Privacy Policy

1. Data controller

Trade name

Ever After Planner

Email

info@everafterplanner.net

Website

www.everafterplanner.net

You can write to us at info@everafterplanner.net or use the contact form on the home page (no account needed).

2. What data we process

• Account data: email address, password (stored encrypted; we cannot see it), your name if you give it, language and account preferences.
• Wedding data you enter: date and venues, budget and expenses, vendors, tasks, menu, speeches and vows, texts and photos of the wedding website, gift registry and, if you choose to show them, details for cash gifts (for example, an IBAN).
• Guest data, entered by you or given by guests in the RSVP: name, contact details, plus-ones, attendance reply, table, menu choice, dietary restrictions or allergies, and messages.
• Payment data: payments are handled by Stripe. We never see or store your full card number. We store the customer ID, plan, subscription status and billing dates.
• Contact and review forms: name, email, subject, message and any files you attach.
• Technical data: IP address, browser and device type, needed to serve the website and for bot protection (hCaptcha).
• Browsing data, only if you accept analytics cookies: pages visited, where the visit came from and actions such as signing up or starting checkout, through Google Analytics.

3. Why we use the data and on what legal basis

• Create and manage your account and provide the planning service, including the wedding website and RSVP. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• Charge the subscription, issue invoices and meet accounting and tax obligations. Legal basis: performance of the contract and legal obligations (Art. 6(1)(b) and 6(1)(c) GDPR).
• Generate AI suggestions when you ask for them (see section 4). Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• Protect the service against fraud, abuse and attacks (captcha, usage limits, technical logs). Legal basis: legitimate interest in the security of the service and its users (Art. 6(1)(f) GDPR).
• Answer the questions you send us. Legal basis: your consent (Art. 6(1)(a) GDPR) and, if you are a customer, performance of the contract.
• Send you Ever After Planner news, only if you tick the box. Legal basis: consent (Art. 6(1)(a) GDPR and Art. 21 of Spanish Law 34/2002, LSSI). You can withdraw it at any time.
• Measure visits and website use with Google Analytics, only if you accept analytics cookies. Legal basis: consent (Art. 6(1)(a) GDPR and Art. 22.2 LSSI).

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). AI answers are suggestions that you review and decide whether to use.

4. Artificial intelligence (Google Gemini)

Some features use the Google Gemini API to generate suggestions. Data is sent only when you press a generate-with-AI button, and only what that feature needs:

• Task plan: wedding date and venue, number of guests, budget and the titles of your current tasks.
• Menu: your preferences (menu type, style, season and budget) and the dietary restrictions and allergies noted for your guests, without their names.
• Speeches and vows: the names and details you write for the text.
• Dashboard summary: the couple’s names and aggregated planning figures (confirmed guests, budget and tasks).

Dietary restrictions and allergies may reveal health data (Art. 9 GDPR). They are sent to Google only when the couple uses AI menu generation, and without guest names. If you do not want them sent, do not use that feature or delete those notes first. Please do not write unnecessary personal data in free-text fields.

Google processes this content as the AI service provider, under the Gemini API terms, to return the answer to us.

5. Guest data

If you are a couple using the app: you decide which guest data you enter, in order to organise your wedding. You must be entitled to provide it and must tell your guests how it is used. We process that data only to provide the service to you; we do not use it for our own purposes and we do not send advertising to your guests.

If you are a guest: your data is used to manage your attendance at the wedding of the couple who invited you (RSVP, tables and menu). Dietary restrictions or allergies you give are used only to adapt the menu. You can exercise your rights with the couple or with us.

The service is intended for adults. If the couple adds minors as guests (for example, children invited to the wedding), they should enter only the data that is strictly needed.

6. Recipients and processors

We do not sell your data. We share it only with the providers we need to run the service. They act as processors under a contract that meets Art. 28 GDPR, unless stated that they are independent controllers:

• Hosting provider: the server that hosts the website, the database, sign-in, files and the functions that prepare payments. The server is in the European Union.
• Stripe Payments Europe, Ltd. (Ireland): payments and subscriptions. Stripe also processes data as an independent controller to prevent fraud and meet its legal obligations (Stripe privacy policy).
• Google (Google Ireland Limited and Google LLC): the Gemini API for AI features; Google Analytics, only if you accept analytics cookies; and Google Fonts, which serves the website font and receives your IP address when it loads.
• Intuition Machines, Inc. (hCaptcha, USA): bot protection on sign-up, sign-in, password recovery and forms.
• Email provider: account emails (sign-up confirmation and password change) and internal notices from forms.
• Cloud storage provider: keeps encrypted backups of the database, which only we can decrypt.
• Unsplash: some decorative images are loaded from its servers, which receive your IP address.

Whatever you publish on your wedding website can be seen by the people you share the link with. We may also disclose data to authorities and courts when the law requires it.

7. International transfers

Some providers (Google, hCaptcha, the cloud storage provider and, through its group, Stripe) are US companies or may access data from outside the European Economic Area. These transfers rely on the EU-US Data Privacy Framework adequacy decision, where the provider is certified, or on the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR). You can ask us for more information about these safeguards.

8. How long we keep data

• Account and planning data, including guest data: while you keep your account. If you delete it from Account > Delete account, it is erased, except as stated below.
• Billing and payment data: for the legal periods (6 years under Art. 30 of the Spanish Commercial Code, and the periods set by tax law).
• Messages sent through the contact form: as long as needed to answer you and then for up to 12 months.
• Consent to receive news: until you withdraw it.
• Google Analytics data: up to 14 months, depending on the Google Analytics retention setting. Cookies last up to 2 years (see the Cookie Policy).
• Technical security logs: for the limited time set by our hosting providers.

When we must keep data because of a legal obligation, we keep it blocked, available only to courts and competent authorities, until the related liabilities expire (Art. 32 LOPDGDD).

9. Your rights

You can exercise at any time your rights of:

• Access: know what data about you we process.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data.
• Objection: object to processing based on our legitimate interest.
• Restriction: ask us to keep the data without using it, in the cases set out in the GDPR.
• Portability: receive the data you gave us in a structured, commonly used format, or have us send it to another controller.
• Withdraw your consent at any time, without affecting the lawfulness of earlier processing.

You can use many of these rights directly in the app: edit your data, cancel your subscription or delete your account from Account. For anything else, write to us stating the right you want to exercise and your account email; if needed, we will ask for information to verify your identity. We will reply within one month, extendable by two more months for complex requests (Art. 12(3) GDPR).

You can write to us at info@everafterplanner.net or use the contact form on the home page (no account needed).

If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid, Spain, www.aepd.es, or with the supervisory authority of your country of residence in the EU.

10. Security

We apply technical and organisational measures suited to the risk: encrypted connections (HTTPS), encrypted passwords, per-user access control in the database and restricted access to systems. No system is completely secure; if a personal data breach affects you, we will inform you when the law requires it.

11. Cookies

We use technical cookies and, only if you accept them, Google Analytics cookies. See the details in the Cookie Policy.

12. Changes to this policy

We may update this policy to reflect legal or service changes. We will publish the new version on this page with its date and, if the change is important, we will tell you in the app or by email.