Privacy Policy
Last updated: November 1, 2026 Effective: at the launch of vowberry.com
This policy explains how we handle personal data when you use vowberry.com (the “Service”). It is our information notice under Articles 13 and 14 of the EU General Data Protection Regulation (GDPR) and the UK GDPR.
1. Who is responsible for your data
The controller of your personal data is:
Nordic Landing OÜ Harju maakond, Kuusalu vald, Pudisoo küla, Männimäe/1, 74626 Estonia Registry code 16372123 Email: legal@vowberry.com
2. The personal data we collect
| Category | Data | Where it comes from |
|---|---|---|
| Identity and contact | Name, email address, user ID and username if you set one. If you email yourself a file, an invitation design or a countdown link without an account: only your email address. | You, when you sign up (through our sign-in provider Clerk), or in the “email it to me” form. |
| Payment and billing | The last 4 digits of your card, billing country, the package you bought, your Stripe customer ID. We never see or store your full card number; Stripe keeps it. Link, the merchant of record for purchases, collects the payment, billing and tax data it needs under its own privacy notice. | Stripe Checkout, sold through Link. |
| Invitation content | Photos you upload; invitation text; names of the couple or the people celebrated; event date and time; venue name and address; theme and color choices; prompts sent to the AI features; drafts saved in the invitation editor; AI results and the invitation images you download. An invitation emailed to you without an account is attached to that email only and is not stored on our servers. | You, while using the Service. |
| Account status | Credit balance, invitation history, referral code. | Your use of the Service. |
| Technical and usage | IP address, browser type and version, operating system, device type, pages visited, clicks, session length and error logs. Campaign (UTM) and referral data only if you accept marketing and attribution cookies. | Cloudflare, server logs, DataFast (after consent) and a first-party attribution record (after consent). |
| Marketing preferences | Whether you agreed to receive offers and product tips by email. | The sign-up form and your email preferences. |
| Wedding website and RSVPs | Couple and event details; the site’s theme and publishing status; what a guest enters in the RSVP form (name, attendance, number of guests and an optional message or contact details); for each “new RSVP” notice to the site owner, the email provider’s message ID, delivery status and timestamps. | The site owner, and the guest who fills in the RSVP form. |
| Free tools | The wedding countdown keeps the names and date you enter in its link; the guest list stays in your browser. If you email yourself the countdown link or a tool file, we store your email address, the wedding date if you gave one, and whether you agreed to reminders. Reminders are sent only if you agreed. | You, in the tools. |
| Aggregate site usage | Daily totals of views, shares, map opens, music starts and RSVPs started or sent on live wedding websites. These counters contain no guest name, contact detail, message, raw IP address or browser identifier. | Our own first-party server counters. |
3. Why we use your data and our legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating your account, signing you in and providing the Service | Performance of a contract, 6(1)(b) |
| Taking payments and keeping billing records | Contract and legal obligation, 6(1)(b) and 6(1)(c) |
| The invitation editor’s AI features (design suggestions and result checks with OpenAI; image generation and editing, AI lettering and background removal with Fal.ai) | Performance of a contract, 6(1)(b) |
| Publishing wedding websites, delivering RSVPs, telling the site owner about a new RSVP, and aggregate counters without personal data | Contract and legitimate interests, 6(1)(b) and 6(1)(f) |
| Measuring how the Service is used, with DataFast’s cookieless analytics (no cookies; a pseudonymous visit hash that changes every day) | Legitimate interests, 6(1)(f) |
| Measuring which campaigns or referrals bring visitors (first-party UTM and referral record) | Consent, 6(1)(a) |
| Account and service emails, referral reward notices, and sending you a file, design or link you asked for | Performance of a contract, 6(1)(b) |
| Newsletters, optional offers and the planning reminders tied to your wedding date | Consent, 6(1)(a) |
| Preventing fraud and abuse, and responding to legal claims | Legitimate interests and legal obligation, 6(1)(f) and 6(1)(c) |
4. Who we share data with
We share data with the service providers below, under contracts that limit what they may do with it. Some of them process data outside the European Economic Area. For those transfers we rely on an adequacy decision (such as the EU-US Data Privacy Framework, where the provider is certified) or on the European Commission’s Standard Contractual Clauses, and the UK equivalents for UK data.
| Provider | Location | Purpose |
|---|---|---|
| Clerk, Inc. | United States | Sign-in and session management. |
| Stripe, with Link as merchant of record | Ireland / United States | Payments and billing. Link sells your purchase as merchant of record and is a separate controller of the payment, tax and fraud-prevention data it collects. |
| Fal.ai | United States | AI image and decoration generation, image editing, AI lettering and background removal in the invitation editor. Your prompt, the names to be lettered and the image being edited (including a photo you uploaded) are sent to Fal.ai. Generation, editing and lettering use an OpenAI image model through Fal.ai. |
| OpenAI, L.L.C. | United States | Design suggestions in the invitation editor and checks of AI results (whether a generated image contains unwanted text, whether lettered names are spelled correctly). The texts in your design (names, date, venue), your request and the image being checked are sent to OpenAI. These requests ask OpenAI not to store them; the data is not used to train models, but OpenAI may keep it for up to 30 days to prevent abuse. |
| Cloudflare, Inc. | Global network; stored files in the United States | Hosting, running the site, protection against attacks, and storing your account’s records. Wedding websites, RSVPs and invitation editor drafts are kept in Cloudflare D1 in Western Europe. Photos you upload, invitation and AI images, and other files are kept in Cloudflare R2 in North America (United States), under the transfer safeguards above. |
| Resend (Plus Five Five, Inc.) | United States | Sending account and notification emails and reporting their delivery. A “new RSVP” notice never contains the guest’s name, contact details, reply or note; it carries only the site owner’s address, a general message and a link to the dashboard. |
| DataFast | Singapore / United States | Page and conversion analytics without cookies. Its servers recognise a visit by a pseudonymous hash of your IP address and browser that changes every day, so it cannot follow you from one day to the next. |
Apart from these providers, we share personal data only:
- when the law, a court or a competent authority requires it;
- when needed to protect our rights or the rights of others;
- to investigate fraud or a security incident;
- in a merger, acquisition or insolvency, in which case the new owner takes the data on the same terms and we tell you about any material change.
5. How long we keep data
- Account data: while your account is active. After you delete your account it is removed once our 30-day backups expire.
- Invitation data (images, prompts, event details): may be deleted 30 days after the event date; you can delete it earlier from your account.
- Wedding websites and RSVP data: the site closes to the public at the end of its 12-month online period after the main wedding date. After a full refund or a payment dispute decided in the buyer’s favor, the data may be kept in restricted form for 30 days to handle corrections or disputes; after that the legal retention rules and any deletion request apply.
- RSVP email delivery records: for as long as the RSVP they belong to is kept; deleting the RSVP deletes them.
- Payment and billing records: 7 years, as Estonian accounting law requires.
- Reminder subscriptions from the free tools: until the reminders for your wedding date are sent or you unsubscribe, whichever comes first.
- Marketing consent: until you withdraw it; sending stops immediately.
- Analytics: according to DataFast’s retention settings.
- Anonymous aggregate statistics: including the daily counters of live wedding websites, may be kept indefinitely because they cannot be linked to a guest.
6. Your rights
Under Articles 15 to 22 of the GDPR and the UK GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- have incomplete or incorrect data corrected;
- have your data erased where the legal conditions are met;
- restrict how we use it;
- receive it in a structured format or have it transferred to another controller;
- object to processing based on legitimate interests;
- not be subject to decisions made solely by automated means that have legal effects for you;
- withdraw your consent at any time, where we rely on it;
- complain to a data protection authority: in Estonia the Andmekaitse Inspektsioon (aki.ee), or the authority of the EU country where you live; in the UK the Information Commissioner’s Office (ico.org.uk).
To use these rights, email legal@vowberry.com with enough detail for us to confirm your identity. We answer within one month.
If you live in the United States: we do not sell your personal information, and we do not share it for cross-context behavioral advertising. You can ask us to access, correct or delete your personal information at legal@vowberry.com.
7. Guests of a wedding website
When you reply to an RSVP form, the couple who owns the site decides what the form asks, sees your reply in their dashboard and is responsible for telling you how they use it. We store and deliver the reply to provide the site to them. To have your reply corrected or deleted, contact the couple, or write to legal@vowberry.com and we will pass your request on.
8. Children
The Service is not meant for anyone under 18, and we do not knowingly collect their data. If you upload a photo of a child (for a birthday invitation, for example), you confirm that, as their parent or guardian, you have the permission needed to use it. If you believe we hold a child’s data without permission, contact us and we will delete it.
9. Cookies
We use strictly necessary cookies and local storage, cookieless analytics (DataFast), and, only with your consent, further analytics and attribution storage. Our Cookie Policy lists each one and explains how to change your choice.
10. Security
We protect your data with industry-standard technical and organizational measures, including TLS encryption, sign-in through Clerk, Cloudflare’s firewall and attack protection, storage permissions and limited access. No transfer over the internet is 100% secure. If a data breach happens, we notify the competent authority and the people affected within the time the law requires.
11. Changes to this policy
We may update this policy from time to time. We announce material changes by email or in the Service before they take effect, at least 30 days ahead where reasonably possible. The current version is always on this page with its “Last updated” date.
12. Contact
For any question, request or complaint about how we handle your data:
Nordic Landing OÜ Harju maakond, Kuusalu vald, Pudisoo küla, Männimäe/1, 74626 Estonia Email: legal@vowberry.com