookieless requests sent before a choice or after a refusal we send out of a legitimate interest in knowing, in aggregate, how the public pages are used (Article 6(1)(f) GDPR); they store and read nothing on your device.
The trial e-mail (the link and the reminder for a trial invitation) we process at your request, to do what you asked for, that is to perform a contract (Article 6(1)(b) GDPR).
E-mails from the service (the welcome, the notice about the limit of personal links and the purchase confirmation) we send to perform the contract for the service (Article 6(1)(b) GDPR). The congratulation after the event we send out of our legitimate interest in greeting the couple after the event (Article 6(1)(f) GDPR); you can unsubscribe from it at any time with the link in the e-mail.
Payments for plans we process to perform the contract with the buyer (Article 6(1)(b) GDPR).

Who sees the data

Invitations and guests' pages are not published anywhere: only somebody who knows the link can open them, and search engines are forbidden to index them. The couple see the guests' replies in their overview; every administrator of the invitation sees the same as the couple, including the list of administrators. A guest's message appears on the invitation only if the couple decide to show it to the other guests.

We do not sell the data to anyone. For measurement Google receives from the public pages only what this document describes, and never anything from an invitation or about guests.

Who helps us (processors)

We run the service with the help of the following suppliers, who process data for us under our agreements with them:

Hetzner Online GmbH — hosting of the website and storage of uploaded photographs and music on the server's disk. The server is located in Germany, in the European Union.
Cloudflare, Inc. — a CDN and proxy in front of the website. The servers may be outside the European Union; in that case the transfer of data is covered by the European Union's standard contractual clauses.
Turso (ChiselStrike Inc.) — the database in which the invitation content, the guest list and the replies are stored.
Sentry (Functional Software, Inc.) — monitoring of the service's errors. Technical error reports are sent to Sentry; personal data is removed before sending: no IP addresses and no e-mail addresses are sent, and private links are masked. The data is stored in the European Union (Germany).
Slack Technologies — only if the couple have switched on notifications of new replies: the guest's name and reply are then sent to the couple's private channel.
Stripe — when a plan is bought (including the invoice details entered by a buyer who buys for a business) and also if the couple offer a gift by card payment. Stripe acts as an independent controller; when paying on its page, its own terms and privacy policy apply.
Resend (Plus Five Five, Inc.) — sends e-mails: the sign-in code, only when someone chooses to sign in by email, and the notice to an invitation's administrators before it is deleted (see below), and also the e-mails from the service described above: the welcome, the notice about the limit of personal links, the purchase confirmation, the congratulation, and the link and reminder for a trial invitation. It receives only the email address and the e-mail's content: the code, the deletion date, the couple's names and the link to the editor, or the text of the e-mail in question. Its servers may be outside the European Union; any such transfer is covered by the EU Standard Contractual Clauses.
Anthropic, PBC (USA) — only if the couple use "Fill it in for me" in the editor: the text and photos they provide are sent to Anthropic's language model, which suggests details for the invitation; and if they use "Help with guests", the guest list they provide (see Filling in with AI).
Google (for users in the European Economic Area, Google Ireland Limited) — only when somebody chooses to sign in to the editor or to the administration. Google is not our processor: it handles the sign-in as an independent controller under its own terms and privacy policy and passes us only the verified e-mail address.
Google Analytics and Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) — only on the public pages: with your consent with cookies, otherwise only the cookieless requests described above. For Google Analytics Google is our processor; for Google Ads and conversion measurement it is an independent controller under its own terms and privacy policy. Data may also be transferred to Google LLC in the USA; the transfer is governed by the EU–US Data Privacy Framework, to which Google LLC has committed, and by the European Union's standard contractual clauses. Google Analytics data is kept for 14 months.
Microsoft Clarity (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) — only on the public pages and only with your consent to analytics cookies: it helps us understand how visitors use the pages. Microsoft is our processor for it. Data may also be transferred to Microsoft Corporation in the USA; the transfer is governed by the EU–US Data Privacy Framework, to which Microsoft Corporation has committed, and by the European Union’s standard contractual clauses. Microsoft keeps recordings of visits for 30 days and heatmaps and aggregate data for 13 months; we also keep the aggregate figures (visits and click shares per page, no recordings) ourselves.

We pass data to no other recipients unless the law requires us to. In the case of unlawful content we may preserve the photo concerned and the records of its upload as evidence, separately from the album, and on a lawful request hand them to law enforcement authorities. We keep the evidence until the matter is closed and then delete it; every handover is recorded. Contact for law enforcement authorities: abuse@svatebni-pozvanka.cz.

Filling in with AI

If the couple use "Fill it in for me" in the editor, the text they paste and the photos they upload are sent to Anthropic, PBC (USA), which runs the language model for us as a processor and suggests details for the invitation from them. This happens at the couple's request, to perform our contract (Art. 6(1)(b) GDPR). We do not store the photos and use neither the text nor the photos for anything else. Under its commercial terms Anthropic does not use API data to train its models and keeps it only for a limited time for safety and abuse prevention. The transfer to the USA relies on the EU Standard Contractual Clauses. We store only the number of uses and the tokens processed, never the content. Suggestions are saved to the invitation only once the couple confirm them, and nothing is sent to the guests. Please don't paste details that don't belong on an invitation (such as ID or bank account numbers).

If the couple use "Help with guests" on the guests page, the guest list they paste or upload is sent to Anthropic in the same way, so that the model can suggest rows for the list (the name on the envelope, the salutation, the language, and the side or group where given). We read an uploaded file (CSV or XLSX) on our own server and send Anthropic only its text, never the file. The couple are the controller of their guest list, we process it as their processor on their instructions, and Anthropic is our sub-processor; everything above applies. If the pasted list also contains phone numbers or addresses, they are sent with it, but we do not store them in the guest list. Suggested rows are saved only once the couple have checked and confirmed them, and nothing is sent to the guests.

How long we keep the data

We keep the invitation, the guest list, the list of administrators, the replies and the uploaded files until the couple delete the invitation (which they can do at any time in the editor's Settings), but for no longer than 12 months after the wedding date stated in the invitation. If the invitation has no wedding date, we count from the date of its last ceremony, and failing that from the day the invitation was created. This applies to every invitation, complimentary ones included.

11 months after the wedding we send all the invitation's administrators an e-mail naming the deletion date, with a link to the editor, where, once signed in, they can download a ZIP archive of all the tables from Settings — the guest list and their replies, the choice of menu, the messages and the list of administrators — so that the couple can keep them. The couple download the photographs from the album while it is still shown. At least 4 weeks always pass between this e-mail and the deletion.
12 months after the wedding we delete the invitation from all databases, including earlier versions, the guest list, the replies, the messages and the list of administrators, and delete the uploaded photographs and music from all storage. We keep the payment records (the order and any refund), no longer linked to the invitation, for as long as accounting and tax law require.

We keep database backups for at most 30 days; deleted data is gone from them at the latest after that.

The photo album is shown only for the hosting period of the plan, counted from the date of the event (Free 30 days, Premium 6 months, Exclusive 12 months); we delete photos together with the invitation within the periods above, or earlier if the couple delete them.

The photo upload log, including the original IP address, we keep for 6 months from the upload and it is then deleted automatically, except records preserved as evidence, which are kept until the matter is closed.

The hosting's technical records are deleted automatically within days to weeks. We delete the address of an administrator whom somebody removes from the invitation immediately.

The couple can ask for deletion earlier at any time; we will also delete the guests' data, because it is part of their invitation.

The bin and deleting an invitation. The couple can delete their invitation themselves. It first moves to the bin in their account, where they can restore it for 30 days; guests can no longer open it meanwhile. After 30 days in the bin, or at once if the couple delete it permanently, it disappears from their account, but we keep the invitation and everything that belongs to it for another 30 days, so that we can restore it if the couple ask. After that we irreversibly delete it together with the guest list, the replies, the photos, videos, music and the keepsake book. Payment records are kept for the period the law requires, no longer linked to the invitation. A record of who deleted or restored the invitation, and when, is kept after it is deleted; it contains no guest data.

Cookies

We use only the cookies that are strictly necessary, without which the service does not work:

ll_editor_lang — remembers the language in which the couple opened the editor.
ll_consent — remembers your choice in the cookie bar (whether you accept analytics and advertising cookies), 6 months.

When somebody signs in through Google or with a code sent by e-mail to the editor or to the administration, and only then, the sign-in cookies are added:

authjs.session-token (on an HTTPS connection under the name __Secure-authjs.session-token) — the sign-in session: it contains the verified e-mail address (verified by Google or by the e-mailed code), is signed and encrypted, and is valid for 30 days or until you sign out.
authjs.csrf-token (on HTTPS with the prefix __Host-) — protection against forged requests sent in your name.
authjs.callback-url — where to return to after signing in.
authjs.pkce.code_verifier and authjs.state — they live only a few minutes, during the redirect to Google and back, and ensure that the sign-in really belongs to you.
ll-device-… — set only after you sign in with a code or a link sent by e-mail: for 1 year it remembers this browser as yours for that address, so that the limits meant for strangers do not apply to you; we keep only a one-way hash of it, the country the connection came from and the type of browser.
ll_ref_device — set only for the owner of a referral code (when they create the code or sign in): a random device identifier used only to recognise self-referrals; we keep only its keyed hash, for 90 days. It lasts 1 year.

On the public pages (the home page, the blog, the legal documents, the page shown after payment) the cookie bar asks you about optional cookies. Until you agree, we set none of them; Google's tools then send only the cookieless requests described above:

_ga and _ga_… (Google Analytics, analytics) — tell visitors and their visits apart, 2 years.
_clck and _clsk (Microsoft Clarity, analytics) — tell visitors apart and join the pages of one visit into one recording, 1 year and 1 day. Clarity may also set cookies on Microsoft’s domains (such as CLID, MUID); when you withdraw consent we tell Clarity, which deletes its cookies.
_gcl_au, _gcl_aw, _gcl_gb (Google Ads, advertising) — connect an ad click with an order, 90 days.
ll_attr (ours, advertising) — the ad click identifier and campaign tags of the link you arrived by, so that they can be attached to an order, 90 days.

You can change your choice or withdraw your consent at any time through the "Cookie settings" link in the footer; after withdrawal we delete these cookies. Invitations and guests' pages, the editor, the account and the administration set no analytics or advertising cookies and do not load Google's or Microsoft's tools at all. A guest's page sets no cookie.

Your rights

Under the GDPR you have the right to:

access the data we process about you and to a copy of it;
have inaccurate data corrected;
erasure;
restriction of processing;
portability of the data you gave us;
object to processing based on legitimate interest;
withdraw consent to the processing of a message, without affecting processing before the withdrawal.

Write to us at info@svatebni-pozvanka.cz. We will reply without undue delay and at the latest within one month. A guest can also turn to the couple who invited them; as the couple's processor we will help to deal with their request.

If you believe that we process your data in breach of the law, you can lodge a complaint with the supervisory authority: Úřad pro ochranu osobních údajů (the Czech Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz. If you live in another state of the European Union, you can also turn to that state's supervisory authority.

Security

The invitation is available only through a random link that cannot be guessed; each guest's link is separate and can be invalidated without affecting the others. The link to the editor is separate from the guests' link and is never shown to guests; even so, the editor opens only to a Google account that is an administrator of that invitation. The operator's own administration also signs in through Google, and only its staff can get into it. We store no passwords. The connection is encrypted (HTTPS), uploaded files are stored non-publicly and are served only through the service. Only the people who run the service have access to the database.

Referral codes

If you save a referral code, its owner will see that you saved it and the status of your order (paid, in guarantee, refunded). They see your e-mail address only shortened (e.g. pe•••••••@gm•••.com), and never your name or your invitation. We do this on the basis of our legitimate interest in running the referral programme. If you create a code, we process the details needed to pay your reward (name, company and VAT numbers, address, bank account) to perform the agreement and meet our accounting duties, and keep them for the period the law requires.

To prevent misuse of the referral programme, when a code owner signs in and when someone pays with a referral code we keep only a keyed hash of the IP address (HMAC; never the address itself), and we set a cookie ll_ref_device with a random device identifier in code owners' browsers. We compare them with the purchases made with their code, and the reward recipient's name with the payer's billing name; a match only leads to a manual review of the reward, never to an automatic block. We do this on the basis of our legitimate interest in protecting the programme from fraud. We delete the IP address and device hashes after 90 days; the cookie lasts 1 year.

Changes to this document

We may update this document. The current wording is always on this page with its effective date.