1. Data Controller

The data controller responsible for the processing of your personal data is:

2. Information We Collect

We collect the following categories of personal data:

• Account data — your name and email address provided at registration
• User-generated content — photos and media files uploaded by you or your guests
• Technical data — IP address, browser/device information, and server access logs collected automatically when you use the Service
• Payment data — payment transactions are handled directly by Stripe; we receive only a transaction status and your selected package type. We do not store payment card details.
• Reminder subscriber data — if you subscribe to receive reminder emails, we collect your email address, the consent text you agreed to, and your subscription status

3. Purpose of Processing

We process personal data for the following purposes:

• Providing and operating your private wedding photo gallery
• Enabling guests to upload and access photos via your gallery link
• Ensuring the security, integrity, and fraud prevention of the Service
• Sending reminder emails to subscribers who have opted in, to remind them about the Service at a later time

4. Legal Basis for Processing

We process your personal data on the following legal bases under GDPR Article 6:

• Performance of a contract (Art. 6(1)(b)) — processing is necessary to provide the Service you have purchased or are using
• Consent (Art. 6(1)(a)) — where you have given explicit consent, such as subscribing to receive reminder emails. You may withdraw this consent at any time by using the unsubscribe link included in every email or by contacting us
• Legitimate interests (Art. 6(1)(f)) — processing is necessary for our legitimate interests in maintaining the security of the Service, preventing abuse, and ensuring service integrity

5. Payment Processing

• Payments on WeddingCircle are processed by Stripe, Inc. (stripe.com), a third-party payment processor. When you complete a purchase, your payment details are submitted directly to Stripe.
• We do not store, access, or process your payment card information. We receive only a confirmation of the transaction status and the package identifier.
• Stripe may process your payment data in the United States and other jurisdictions outside the European Union.
• Stripe's use of your data is governed by Stripe's Privacy Policy, available at stripe.com/privacy.

6. Email Communications

We use Resend (resend.com), a third-party email delivery service, to send emails from the Service. This includes:

• Reminder emails — sent only to users who have explicitly opted in by providing their email address and checking the consent checkbox on our website. Each reminder email contains an unsubscribe link.
• Transactional emails — such as contact form confirmations and invoice notifications, sent as part of the normal operation of the Service.

When we send an email via Resend, your email address and the email content are transmitted to Resend's servers. Resend processes this data solely for the purpose of delivering the email on our behalf.

Resend's use of your data is governed by Resend's Privacy Policy, available at resend.com/legal/privacy-policy.

We do not send unsolicited marketing emails. Reminder emails are sent only with your explicit prior consent, and you may unsubscribe at any time.

7. User-Generated Content

• You retain full ownership of all photos and content you upload to WeddingCircle.
• By uploading content, you grant us a limited, non-exclusive, royalty-free license to store, process, and serve that content solely for the purpose of providing the gallery service to you and your guests.
• We do not use your uploaded content for any other purpose, including advertising, training of machine learning models, or sharing with third parties beyond what is necessary to operate the Service.

8. Data Retention

• User accounts are retained for the duration of the active package period and are deleted upon expiration.
• Basic Package — photos, content, and account data are retained for 6 months from the date of gallery activation.
• Premium Package — photos, content, and account data are retained for 12 months from the date of gallery activation.
• Upon expiration of the package period, all uploaded content and associated account data are permanently and irreversibly deleted within 7 days. No backups of user data are retained beyond the active service period.
• You may request early deletion of your data at any time by contacting us at info@weddingcircle.app. We will process such requests within 30 days.
• Reminder subscriber data — your email address and consent record are retained while your subscription is active. When you unsubscribe or after the final reminder has been sent, your data is retained for a limited period for record-keeping purposes and then permanently deleted.

9. International Data Transfers

To deliver the Service, your data may be processed by or transferred to the following infrastructure providers, some of which operate outside the European Union:

• Cloudflare R2 — object storage for uploaded photos; data may be processed in the United States and globally
• Vercel — application hosting; data processed in the United States
• Railway — database hosting; data processed within the European Union
• Stripe — payment processing; data processed in the United States
• Resend — email delivery service; data processed in the United States

Where transfers occur to countries outside the EU/EEA, providers rely on Standard Contractual Clauses (SCCs) or other GDPR-approved transfer mechanisms.

10. Data Sharing

• We do not sell, rent, or share your personal data with third parties for marketing or commercial purposes.
• Personal data is shared only with the infrastructure, payment, and email providers listed in Section 9 (International Data Transfers), and only to the extent necessary to provide the Service.
• We may disclose your data if required to do so by applicable law, court order, or regulatory authority.

11. Your Rights (GDPR)

If you are located in the European Union or European Economic Area, you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete personal data
• Right to erasure — request deletion of your personal data (subject to legal retention obligations)
• Right to restriction — request that we restrict processing of your data in certain circumstances
• Right to data portability — receive your data in a structured, machine-readable format
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing
• Right to lodge a complaint — you have the right to file a complaint with the Croatian Personal Data Protection Agency (AZOP, azop.hr) or the supervisory authority in your country of residence

12. Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encrypted data transmission (HTTPS/TLS), strict access controls, and secure cloud storage infrastructure. While we take reasonable precautions, no system is completely immune to security risks, and we cannot guarantee absolute security.

13. Cookies and Tracking

WeddingCircle does not use cookies, tracking pixels, local storage identifiers, or any other tracking technologies. We do not use third-party analytics platforms (such as Google Analytics) on this Service.

14. Contact

To exercise your rights, submit a data-related request, or ask any privacy-related questions, please contact us at: info@weddingcircle.app