Privacy Policy

1. Data controller

The controller of your personal data is:

Jáchym Hrňák
Business ID (IČO): 19476108
Address: Lužická 45, Nelahozeves 27751, Czech Republic
Email: info@vowly.love

2. What data we process

When operating Vowly, we may process in particular the following categories of personal data:

a) User account data

• first and last name or display name,
• email address,
• profile picture, if provided through Google or Facebook sign-in,
• account and sign-in identifiers, such as the provider account ID,
• data related to sessions, verification and sign-in,
• technical authentication tokens.

b) Data related to use of the service

• details of the wedding projects you create,
• wedding website content, such as texts, the date, the venue, the schedule and other content you add,
• project settings, templates, colour variants and other user settings,
• the password for a password-protected website, stored in encrypted form,
• email addresses for notifications about new guest responses, and the email of a partner invited to manage the wedding together,
• your answer to how you heard about Vowly, if you provide one,
• internal operational and product events, such as events related to the use of features or the paywall.

c) Guest data and RSVP responses

• guest name and, where applicable, the names of the people coming with them,
• RSVP response,
• number of adults and children,
• email (required for RSVP, optional for the guest form),
• optionally, meal choice or dietary preferences,
• optionally, interest in accommodation and a note about it,
• optionally, a message or note,
• details the couple adds to their guest list, such as phone number, group or notes,
• technical data used to protect the form from spam: a shortened fingerprint (hash) of the IP address, browser information, the referring page and how long the form took to fill in.

d) Photos and other uploaded content

• photos uploaded by the couple,
• photos uploaded by guests,
• related metadata needed to store, display and manage the gallery.

e) Technical and security data

• IP address,
• information about your device, browser and operating system,
• system logs,
• data needed for security, abuse prevention, error diagnostics and running the application.

f) Payment-related data

• details of the purchased plan,
• payment status,
• payment and transaction identifiers,
• basic details provided in connection with the payment, such as name, email address and technical identifiers associated with the payment,
• the discount code used, if one was entered at checkout.

3. Where we get the data

We obtain personal data:

• directly from users who create an account or use Vowly,
• from guests who submit an RSVP response or upload photos,
• from third parties used for sign-in or for running the service, such as Google or Facebook when you sign in with their account.

4. Purposes of processing

We process personal data in particular for the following purposes:

• registering and managing user accounts,
• verifying identity and signing in to the application,
• providing the features of Vowly,
• creating, managing and publishing the wedding website,
• keeping track of guests and processing RSVP responses,
• storing, managing and displaying photos and other content,
• sending system emails, such as sign-in links, payment confirmations or notifications about new guest responses,
• sending emails to guests: confirmation of a submitted response, and reminders the couple sends to guests who haven't responded yet,
• sending informational emails to registered users about their wedding and Vowly, such as tips for finishing the website, reminders of the approaching wedding date or a note about an unfinished PRO order; you can unsubscribe from these emails at any time using the link in the email footer,
• securing the application and preventing abuse,
• monitoring technical errors and the stability of the service,
• internal product analytics and evaluating how features are used, including through third-party analytics tools (such as PostHog) that help us understand how users use the service, identify problems and improve the user experience; for signed-in users, analytics may also involve identifying data such as an email address, if the user has given consent through the cookie banner,
• measuring ad effectiveness, evaluating conversions, remarketing and showing more relevant ads, if the user has given consent through the cookie banner; for these purposes we may use third-party marketing tools, in particular Meta Pixel and Google tag / Google Ads,
• protecting the controller's rights and resolving any disputes,
• complying with legal obligations,
• processing and recording payments for the PRO plan, verifying that a payment has been completed and unlocking the paid features of the service.

5. Legal bases for processing

We process personal data on the following legal bases:

• performance of a contract under Article 6(1)(b) GDPR, where processing is necessary to create an account, provide Vowly, and manage the wedding website, RSVP and gallery, including processing payments for the PRO plan and unlocking paid features,
• legitimate interest under Article 6(1)(f) GDPR, in particular for security, protection against abuse, operational logging and error monitoring, for sending guests emails related to their response, and for sending our own users informational emails about the service,
• consent under Article 6(1)(a) GDPR for analytics cookies and related product analytics, and for marketing cookies and tools used to measure ad effectiveness, remarketing and conversion tracking,
• compliance with a legal obligation under Article 6(1)(c) GDPR, where required by law.

6. Who may have access to the data

Personal data may be made available to our processors or technical partners who help us run the service. Currently, these may include in particular the following services or types of providers:

• Render for hosting and running the application and the database where the application data is stored,
• Cloudflare for domain management and related network services,
• Cloudflare R2 for storing photos and files,
• Resend for sending system emails,
• Stripe for processing payments and related payment operations,
• Google for Google sign-in,
• Meta Platforms for Facebook sign-in,
• Auth.js / NextAuth for authentication and sign-in management,
• Upstash for short-term storage of technical counters that limit the number of form requests (protection against abuse and spam),
• Sentry for monitoring errors and application stability,
• PostHog for product analytics and evaluating how the service is used, including session recordings; data is processed on servers in the European Union,
• Google Fonts for loading the typeface in emails; when an email is displayed, the recipient's IP address is shared with Google,
• Meta Platforms for marketing measurement, Meta Pixel, conversion tracking and remarketing, if the user has given marketing consent,
• Google for Google tag / Google Ads, conversion measurement, evaluating ad effectiveness and remarketing, if the user has given marketing consent,

We do not sell personal data to third parties. We use third-party marketing tools such as Meta Pixel or Google tag / Google Ads only with the user's marketing consent, to measure ad effectiveness, evaluate conversions and for remarketing.

7. Public wedding website

The content of a wedding website is publicly available only once the couple actively publishes it. The user who manages the project is responsible for the content they publish on the wedding website.

The user is also responsible for having the appropriate authorisation to use the guest details they add to the service or manage through it.

8. How long we keep data

We keep personal data only for as long as necessary to fulfil the purposes described above, or for as long as required by law.

In general:

• we keep user account data for as long as the account exists, i.e. until it is deleted on request,
• the wedding website is publicly available for 12 months after the wedding date, after which we take it offline; we let you know by email 30 days in advance,
• we delete the wedding, including the website content, guest data, RSVP responses and photos, 18 months after the wedding date, provided there has been no activity in it for at least 30 days, or earlier on request,
• we delete untouched draft weddings without a date after 120 days,
• we keep payment records even after a wedding or account is deleted, for the period required by accounting and tax law,
• we keep operational logs, security data and error records for as long as necessary for security, diagnostics and protecting the service.

If a user or another authorised person asks for their data to be erased, we will delete it unless we need to keep it for legal, security or operational reasons.

9. Deleting and managing data

Within the application, users can manage and delete certain data, such as guests or photos.

Deleting an account or an entire wedding is not yet available as a self-service feature. You can request erasure by emailing info@vowly.love; the steps are described on the Deleting your data page.

10. Cookies and similar technologies

Vowly uses cookies and similar technologies to make the service work, to analyse how it is used and, if the user consents, for marketing measurement and evaluating ad effectiveness.

a) Necessary cookies

These cookies are required for the service to work properly, in particular for:

• signing in and managing sessions,
• securing the application,
• the technical operation of administration and account management.

These cookies cannot be turned off.

b) Analytics cookies

With your consent, we use analytics cookies that help us understand how users use the service and improve it.

For this purpose we use PostHog, which may process:

• anonymous identifiers (such as a cookie ID),
• data about your activity on the website (such as page views, clicks and use of features),
• for signed-in users, also identifying data such as an email address or user ID,
• for some visits, a session recording, i.e. how you move around the page and what you click; the content of form fields is not recorded.

Analytics cookies and the related processing of data are used only with your consent, which you can change or withdraw at any time.

Analytics cookies are separate from marketing cookies. Consenting to analytics does not mean consenting to marketing measurement.

c) Marketing cookies

With your consent, we may use marketing cookies and similar technologies that help us measure ad effectiveness, evaluate conversions, build remarketing audiences and show more relevant ads.

For these purposes we may use in particular Meta Pixel and Google tag / Google Ads. These tools may process technical identifiers, information about your device and browser, data about your visit to the website, the pages you view and selected actions taken on the website, such as creating an account, creating a wedding project, starting an order or completing a purchase.

If you arrive through a wedding supplier's link and accept marketing cookies, we also store a first-party partner attribution. It contains only an internal partner identifier, is used to attribute the resulting wedding and payment to that partner, and expires after 90 days.

Marketing cookies and the related processing of data are used only with your separate marketing consent. Consenting to analytics cookies does not mean consenting to marketing cookies.

d) Cookie settings

On your first visit, you can decide whether you agree to the use of analytics and marketing cookies. You can reject optional cookies, accept all of them, or choose each category separately. You can change or withdraw your consent at any time in the cookie settings.

11. Transfers of data outside the European Union

Some of the technical services we use may, in certain cases, involve processing of or access to data outside the European Economic Area.

Where such a transfer takes place, we aim to ensure it complies with the applicable law and uses appropriate safeguards.

This may also apply to some payment or technical service providers, such as Stripe.

Data may also be transferred or made accessible outside the European Economic Area when certain third-party marketing tools are used, such as Meta Platforms or Google. Where such a transfer takes place, we aim to use appropriate legal safeguards under the applicable law.

12. Your rights

In connection with the processing of your personal data, you may exercise in particular the following rights under the conditions set out in the GDPR:

• the right of access to your personal data,
• the right to have inaccurate or incomplete data corrected,
• the right to erasure,
• the right to restriction of processing,
• the right to object to processing,
• the right to data portability,
• the right to lodge a complaint with a supervisory authority.

To exercise these rights, contact us at info@vowly.love. We will handle your request without undue delay and within one month at the latest.

13. Supervisory authority

If you believe that the processing of your personal data breaches the law, you can lodge a complaint with the competent supervisory authority, which in the Czech Republic is:

Office for Personal Data Protection (Úřad pro ochranu osobních údajů)
Pplk. Sochora 27
170 00 Prague 7, Czech Republic
Web: uoou.gov.cz

14. Data security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, destruction or unauthorised alteration.

However, no system can be guaranteed to be completely secure.

15. Changes to this policy

We may change or update this policy from time to time. The current version will always be published on this page.