Privacy Policy

Last updated: [TODO: DATE]

[TODO — NOT YET LAUNCH-READY] Replace every bracketed placeholder below, and have this reviewed before launch. RSVBee handles personal data about guests who never signed up for it, which is the part regulators care about most.

1. Controller

[TODO: LEGAL ENTITY NAME], [TODO: REGISTERED ADDRESS], [TODO: JURISDICTION], is the controller of the personal data described here. Contact: info@myrsvbee.app. [TODO: If you have an EU/UK establishment threshold issue or appoint a representative or DPO, name them here.]

2. What we collect

  • Account holders (the couple): email address, and the authentication data Amazon Cognito needs to sign you in.
  • Wedding pages: couple names, date, venue, your story text, and any photo you upload.
  • Guests: the name and email address you add to a guest list, plus each guest's invitation status, whether they are attending, whether they are bringing a plus-one, their meal choice, and when they replied.
  • Payments: a Stripe checkout session reference and the plan purchased. Card details go to Stripe directly and never reach our systems.
  • Operational logs: application and email-delivery logs held in Amazon CloudWatch for troubleshooting.

3. Why, and on what legal basis

  • To run your account and wedding page, and to send and record invitations — performance of a contract with the account holder.
  • To process guests' personal data — our legitimate interest, and the account holder's, in delivering an invitation the guest was meant to receive. If you are in the EU/UK, the account holder is responsible for having a lawful basis to share their guests' details with us.
  • To take payment and meet tax and accounting obligations — contract and legal obligation.
  • To keep the service secure and debug faults — legitimate interest.

We do not sell personal data, and we do not use guest data for marketing.

4. Who we share it with

  • Amazon Web Services — hosting, database, file storage and email delivery (Amazon SES). Data is stored in [TODO: AWS REGION].
  • Stripe — payment processing.
  • Anyone we are legally required to disclose to.

[TODO: If your AWS region or Stripe account moves data outside the EU/UK, describe the transfer mechanism — typically Standard Contractual Clauses.]

5. How long we keep it

Wedding pages, guest lists and RSVPs are kept until you delete them or close your account. Deleting a guest removes their record immediately. [TODO: STATE A RETENTION PERIOD for inactive accounts, e.g. "we delete wedding data 12 months after the wedding date".] Payment records are kept for [TODO: PERIOD] to meet accounting obligations. Operational logs are kept for [TODO: PERIOD].

6. Your rights

Depending on where you live, you may have the right to access, correct, delete, export or restrict the use of your personal data, and to object to processing based on legitimate interests. Emailinfo@myrsvbee.app and we will respond within [TODO: PERIOD, e.g. one month].

If you are a guest and want your details removed from a wedding list, you can ask the couple who invited you, or email us atinfo@myrsvbee.app and we will remove your record.

You also have the right to complain to your data protection authority — in the EU/UK, [TODO: NAME THE SUPERVISORY AUTHORITY].

7. Cookies

We use only the cookies needed to keep you signed in and to run the site. We do not use advertising or analytics cookies. [TODO: If you add analytics later, add a consent banner and update this section before you do.]

8. Security

Data is encrypted in transit and at rest on AWS. Each wedding page and guest list is readable only by the account that created it. Invitation links contain a random, unguessable token; anyone holding the link can view and answer that invitation, so guests should not forward theirs.

9. Changes

We will post updates here and, for material changes, email account holders before they take effect.