1. Data Controller

The data controller responsible for the processing of your personal data is:

2. Information We Collect

We collect the following categories of personal data:

• Account data — your name and email address provided at registration
• User-generated content — photos and media files uploaded by you or your guests
• Technical data — IP address, browser/device information, and server access logs collected automatically when you use the Service
• Payment data — payment transactions are handled directly by Stripe; we receive only a transaction status and your selected package type. We do not store payment card details.

3. Purpose of Processing

We process personal data for the following purposes:

• Providing and operating your private wedding photo gallery
• Enabling guests to upload and access photos via your gallery link
• Ensuring the security, integrity, and fraud prevention of the Service

4. Legal Basis for Processing

We process your personal data on the following legal bases under GDPR Article 6:

• Performance of a contract (Art. 6(1)(b)) — processing is necessary to provide the Service you have purchased or are using
• Legitimate interests (Art. 6(1)(f)) — processing is necessary for our legitimate interests in maintaining the security of the Service, preventing abuse, and ensuring service integrity

5. Payment Processing

• Payments on WeddingCircle are processed by Stripe, Inc. (stripe.com), a third-party payment processor. When you complete a purchase, your payment details are submitted directly to Stripe.
• We do not store, access, or process your payment card information. We receive only a confirmation of the transaction status and the package identifier.
• Stripe may process your payment data in the United States and other jurisdictions outside the European Union.
• Stripe's use of your data is governed by Stripe's Privacy Policy, available at stripe.com/privacy.

6. User-Generated Content

• You retain full ownership of all photos and content you upload to WeddingCircle.
• By uploading content, you grant us a limited, non-exclusive, royalty-free license to store, process, and serve that content solely for the purpose of providing the gallery service to you and your guests.
• We do not use your uploaded content for any other purpose, including advertising, training of machine learning models, or sharing with third parties beyond what is necessary to operate the Service.

7. Data Retention

• User accounts are retained for the duration of the active package period and are deleted upon expiration.
• Basic Package — photos, content, and account data are retained for 6 months from the date of gallery activation.
• Premium Package — photos, content, and account data are retained for 12 months from the date of gallery activation.
• Upon expiration of the package period, all uploaded content and associated account data are permanently and irreversibly deleted within 7 days. No backups of user data are retained beyond the active service period.
• You may request early deletion of your data at any time by contacting us at kristijan@dakovic.dev. We will process such requests within 30 days.

8. International Data Transfers

To deliver the Service, your data may be processed by or transferred to the following infrastructure providers, some of which operate outside the European Union:

• Cloudflare R2 — object storage for uploaded photos; data may be processed in the United States and globally
• Vercel — application hosting; data processed in the United States
• Railway — database hosting; data processed within the European Union
• Stripe — payment processing; data processed in the United States

Where transfers occur to countries outside the EU/EEA, providers rely on Standard Contractual Clauses (SCCs) or other GDPR-approved transfer mechanisms.

9. Data Sharing

• We do not sell, rent, or share your personal data with third parties for marketing or commercial purposes.
• Personal data is shared only with the infrastructure and payment providers listed in Section 8 (International Data Transfers), and only to the extent necessary to provide the Service.
• We may disclose your data if required to do so by applicable law, court order, or regulatory authority.

10. Your Rights (GDPR)

If you are located in the European Union or European Economic Area, you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete personal data
• Right to erasure — request deletion of your personal data (subject to legal retention obligations)
• Right to restriction — request that we restrict processing of your data in certain circumstances
• Right to data portability — receive your data in a structured, machine-readable format
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing
• Right to lodge a complaint — you have the right to file a complaint with the Croatian Personal Data Protection Agency (AZOP, azop.hr) or the supervisory authority in your country of residence

11. Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encrypted data transmission (HTTPS/TLS), strict access controls, and secure cloud storage infrastructure. While we take reasonable precautions, no system is completely immune to security risks, and we cannot guarantee absolute security.

12. Cookies and Tracking

WeddingCircle does not use cookies, tracking pixels, local storage identifiers, or any other tracking technologies. We do not use third-party analytics platforms (such as Google Analytics) on this Service.

13. Contact

To exercise your rights, submit a data-related request, or ask any privacy-related questions, please contact us at: kristijan@dakovic.dev