Privacy Policy

Swiss Law (FADP)

The processing of personal data is based on the Swiss Federal Act on Data Protection (FADP, revised version of 1 September 2023) and the Data Protection Ordinance (DPO). Where no legal basis exists, we obtain explicit consent.

EU Law (GDPR)

For users in the European Economic Area (EEA), we base the processing on the following legal grounds:

• Art. 6(1)(a) GDPR – Consent (e.g. marketing, analytics)
• Art. 6(1)(b) GDPR – Performance of a contract (e.g. account management, payment processing)
• Art. 6(1)(c) GDPR – Legal obligation (e.g. accounting, taxes)
• Art. 6(1)(f) GDPR – Legitimate interest (e.g. security, abuse prevention)

4.1 When Visiting the Website (Without an Account)

• IP address (stored anonymised)
• Date and time of access
• Browser type and version
• Operating system
• Referrer URL (previously visited page)
• Pages and subpages accessed

This data is automatically collected by our hosting provider and serves system security and error analysis purposes.

4.2 When Creating an Account (Couples)

• First and last name
• Email address
• Password (stored encrypted, bcrypt/argon2)
• Wedding date and location
• Names of the partners
• Language and timezone settings

4.3 When Using the Platform

• Guest lists (names, email, RSVP status, dietary preferences)
• Wedding content (texts, images, schedule, budget data)
• Communication data (messages to guests)
• Documents (uploaded files)
• Usage data (activity log within the platform)

4.4 Wedding Guests

When guests access a wedding website via QR code or link, the following data may be collected:

• Name (entered by the couple)
• RSVP response and plus-ones
• Dietary preferences / allergies
• IP address (technically required, anonymised)

Note: The couple is responsible for obtaining the necessary consent from their guests for data processing. VJENY provides the technical infrastructure but does not act as an independent controller for guest data.

4.5 Payment Data

During payment processing, the following data is transmitted to our payment provider Stripe:

• Cardholder name
• Credit card number (processed by Stripe only, never stored on our servers)
• Expiry date and CVC
• Billing address

We do not store any credit card data ourselves. We only receive a transaction ID, payment status, and the last four digits of the card from Stripe.

6.1 Vercel Inc. – Hosting & Deployment

Purpose: Website hosting, server-side rendering, edge network
Data: IP address, HTTP request data, server log files
Headquarters: San Francisco, CA, USA
Transfer basis: EU-US Data Privacy Framework, Standard Contractual Clauses (SCC)
Privacy: vercel.com/legal/privacy-policy

6.2 PlanetScale Inc. – Database

Purpose: Storage of all user and platform data (MySQL-compatible)
Data: All data mentioned in section 4 (encrypted at rest and in transit)
Headquarters: San Francisco, CA, USA (Servers: AWS us-east / eu-west)
Transfer basis: EU-US Data Privacy Framework, Standard Contractual Clauses (SCC)
Privacy: planetscale.com/legal/privacy

6.3 Cloudinary Ltd. – Image Processing & CDN

Purpose: Storage, optimisation and delivery of images (profile pictures, wedding photos, template images)
Data: Uploaded image files, metadata (filename, size, format)
Headquarters: Santa Clara, CA, USA
Transfer basis: EU-US Data Privacy Framework, Standard Contractual Clauses (SCC)
Privacy: cloudinary.com/privacy

6.4 Stripe Inc. – Payment Processing

Purpose: Processing of credit card payments and subscriptions
Data: Payment data (see 4.5), email address, billing address
Headquarters: San Francisco, CA, USA (European office: Dublin, Ireland)
Transfer basis: EU-US Data Privacy Framework, Standard Contractual Clauses (SCC)
Certification: PCI DSS Level 1 (highest security standard for payment data)
Privacy: stripe.com/privacy

6.5 Cloudflare Inc. – DNS & Security

Purpose: DNS management, DDoS protection
Data: IP address, HTTP headers
Headquarters: San Francisco, CA, USA
Transfer basis: EU-US Data Privacy Framework, Standard Contractual Clauses (SCC)
Privacy: cloudflare.com/privacypolicy

6.6 Amazon Web Services (AWS) – File Storage & CDN

Purpose: Storage and delivery of user uploads (wedding photos, documents) via Amazon S3 and CloudFront CDN
Data: Uploaded files, file metadata (name, size, type)
Headquarters: Seattle, WA, USA (Servers: eu-central-1 Frankfurt, where available)
Transfer basis: EU-US Data Privacy Framework, Standard Contractual Clauses (SCC)
Privacy: aws.amazon.com/privacy

6.7 Twilio Inc. – WhatsApp Messaging

Purpose: Sending WhatsApp messages to wedding guests on behalf of the couple
Data: Recipient phone numbers, message content, attached images if applicable
Headquarters: San Francisco, CA, USA
Transfer basis: EU-US Data Privacy Framework, Standard Contractual Clauses (SCC)
Privacy: twilio.com/legal/privacy

6.8 Sentry (Functional Software Inc.) – Error Monitoring

Purpose: Error detection and performance monitoring
Data: IP address, error messages, stack traces, browser information
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) – ensuring platform stability
Headquarters: San Francisco, CA, USA
Transfer basis: EU-US Data Privacy Framework, Standard Contractual Clauses (SCC)
Privacy: sentry.io/privacy
Retention: 90 days

Essential Cookies

These cookies are strictly necessary for the operation of the website and cannot be disabled. They include session cookies, language settings and CSRF protection.

Functional Cookies

Store user preferences such as language and theme selection to improve the user experience.

Analytics Cookies

Only set with your explicit consent and serve for anonymised analysis of website usage. We currently do not use any third-party analytics cookies.

Under Swiss FADP

• Right of access (Art. 25 FADP): You may request information about your stored data at any time
• Right to rectification (Art. 32 FADP): You may request the correction of inaccurate data
• Right to deletion (Art. 32 FADP): You may request the deletion of your data, provided no statutory retention obligations apply
• Right to data portability (Art. 28 FADP): You may request the release of your data in a commonly used electronic format

Additionally under EU GDPR (for EEA residents)

• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR): Against processing based on legitimate interests
• Right to withdraw consent (Art. 7(3) GDPR): At any time, without giving reasons

Administrative Access

The platform operator maintains an internal administration dashboard with technical access to user data, communication logs and uploaded files. This access is strictly purpose-bound and is only used for:

• Technical troubleshooting and support requests
• Ensuring platform stability and security
• Detection and prevention of abuse
• Compliance with legal obligations

All administrative access is recorded in an audit log. Access to the administration dashboard is protected by two-factor authentication (2FA) and restricted to authorised personnel. No access to content occurs without a specific reason or purpose.

Switzerland

Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1, 3003 Bern
www.edoeb.admin.ch

Germany

The competent state data protection authority of your federal state

Austria

Austrian Data Protection Authority
Barichgasse 40–42, 1030 Vienna
www.dsb.gv.at

Croatia

Agencija za zaštitu osobnih podataka (AZOP)
Fra Grge Martića 14, 10000 Zagreb
azop.hr