Privacy Policy

1. Data Controller

NiiRo AI

Robin Kolb

Carrer de S'Illot 13

07400 Alcúdia

Spain

Email: info@niiro.ai

Who is responsible for what

The provider of NiiRo Smart Wedding named above is responsible for accounts, payments, security and the operation of the platform, and for this website.

For the information a couple enters about its guests or asks them for (guest list, replies including allergy and dietary information, guestbook, questions to the couple, photos, voice messages, videos), the couple decides why and to what extent it is processed. NiiRo processes this information on behalf of the couple to provide the platform and does not use it for its own advertising or analytics. Where the couple acts purely privately, the exemption for personal and household activities applies to the couple itself (Art. 2(2)(c) GDPR); NiiRo as the provider remains bound by the GDPR.

Wedding planners linked to a wedding work for the couple; the lead planner sees the same information as the couple, but not the couple’s own money in the budget; other planners (assistants) see no allergy or dietary information (see recipients).

As a guest, you can contact the couple or us directly with questions about your information (contact details below).

2. What data is processed

When visiting and using NiiRo Smart Wedding, the following data may be processed:

• technical access data and server logs
• Error reports from the browser: if a technical error occurs on a page, your browser sends a short report (page path without access code, shortened error message without e-mail addresses, links and codes). We keep it for 30 days to fix errors (legitimate interest, Art. 6(1)(f) GDPR); your IP address is only used as a daily changing pseudonym for the abuse brake.
• account data of couples and wedding planners
• A couple’s remembered browsers: anyone who chooses “Remember this browser” when signing in gets the cookie above (see Cookies). For each remembered browser we store the browser and operating-system family (for example “Chrome on Windows”), timestamps (remembered, last used, last code) and a hash of the identifier – never the address, the IP or the raw browser data. When a browser is remembered we send a notice email to the account address. The list is part of your data copy and is deleted with the account.
• reply information from guests
• Health information of guests (special category under Art. 9 GDPR): allergens ticked from the list of the 14 allergens that must be labelled, and voluntary notes on intolerances or diet, per person of the group and also for children who come along. With the reply we store which notice on passing the information on it was given under (the date of that version). They are only asked for so that the wedding meal can be planned safely. The information is voluntary; a reply works without it. In addition, the couple can mark in the seating plan that a person needs assistance at the seat – only a yes or no, without a diagnosis – and write a free-text note on any person, which may contain health information (such as “walker, close to the exit”). Only the couple, their lead planner and, if needed, our support see the mark and the notes, never the guests, other planners (assistants) or the seating poster; the couple can remove both at any time, otherwise they are deleted with the wedding’s seating plan.
• Gift list: which wishes guests take on. Through the general invitation link a reservation stays nameless and is tied only to a cookie in that browser. Through the personal invitation link it is assigned to the guest-list entry (stored as a pseudonym, not as a name): the couple then sees who is taking the gift, and the reservation can be undone on any device with that link. A guest who takes a gift "without your name" through the personal link stays nameless as with the general link; the reservation is then tied only to the cookie in that browser. The couple can release single reservations. Other guests only see how many items are still available.
• The couple’s gift log: after the celebration the couple can note who gave them what (a name or a pick from the guest list, the gift, a note, a date) and whether they have already said thank you; we do not store amounts. Only the couple’s two logins can see this list, never guests, wedding planners or our support in the app. We delete it with the other responses of the wedding (see retention), with the guest it points to when that guest is deleted for good, and with the account; the couple can delete it earlier at any time. It is part of the couple’s own data copy under Art. 15 GDPR, not of the shared wedding export.
• the couple’s guest list (name and, if provided, email address, phone number, postal address, number of seats and note). The postal address (per household or guest) only serves invitations and thank-you cards the couple sends by post; guests do not see it, and it is deleted with the last guest of a household. Each entry gets a personal invitation link with a random access code; it assigns the reply to the entry so it can be changed until the deadline. Anyone who has the link can see and change the reply; if guests are grouped into a household, the link also shows the names of the other household members. We do not evaluate whether a link was opened; the hosting provider’s technical access logs contain the requested address and are deleted as described below. The access code is not included in data copies under Art. 15 GDPR. If a guest replies through the shared invitation link, such an entry is created automatically with their name and, if given, their email address. The guest then receives the personal link in the confirmation email, sent to the address they entered themselves, if their reply contains no health information; otherwise the email carries the shared link, because nobody checks that the address is correct, and the couple can send the personal link. If the couple deletes the reply, the entry that was created automatically is removed with it, as long as the couple has not edited it.
• Reminders to guests: when a reminder email went to an entry of the guest list – sent by the couple or, if they switched it on, once automatically before the reply deadline – and whether our email service could deliver it. The automatic reminder only goes to guests without a reply, never to unsubscribed or blocked addresses or addresses without consent. Only the couple, authorised wedding planners and, for a support request, our support see these details; guests never do. We delete the reminder details with the entry and the delivery reports of our email service with the wedding.
• Group messages to guests: the couple can send their guests messages about their wedding; we send them on the couple’s behalf, with an unsubscribe link. The legal basis is the couple’s legitimate interest in organising their celebration (Art. 6(1)(f) GDPR). Excluded are unsubscribed and blocked addresses, guests who have objected, and addresses the couple has not released. We store whom a group message reached and, for each address it reached, a non-reversible identifier (a keyed checksum), never the address itself; we delete both with the wedding. The couple can release addresses that guests gave with a yes in the reply form; the form names this purpose. Without a release no group message goes to such an address; for older replies the couple brings into the list with “Add replies to the guest list”, the release counts as given with that button. The couple can withdraw it.
• The couple’s budget: the total budget with its areas, the cost items (title, amounts, deposit, status, due dates, notes and the name of the vendor), the payments (for each payment the amount, the date and who paid, only as a role – the couple, family or others – never by name) and the financing figures (starting capital, monthly savings, pledged money, possible extras, expected cash gifts, reserve and buffer). These are the couple’s details about its own money, not about guests; the app does not process any payment to vendors, it only records what the couple enters. The couple, authorised wedding planners and, for a support request, our support see these details; guests never do. The exception is the couple’s own money – starting capital, monthly savings, pledged money, possible extras, expected cash gifts and reserve: only the couple and, for a support request, our support see these; wedding planners do not. Items and payments can be deleted at any time; otherwise they are deleted with the other wedding data (see retention). They are part of the data copy under Art. 15 GDPR. Payments and payment deadlines also appear in the planning summary by e-mail: on days when something is due in 7 days or tomorrow, our e-mail service sends it to the couple and, as one collective e-mail, to linked wedding planners. It names due tasks, payments and deadlines (cancellation deadlines and booking deadlines for accommodation) with title and date; the e-mail to the couple also names the number and total of the payments without a date and the number of guests who have not replied yet (a number only, no names). Every one of these e-mails contains an unsubscribe link, and the summary can be switched off in the e-mail settings.
• The couple’s vendors: contact details of the vendors (name, company, e-mail address, phone number, website) where entered, the type of service, their status, the cancellation deadline and a note. Only the couple, authorised wedding planners and, for a support request, our support see these details; guests never do. They are deleted together with the wedding’s budget (see retention) and are part of the data copy under Art. 15 GDPR.
• Questions from guests to the couple: name, question and – only if an answer by email is wanted – the email address, plus the language of the page and whether the question is done. Only the couple, the lead planner and, in a support request, our support can see the question, never other guests. It is deleted together with the wedding’s other replies (see storage period); the couple can delete it earlier at any time, and it is included in the data copy under Art. 15 GDPR. The couple receives at most one email per hour saying that a question is waiting – without the question and without a name.
• uploaded images and content
• Guestbook entries and photos from guests: name, message or image, and the time. The legal basis is the consent given when sending (Art. 6(1)(a) GDPR). By default, other guests only see a contribution once the couple has approved it. If a couple switches on “Publish straight away” for their wedding, a new contribution is visible to everyone with the wedding link as soon as it is sent; the form says so before sending. The couple can hide or delete contributions at any time. The couple can also show approved photos on a photo wall during the celebration (a screen or projector at the venue, via a separate link that is valid until at most 24 hours after the last appointment and can be withdrawn at any time); the photo wall shows no names. Photos of children may only be shared with their parents’ consent. Anyone shown in a photo they did not upload themselves can object to its publication (Art. 21 GDPR) – with the couple or through the “Report content” form (see Reports of illegal content); for children, their parents do so. Voice messages from guests (only if the couple has allowed them for their wedding): a recording of up to 90 seconds, the name the guest gives and the time. A voice is personal data; the legal basis is the consent the guest confirms separately when sending (Art. 6(1)(a) GDPR). A voice message always waits for the couple’s approval, even if “Publish straight away” is on: at first only the couple and, if involved, their wedding planner (the planners linked to the wedding) hear it – NiiRo support cannot play it and sees only name, length, size and state – while other guests with the wedding link hear it only after approval. The recording is kept in the platform’s storage (Cloudflare R2, EU) and goes to no other third party; we do not transcribe the speech and do not analyse it. The couple can listen to, hide or delete every recording; a deleted recording is removed at once. It is part of the couple’s data copy and is deleted when the guest withdraws it, the couple deletes it, the wedding or the account is deleted, or the period under “Data retention” ends. Videos from guests (only if the couple has allowed them for their wedding): a recording of up to 60 seconds and 100 MB, the name the guest gives and the time. A face and a voice are personal data; the legal basis is the consent the guest confirms separately when sending (Art. 6(1)(a) GDPR). A video always waits for the couple’s approval, even if “Publish straight away” is on: at first only the couple and, if involved, their wedding planner (the planners linked to the wedding) can watch it – NiiRo support cannot play it and sees only name, length, size and state – while other guests with the wedding link see it only after approval. The file goes from the guest’s device straight into the platform’s storage (Cloudflare R2, EU) and to no other third party; we do not analyse picture or sound. The couple can watch, hide, reject or delete every video; on rejecting and on deleting the file is removed at once. Videos count together with the voice messages towards the media storage of 5 GB per wedding. A video is part of the couple’s data copy and is deleted when the guest withdraws it, the couple deletes or rejects it, the wedding or the account is deleted, or the period under “Data retention” ends.
• payment data via Stripe checkout

Guests’ photos: image rights and withdrawal

Anyone who uploads a photo first confirms that they may upload it and that everyone who can be recognised in it is happy for it to be uploaded – for children, their parents or guardians. The right to one’s own image (section 22 of the German Art Copyright Act; Article 18 of the Spanish Constitution, Organic Law 1/1982 and Article 7 of the Spanish data protection act LOPDGDD) stays with the people shown; their objection, and that of parents, works as described above under the data we process. We only record that the confirmation was given when uploading, not by whom.

Withdrawing your own contributions: anyone who sent a photo, a guestbook entry, a voice message or a video can withdraw it on the same device until the couple has approved it. For this the browser remembers in the device’s local storage a withdrawal code and, for a guestbook entry, its beginning, so that you can see which entry you are withdrawing (not a cookie, not passed on to third parties, deleted after 30 days or when you withdraw). We do not store the code; we recompute it with a secret key when you withdraw. On withdrawal we delete the contribution with all image files (original, preview, large view) or the recording or video; backup copies expire after the period under “Data retention”. Once approved, the couple takes a contribution down. A music request can be deleted by whoever sent it with the same browser; for this we store an irreversible identifier of the visitor cookie with the request, never the cookie value.

3. Purposes of processing

Personal data is processed for the following purposes:

• Platform operation: Provision and operation of the platform (Art. 6(1)(b) GDPR).
• Wedding management: Managing invitations, guest replies, and galleries (Art. 6(1)(b) GDPR).
• Payment processing: Processing couple activation payments via Stripe (Art. 6(1)(b) GDPR).
• Security: Abuse prevention, error analysis, and system security (Art. 6(1)(f) GDPR).
• Analytics: Anonymous usage statistics via Vercel Analytics, only with your consent (Art. 6(1)(a) GDPR).

4. Legal basis

The processing of personal data is based on the following GDPR legal bases:

• Art. 6(1)(a) (Consent): For analytics cookies and non-essential data processing.
• Art. 9(2)(a) (Explicit consent): For guests’ allergy and dietary information. The information is voluntary; anyone who enters it in the reply form explicitly consents to the couple and their lead planner (the leading linked wedding planner) receiving it to plan the meal and – where the form says so – passing it on to the kitchen, caterer or venue together with the name for that purpose; anyone who enters information for others asks them first, and for children their parents or guardians decide; our support only sees it when a request or a technical fault requires it (see recipients). Consent can be withdrawn at any time with effect for the future: you can remove the information yourself via your personal invitation link until the reply deadline; otherwise the couple or our support removes it at your request.
• Art. 6(1)(b) (Contract performance): For providing the platform, account management, and payment processing.
• Art. 6(1)(f) (Legitimate interest): For security measures, error analysis, and abuse prevention.
• Art. 6(1)(c) (Legal obligation): For tax-related retention obligations for payment data.

5. Service providers (processors)

To provide our services, we engage the following processors, each under data processing agreements (DPAs) pursuant to Art. 28 GDPR. A full record of processing activities under Art. 30 GDPR — including contract paths, data categories, storage location, and retention periods — is maintained internally:

Vercel Inc. (USA) — EU contracting party: Vercel International Limited (Dublin, Ireland)

Hosting, Web Analytics (cookieless, consent-based) and performance monitoring. Region: EU (Frankfurt, fra1 — pinned in vercel.json and observable on the live response: the x-vercel-id header names fra1 as the executing region). EU contracting party: Vercel International Limited, Dublin, Ireland. Parent: Vercel Inc., USA. Legal basis: Art. 28 GDPR. Transfer: EU-US Data Privacy Framework + EU Standard Contractual Clauses (SCC Module 2).

Supabase Inc. (USA)

PostgreSQL database for wedding and account data (the app checks sign-ins and sessions itself). Region: EU (AWS Frankfurt, eu-central-1, verified live via server IP). Parent: Supabase Inc., USA/Singapore. Legal basis: Art. 28 GDPR. Transfer: EU-US DPF + SCC Module 2.

Cloudflare Inc. (R2, USA)

Cloudflare R2 Object Storage for photo gallery and media. Region: EU (Western Europe, weur). Parent: Cloudflare Inc., USA. Legal basis: Art. 28 GDPR. Transfer: EU-US DPF + SCC Module 2.

Upstash Inc. (USA)

Upstash Redis for rate limiting and abuse protection. Region: EU. Parent: Upstash Inc., USA. Data processed: ephemeral IP-based counters (max. 30 days). Legal basis: Art. 6(1)(f) GDPR + Art. 28 GDPR. Transfer: EU-US DPF + SCC Module 2.

Stripe Payments Europe Ltd. (Dublin, Ireland) / Stripe Inc. (San Francisco, USA)

Payment processing (PCI DSS Level 1 certified). Primary processing for EU customers: Stripe Payments Europe Ltd., Dublin, Ireland. Parent: Stripe Inc., San Francisco, USA. Legal basis: Art. 28 GDPR + Art. 6(1)(c) GDPR (tax retention obligation). Transfer: EU-US DPF + SCC Module 2.

Plus Five Five, Inc. (Resend), USA

Transactional emails (invitation links, notifications to the couple and to linked wedding planners, including the planning summary with due tasks, payments and deadlines and its unsubscribe link). Region: EU (Frankfurt). Parent: Plus Five Five, Inc. (Resend), USA. Legal basis: Art. 28 GDPR. Transfer: EU-US DPF + SCC Module 2.

Google LLC (Google Maps, USA) — EU subsidiary: Google Ireland Limited (Dublin)

Embedded map on the guest page (directions). The map is NOT loaded automatically: it appears only after the guest explicitly requests it. Before that, no data is sent to Google. From that click on, Google receives the IP address, user agent and the requested map address. For loading the map and this transfer, we and Google are joint controllers under Art. 26 GDPR (CJEU C-40/17); Google alone is responsible for any further processing. Google offers no separate agreement for embedded maps without an API key; you can exercise your rights with us and we pass them on to Google. EU subsidiary: Google Ireland Limited, Dublin, Ireland. Parent: Google LLC, USA. Legal basis: consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG, given by explicitly loading the map. Transfer to the USA: adequacy decision EU-US Data Privacy Framework (Google LLC is certified).

Anthropic, PBC (USA) — EU subsidiary: Anthropic Ireland, Limited (Dublin)

Anthropic-backed AI features for the couple (currently Claude Haiku 5.5): the planning assistant and the AI reading in the budget. Activation status: only when actively used by the couple or the linked planner (optional features, no guest access). Data processed by the planning assistant: question text (user input) and generated answers — no guest or wedding master data. Data processed by the AI reading in the budget, only when the couple or the linked planning triggers it: the publicly accessible text of a vendor’s web page that you enter (start, contact and imprint page; without scripts, style sheets and embedded content, but with e-mail and phone links and a few business details from the page’s structured data) or an image that you upload (screenshot of a vendor page, photo of an offer or an invoice; PDF files are not read), plus the names of your budget categories. Such documents can contain names, addresses, contact details, bank details (such as an IBAN) and amounts of vendors and of you. They are transmitted unchanged in content, nothing is redacted (the model is told not to repeat bank details in its answer). The app sends no guest data; please do not photograph or upload guest data. Images are re-encoded without metadata (such as the place of capture) before they are sent. Neither the image nor the page text nor the result is stored or logged by us; the result is only a suggestion that you check and only then adopt. 30 readings are provided per wedding; for that we store a number without any content (for up to two years or until the wedding is deleted) and, in the change history, one entry per reading with its kind and the counter, without any content. Anthropic processes the inputs as a processor and, according to its own statements, deletes them automatically within 30 days. EU subsidiary: Anthropic Ireland, Limited, Dublin, Ireland. Parent: Anthropic, PBC, USA. API inputs are not used by Anthropic for model training. Legal basis: Art. 28 GDPR + Art. 6(1)(b) GDPR. Transfer: EU Standard Contractual Clauses (Module 2) under Anthropic’s data processing addendum (DPA).

Google LLC (Google Play Billing, USA) — EU subsidiary: Google Ireland Limited (Dublin)

Google Play Billing for Android subscription payments (couple activation via the Google Play Store). Activation status: only when the Android app is used (optional distribution channel). Data processed: couple’s email (Google account email), subscription status — payment details are managed exclusively by Google and are not stored in the Smart Wedding database. EU subsidiary: Google Ireland Limited, Dublin, Ireland. Parent: Google LLC, USA. Legal basis: Art. 28 GDPR + Art. 6(1)(b) GDPR + Art. 6(1)(c) GDPR. Transfer: EU-US DPF + SCC Module 2.

The complete record of processing activities (Art. 30 GDPR), including data processing agreements (DPAs), is available on request via info@niiro.ai.

Who sees your information

Information about a wedding is seen only by these recipients, each to the extent stated:

• The couple: all replies for their own wedding, including allergy and dietary information, also as an export. What the couple passes on itself, for example to a caterer or venue, is the couple’s own decision.
• Linked wedding planners: the lead planner sees the same information as the couple, for as long as the link exists, but not the couple’s own money in the budget. Other linked planners (assistants) see the replies without allergy and dietary information and no exports containing replies; they do see the kitchen sheet’s totals without names.
• Our support: NiiRo staff with a dedicated support access. It can view any wedding with its guest list, replies including allergy and dietary information, budget and vendors, and create data copies. We use it only when a request or a technical fault requires it; switching into support access is logged. Support never sees card details, which are held only by Stripe.
• Kitchen and venue: the kitchen sheet the couple can download contains totals without names. Free-text dietary notes appear on the papers for kitchen and venue verbatim only where that is allowed: if a guest consented in the reply form to allergies and notes being passed on together with their name, the couple may give them to the kitchen, caterer or venue with name and seat. Other notes – from guests who answered under the current notice without agreeing to the name, and those the couple entered itself – appear verbatim only in a separate list “Other notes about food”, without names, seat or table; the names of the people in the reply and of the couple are replaced there by a placeholder (nicknames, family relations and other people’s names are not recognised; the couple can see each note beforehand in the reply list). Notes from replies given under the earlier notice (“Only totals, without names, go to the kitchen”) appear only as a count until the guest gives the release afterwards; their allergies appear at no seat and no table, only in the totals without names.
• Guests who replied under the earlier notice (“totals only”) are asked on their personal link whether their details may go on with the names; without an explicit yes they stay as totals, and a yes can be withdrawn there at any time. A yes also covers free-text notes about food: they then go along word for word, beside the name at the seat or unattributed in a list of further notes.
• Day helpers: anyone who helps at the entrance on the wedding day receives a password from the couple. With it, this person sees only on the event days (from midnight of that day until 6 a.m. the next morning, Berlin time) the names of the households that said yes, the number of people, the table (only once the seating plan is released to guests) and whether the household has already arrived, and can record arrivals. Day helpers never see contact details, allergy or dietary information, notes, messages or exports. A sign-in lasts at most 8 hours and ends at the latest when the time window closes. The couple can switch the access off or renew the password at any time; all sign-ins then end at once.
• Other guests do not see your reply. Anyone who has your personal invitation link can see and change your reply (see the guest list above).
• Seat link and guest code: Anyone who knows the seat link from the confirmation sees the table of that answer with the seat number and a small sketch of the hall (where the tables are, no names), never the names of other guests. The shared guest code alone shows no table. Neither can be revoked individually; please don’t pass them on.
• Reply address in emails to guests: if a couple account chooses “Send guests’ replies to your address” when sending a reminder, or switches on “Guests may reply to me from their confirmation”, that account’s email address appears as the reply address in the header of the email to the guests and travels along when it is forwarded. The confirmation carries it only if the guest replied through their personal link and the address comes from the guest list, and never while a planner can edit the guest list. The legal basis is the account’s own choice (Art. 6(1)(a) GDPR); it can be switched off at any time, emails already sent keep the address.
• Technical service providers (see above) process the data only on our behalf. Allergy and dietary information is stored in the database (Supabase, EU) and in data copies that have been created (Cloudflare R2); it is not included in any email.
• Authorities receive information only where we are legally obliged to provide it.

6. Data transfers to third countries

Some of our service providers are based in the USA. Data transfers are based on the EU-US Data Privacy Framework (EU Commission adequacy decision of 10 July 2023) and additionally on EU Standard Contractual Clauses (SCCs).

7. Cookies and local storage

NiiRo Smart Wedding distinguishes between necessary and optional storage:

• Necessary: Every cookie this app sets is technically necessary — there is no tracking cookie. In detail: __Host-niiro_admin_session (couple area sign-in, 7 days, or 30 days with the "Stay signed in" checkbox; regular use extends it, at most 90 days after the two-factor confirmation), __Host-niiro_support_edit (cleared support accounts only: edit mode, at most 30 minutes, ends on sign-out), __Host-niiro_photo_session (guest photo access, 12 hours), __Host-niiro_day_helper (day helper access on the wedding day, at most 8 hours and never beyond the time window, so at the latest until 6 a.m. on the morning after the event day), __Host-niiro_pg_device (remembers a device that has signed in with the photographer access before, so that failed attempts by others on the same network cannot lock it out; a pseudonymous random identifier, no names or contact details, 180 days), __Host-csrf (form abuse protection, 24 hours), __Host-niiro_mfa_pending (two-factor intermediate step, 10 minutes), __Host-niiro_trusted_browser (remembers a couple’s browser where “Remember this browser” was chosen, so a password is enough next time; at most 30 days after last use, 90 days after the last code at the latest; random identifier, no name, no address, no IP), NEXT_LOCALE (chosen language), niiro_offer_code (carries an offer code you opened through to activation, 14 days) and niiro_smart_wedding_music_vote_id (prevents double voting on music requests and recognises your own requests so you can delete them, 12 months) and niiro_gift_visitor (remembers which gifts you reserved so you can release them again, 12 months). Your cookie decision itself is stored locally in the browser (niiro_cookie_consent, 12 months) — that is not a cookie and is never transmitted to us. In the couple area the browser keeps steps made without a connection (task ticks, arrivals at check-in) in this device’s local storage (no cookie): only technical IDs, the chosen state and the time, no names and no health information. They are sent once a connection is back and removed on sign-out; anything older than 48 hours is discarded instead of sent the next time the page is opened.
• Analytics (optional): Vercel Analytics and SpeedInsights are only activated after explicit consent via the cookie banner.

Consent can be revoked at any time via the cookie banner.

Legal basis for storage on your device: we set necessary cookies and storage without consent because they are strictly necessary for the service you have explicitly requested (Art. 22(2), third subparagraph, LSSI, Spain; Section 25(2) no. 2 TDDDG, Germany). Optional analytics storage is set only with your consent (Art. 22(2), first subparagraph, LSSI; Section 25(1) TDDDG).

8. Data retention

Specific retention periods depend on the processing purpose:

• Account data: until the account is deleted by the user.
• Remembered browsers: valid for at most 30 days after the last use and 90 days after the last code at the latest; the entry is deleted 7 days after it expires and 30 days after it is removed, in any case with the account.
• Wedding data (guest replies, gallery, content, budget): 24 months after the wedding date, access ends for the couple, planners and guests; the data is deleted for good 14 days later. During this grace period only our support can still access it, for example to correct a wrongly entered wedding date at the couple’s request before anything is irreversibly deleted. If a couple account with an email address exists, we remind the couple by email 60 and 14 days before access ends, and we usually send one more email when the grace period begins. Linked wedding planners receive a copy of each of these emails. It names the couple as entered; if the name is very long or looks like a web or email address, we leave it out for security reasons.
• Budget: cost items, payments, financing figures and vendors with their contact details are deleted for good at the same time as the other wedding data (see above). Until access ends, the couple can download the budget as a CSV file (with the paid total instead of the individual payments, without the vendors’ e-mail address, phone number and website, and without financing figures – unless the couple switches on “Include money sources” when downloading; then savings, monthly saving, pledges, reserve and cash gifts are added at the end of the file) and request a complete data copy; items, payments and vendors can be deleted at any time. Once access has ended, the budget can no longer be downloaded in the app.
• Allergy and dietary information: it is deleted together with the other replies (see above). Before that, you can remove it yourself at any time via your personal invitation link (until the reply deadline) or by asking the couple or us.
• Payment data: 10 years per commercial and tax retention obligations.
• Server logs and rate limiting data: maximum 30 days.
• Activity log in the couple area: until the account is deleted (legitimate interest in security and traceability, Art. 6(1)(f) GDPR).
• Security and operations log not tied to a wedding, for example sign-up, e-mail confirmation, password and account changes, deletion requests, refused sign-in attempts, access by our support and heartbeats of our background jobs: 12 months, after which we delete the entries automatically (legitimate interest in security and abuse prevention, Art. 6(1)(f) GDPR). Reports of illegal content follow their own period further below.
• Backup copies from account deletions and data exports: maximum 90 days after creation.
• Reports of illegal content: 6 months after the case is closed; if official or court proceedings are ongoing, until they end. The activity log keeps only the reference and the reason, without personal data.
• Withdrawal statements for a purchase: 6 years from the end of the calendar year in which they were received (retention of commercial correspondence, Section 257 HGB, Art. 30 Código de Comercio; Art. 6(1)(c) GDPR), also beyond an account deletion (Art. 17(3)(b) GDPR). The record holds only the identifiers of the purchase and the account and the timestamps; name and e-mail address appear in the acknowledgement sent to you and in the notice to our operator mailbox, which we keep for the same period.
• Guests removed from the guest list: they disappear at once from every list, count, mailing list, export and the guest page; the couple can restore them for 30 days, after which we delete them for good. Until then the own data copy (Art. 15) lists them with the date of removal. On request the couple deletes an entry for good at once (“Delete for good”). Delivery logs (which message went to the address and when) and the address’s entry on the block list remain until the wedding data is deleted, so that no message goes to a blocked address again.
• Deleted answers and photos: when the couple deletes an answer or a photo it stays under “Deleted” in the couple area for 30 days (the answer with its assignments, for a photo the file in storage) and can be restored; after that we delete it for good, photo files included. On request the couple deletes an item for good at once (“Delete for good”). Until then the items appear in your own data copy (Art. 15). An erasure under Art. 17 GDPR, the deletion of the account and the end of the wedding’s retention period clear “Deleted” as well.
• Deleted cost items and payments: when the couple deletes an item or a payment in the budget it stays for 30 days in the “Trash” of the tab “Costs” (an item with its payments) and can be restored; after that we delete it for good. On request the couple deletes an entry for good at once (“Delete for good”). Until then the entries appear in your own data copy (Art. 15). An erasure under Art. 17 GDPR, the deletion of the account and the end of the wedding’s retention period clear the trash as well.

9. Data subject rights

As a data subject, you have the following rights under the GDPR:

• Access (Art. 15): You may request information about the personal data we store.
• Rectification (Art. 16): You may request the correction of inaccurate data.
• Erasure (Art. 17): You may request the deletion of your data, unless legal retention obligations apply.
• Restriction (Art. 18): You may request restriction of processing.
• Data portability (Art. 20): You have the right to receive your data in a machine-readable format.
• Objection (Art. 21): You may object to processing based on legitimate interests at any time.
• Right to complain: You have the right to file a complaint with a data protection supervisory authority.

The supervisory authority competent for us is the Spanish Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. You may also contact the supervisory authority where you live or work (Art. 77 GDPR).

10. Automated decision-making

No automated decision-making including profiling pursuant to Art. 22 GDPR takes place.

11. Reports of illegal content

Through the Report content form you can report content that you believe is illegal (Art. 16 of Regulation (EU) 2022/2065, Digital Services Act).

We process the chosen reason, the address of the reported content, your explanation and your name and email address; for reports of child sexual abuse material, name and email address are optional. The explanation may contain data of third parties. To prevent abuse we count reports per IP address and per email address; for this we only store hashed identifiers that change daily, not the addresses themselves.

The purpose is to handle the report, to acknowledge its receipt and to tell you our decision. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 16 DSA, and Art. 6(1)(f) GDPR for abuse prevention (legitimate interest in a working reporting channel).

The report is sent by email through our email service provider Resend (see service providers) to our operator mailbox. We only disclose your identity to the couple whose content was reported if it is strictly necessary for the decision, for example for copyright. If there is a suspicion of a criminal offence threatening the life or safety of persons, we pass the necessary information to the competent law enforcement authorities (Art. 18 DSA, Art. 6(1)(c) GDPR).

12. Privacy contact

For privacy inquiries, please contact us at info@niiro.ai.

Responsible for data protection: Robin Kolb

Due to the size of our company, we are not required to appoint a Data Protection Officer. For all data protection matters, please use the contact address listed above.