Privacy Policy

Frankford's IT-Solutions GmbH

Fallmerayerstraße 14, 6020 Innsbruck, Austria

VAT identification number: ATU79476149 | Commercial register: FN 604296x (Handelsgericht Innsbruck)

Email: support@wedding-companion.com

For all privacy-related enquiries or to exercise your rights, please contact us at the email address above.

Account data. When you register we collect your email address and name. This information is required to create and manage your account.

Wedding and event data. You may enter wedding dates, venue information, event schedules, menu options, and other details to build your wedding website.

Guest data. You can add names, email addresses, dietary preferences, and attendee responses for your guests. You are the data controller for your guests' personal data; we process it on your behalf as a data processor (see Section 8).

Photos and media. You and your guests may upload photos and other files to the gallery. You are responsible for ensuring you have the right to share any content you upload. Before a photo is stored, we remove its embedded metadata such as the location (GPS), the time it was taken and the camera details. Only the orientation of the image is kept.

Face data. If the couple has switched on the face search for their photo gallery, the faces in its photos and in the selfie of a guest who uses the search are analysed. This is biometric data, see Section 10.

Technical data. Our servers automatically record IP addresses, browser type, operating system, and request timestamps for security and operational purposes.

Payment data. Payments are processed directly by Stripe, Inc. We receive only your subscription plan type and payment status. We do not store card numbers or bank account details.

Partner applications. Photographers, planners and venues who apply for the partner program give us their business and contact name, email address, website, city, country and message. We also store when they agreed and when they confirmed (double opt-in), their browser identification and a keyed hash of their IP address, never the address itself.

We process your personal data for the following purposes and on the following legal bases under Art. 6 GDPR, for face data also under Art. 9 GDPR:

Providing the Wedding Companion service: Art. 6(1)(b) (performance of contract).

Sending transactional emails (account confirmations, attendee notifications): Art. 6(1)(b) (performance of contract).

Ensuring platform security and preventing fraud: Art. 6(1)(f) (legitimate interest).

Complying with tax and accounting obligations: Art. 6(1)(c) (legal obligation).

Face search in the photo gallery: Art. 6(1)(a) and Art. 9(2)(a) (explicit consent, see Section 10).

Showing a published wedding page in search engines: Art. 6(1)(a) (consent of the couple, switch in the settings, see Section 11).

Handling partner program applications: Art. 6(1)(a) (consent, confirmed by email) and Art. 6(1)(b) (steps before a contract).

We do not use your personal data for direct marketing without your explicit consent.

We share your data only with trusted service providers strictly necessary to operate the platform. Each processor has entered into a Data Processing Agreement with us.

netcup GmbH (Karlsruhe, Germany): hosting. The application, the database and the photos uploaded to the galleries run on a server that we rent from netcup in a data centre in Nuremberg, Germany.

Stripe, Inc. (San Francisco, USA): payment processing. Stripe is an independent data controller for payment data. Transfers are covered by SCCs.

Transactional emails (confirmations, attendee notifications) are sent through our email service provider from servers in the EU.

Amazon Web Services EMEA SARL (Luxembourg): face search in the photo galleries with Amazon Rekognition, processed in the AWS region Frankfurt (eu-central-1), Germany. See Section 10.

Google Ireland Limited (Dublin, Ireland): storage of our encrypted backups (Google Workspace). The backups are encrypted on our server before they are uploaded, Google cannot read them. See Section 6.

Google LLC (Mountain View, USA): embedded maps. Public wedding pages can display the venue location through an embedded Google Maps frame. When a guest chooses to show the map, their browser establishes a direct connection to Google and transmits technical data (IP address, browser/device information, referrer URL). Google may use this data in accordance with its own privacy policy (https://policies.google.com/privacy). Transfers to the US are covered by Standard Contractual Clauses. See Section 9 for details on how this is configured.

The fonts of this website are delivered from our own server. Your browser does not load them from Google or any other third party.

We do not sell, rent, or share your personal data with any third party for their own marketing purposes.

Hosting, the sending of emails and the face search take place in the EU, and our backups are stored encrypted. Stripe, Inc. and Google LLC are US companies, Amazon Web Services EMEA SARL and Google Ireland Limited belong to US groups. Where personal data is transferred to the United States, the transfer is protected by Standard Contractual Clauses (EU Commission Implementing Decision 2021/914).

You can request a copy of the applicable safeguards by contacting us at support@wedding-companion.com.

Account and service data: retained as long as your account exists, also after your subscription has ended, so that your wedding page and photos stay available to you. You can request the deletion of your account at any time, we complete it within 30 days of your request.

Wedding content and memories (wedding page, guest replies, photos): retained together with your account until you delete them or the account. Photos you delete from the gallery are removed right away, for the backups see below.

Payment records: retained for 7 years in compliance with Austrian tax law (§ 132 BAO, Bundesabgabenordnung).

Partner applications: deleted after 30 days if the email address is never confirmed. Confirmed applications are kept while we discuss or run the partnership and are deleted on request. Our team also receives each application by email, those mails are deleted on the same terms.

Server logs: automatically deleted after 30 days.

Backups: the database and the photos are backed up every day. The backups are encrypted on our server before they are stored off-site (Section 4) and are used only to restore the service after a failure. Database backups are kept for up to 60 days, photos deleted from a gallery stay in the photo backup for 30 days. Data that has been deleted, also at your request, is therefore gone from all backups 60 days later at the latest.

Under Articles 15–22 of the GDPR you have the following rights:

Right of access (Art. 15): you can request a copy of the personal data we hold about you.

Right to rectification (Art. 16): you can ask us to correct inaccurate or incomplete data.

Right to erasure (Art. 17): you can request that we delete your personal data.

Right to restriction of processing (Art. 18): you can ask us to limit how we use your data in certain circumstances.

Right to data portability (Art. 20): you can receive your data in a structured, machine-readable format.

Right to object (Art. 21): you can object to processing based on our legitimate interests.

To exercise any of these rights, email support@wedding-companion.com. We will respond within 30 days.

When you upload or collect personal data about your wedding guests through our platform, you act as an independent data controller for that data. You are responsible for having a valid legal basis under Art. 6 GDPR (for example, your guests' consent or a legitimate interest) before collecting and processing their information.

We act as your data processor for guest data under a Data Processing Agreement incorporated into our Terms of Service. We process guest data solely on your documented instructions.

Public wedding pages can display an interactive Google Maps frame so guests can see the venue location. To protect your privacy, the map is NOT loaded automatically. Instead, a placeholder with a "Show map" button is shown by default. No connection to Google is established until you explicitly click that button.

When (and only when) you click "Show map", the map is loaded directly from Google's servers (google.com / maps.google.com). Your browser then sends technical data to Google, including your IP address, browser type, device information, and the URL of the page you are viewing. Google may also set its own cookies on its domains as part of this connection.

Legal basis. By clicking the button you give your consent under Art. 6(1)(a) GDPR for this transfer of data to Google for the purpose of displaying the map.

We do not have access to or control over the data Google collects once the map is loaded. Google acts as an independent data controller for that processing. For details on how Google handles your data, see Google's privacy policy at https://policies.google.com/privacy. Transfers to the US are covered by Standard Contractual Clauses.

If you do not want to share data with Google, simply do not click the button. The venue address is still shown in plain text next to the placeholder.

The couple can offer a face search in their photo gallery. It is off until the couple switches it on in the settings. With the face search a guest uploads a selfie and sees the photos of the gallery that show him or her. The faces are compared by Amazon Rekognition, a service of Amazon Web Services EMEA SARL (Luxembourg), in the AWS region Frankfurt (eu-central-1), Germany, on our behalf.

What is processed. While the face search is switched on, Rekognition analyses every photo uploaded to the gallery and stores, for each face it finds, a face template: a numerical description of the facial features. Photos uploaded while it is off are not sent to AWS and cannot be found by the search. The templates are kept in a collection that belongs to this gallery only. AWS does not keep the photos themselves. For a search, the selfie is analysed in the same way and compared with the templates of this gallery. Face templates are biometric data within the meaning of Art. 9 GDPR.

Legal basis. A selfie is only sent after the guest has given explicit consent by ticking the box in the search dialog (Art. 6(1)(a) and Art. 9(2)(a) GDPR). For the analysis of the gallery photos, the couple, as the controller of the gallery (Section 8), is responsible for obtaining the consent of the people shown. Consent can be withdrawn at any time with effect for the future by email to support@wedding-companion.com.

Deletion. The selfie is not stored, neither by us nor by AWS. It is held in memory only for the comparison. The face templates of a photo are deleted together with the photo. When the couple switches the face search off or their account is deleted, the whole collection of the gallery is deleted.

Without consent no selfie is sent. The gallery works without the face search as well.

A published wedding page can be opened by anyone who has its link. It shows what the couple entered, for example names, date, venue, schedule and contact people.

Search engines may list the page only if the couple has switched this on in the settings ("Show our wedding page in search engines"). It is off for every wedding until the couple switches it on. While it is off, the page asks search engines not to include it or its images in their results (robots meta tag "noindex"), it is not listed in our sitemap, and it carries no machine-readable event data with names, date and venue.

When the couple switches it on, search engines can list the page with these details. Switching it off again restores the request not to list it. How fast a search engine removes the page is up to the search engine. The couple can also ask Google or Bing directly to remove a page.

Independent of this setting, our robots.txt asks crawlers that collect text for training AI models (for example GPTBot, ClaudeBot, Google-Extended and CCBot) not to fetch wedding pages and stored photos. Search engines and services that show a preview when the link is shared may fetch the page and its cover photo.

"noindex" and robots.txt are requests that reputable search engines and crawlers follow. They do not technically prevent access, which is why anyone with the link can still open the page.

If the wedding page shows other people, for example witnesses with their phone numbers, the couple, as the controller for that data (Section 8), obtains their consent before switching on search visibility.

We use only cookies that are technically necessary, on our own domain: the sign-in session (up to 30 days, renewed while you use the service), a signed cookie that recognises a browser which has signed in before and protects the sign-in against password guessing (180 days, sent only to the sign-in), a cookie that holds a password reset link for at most one hour, and a gallery pass that lets a guest who has entered the gallery PIN back into that gallery for 24 hours. The gallery page also keeps the PIN in your browser tab until you close it. We do not use tracking, analytics or advertising cookies.

Third-party services embedded on the platform (in particular Google Maps, see Section 9) may set their own cookies when loaded. These are managed entirely by the respective third party.

If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the Austrian supervisory authority:

Österreichische Datenschutzbehörde (DSB)

Barichgasse 40-42, 1030 Vienna, Austria

dsb@dsb.gv.at, www.dsb.gv.at

As an EU resident, you may also contact the supervisory authority of your country of habitual residence or the Member State where the alleged infringement occurred.

We may update this Privacy Policy from time to time. Registered users will be notified by email of any material changes at least 14 days before they take effect. Continued use of the service after that date constitutes acceptance of the updated policy.

The current version is always available at this URL.