Privacy Policy

Last updated: June 17, 2026

1. Data Controller

The data controller for personal data processed through the Wedding Website Builder platform ("Service") is Hexer - Maksymilian Skórnóg, with its registered address at Kobyle 322, 32-720 Nowy Wiśnicz, Poland, NIP 8681999628, REGON 541556879. If you have questions about how your data is handled, contact us at marketing.hexer@gmail.com.

2. Data We Collect

We collect data you provide directly: account information (name, email), wedding page content (names, dates, venues, photos, texts), guest data entered through RSVP forms (names, emails, dietary preferences, attendance status), and data submitted through our contact form (name, email address, subject, and message content). We also automatically collect limited technical data necessary to ensure the security and proper operation of the Service (e.g., IP address, browser type, device information). For traffic analysis we use private, cookieless analytics that does not build persistent user profiles.

3. How We Use Your Data

We use your data to: provide and maintain the Service, display your wedding page to your guests, process RSVP submissions, send you important Service notifications, improve and develop new features, and comply with legal obligations. We do not sell your personal data to third parties.

4. Legal Basis for Processing (GDPR)

We process personal data based on: contract performance (providing the Service you signed up for), legitimate interest (improving the Service, preventing abuse, running anonymous analytics), consent (marketing emails), and legal obligations (tax records, law enforcement requests). You may withdraw consent at any time without affecting the lawfulness of prior processing.

5. Data Sharing

We use trusted providers to whom we entrust data processing only to the extent necessary: Convex (database hosting and backend infrastructure), Stripe (payment processing for Premium features), and Vercel (Service hosting and private, cookieless traffic analytics). All third-party processors are bound by data processing agreements. We do not sell or share your data for advertising purposes. Your wedding page content is publicly accessible at its URL when published - this is the core function of the Service.

6. Guest Data and Your Responsibilities

When you collect guest data through RSVP forms (names, emails, dietary needs, etc.), you act as the data controller for that data. You are responsible for informing your guests about data collection and obtaining any necessary consent. We act as data processor, handling guest data only as needed to provide the Service.

7. Data Retention

Account and wedding page data is retained while your account is active. After account deletion, we remove your data within 30 days, except where retention is required by law (e.g., payment records kept for the period required by tax regulations, typically up to 5 years). RSVP and guest data is deleted along with the associated wedding page. Messages sent through our contact form are kept for a maximum of 6 months, after which they are automatically deleted. Technical and analytics data (such as anonymized traffic statistics) is retained only for as long as necessary to ensure the security and analysis of the Service.

8. Your Rights

Under GDPR and applicable laws, you have the right to: access your personal data, rectify inaccurate data, erase your data ("right to be forgotten"), restrict processing, data portability, and object to processing. To exercise these rights, contact us at marketing.hexer@gmail.com. We will respond within 30 days.

9. Cookies and Tracking

We use only the essential cookies required for the Service to function (authentication, session management). For traffic analysis we use Vercel's private, cookieless analytics, which stores no cookies or other identifiers on your device and does not track you across websites. We do not use third-party advertising or analytics cookies, which is why using the Service does not require a cookie consent banner. You can manage preferences for essential cookies through your browser settings, although disabling them may limit how the Service works.

10. Right to Lodge a Complaint

If you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the supervisory authority. In Poland, this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw. Before doing so, we encourage you to contact us at marketing.hexer@gmail.com - we will try to resolve the matter directly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of significant changes via email or through the Service. The latest version is always available on this page with the effective date shown above.

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at marketing.hexer@gmail.com.