1. Data controller and processor roles
When operating the Svatební plán application, responsibilities are divided in accordance with Article 4(7) and (8) of the GDPR:
A. Svatební plán as Personal Data Controller
The controller is Tomáš Šesták, Business ID (IČO) 07175612, with registered office at Tylovo náměstí 650/4, 120 00 Praha 2, Czech Republic (contact: soukromi@svatebniplan.cz). The Service operator acts as the controller of personal data of engaged couples and wedding coordinators (users) collected for account registration, account management, technical support, invoicing of a purchased wedding website, and compliance with related tax obligations. For coordinators, it is also the controller of their business identification details and the record of their acceptance of the Coordinator Terms.
B. Engaged couples as Controllers and Svatební plán as Processor
When engaged couples enter personal data of their wedding guests (names, households, phone numbers, dietary preferences) or suppliers into the planner, the couple acts as the Controller of that data. In this relationship, Svatební plán acts as the technical Processor, storing and processing the data solely on the couple's instructions to provide the planner and wedding website features (Article 28 GDPR).
C. Wedding coordinators as Controllers and Svatební plán as Processor
A wedding can be run in the app by a wedding coordinator in the Coordinator Studio. The controller of the guest, couple and supplier data that the coordinator enters for such a wedding, or that guests submit through its wedding website, is that coordinator; where the coordinator acts for the couple as their processor, the couple are the controllers. In this relationship, Svatební plán is a processor under its data processing agreement with the coordinator (Article 28 GDPR). Please send requests about this data to the coordinator; if you send them to us, we will pass them on.
2. Categories of data subjects and scope of processing
We process data relating to the following categories of people:
1. Engaged couples (wedding organisers)
- Identification and contact details: full name, email address.
- Authentication details: securely hashed password, Google / Apple sign-in identifier.
- Wedding metadata: planned wedding date and time, venue, time zone, selected currency.
- Planning records: budget items, schedule entries, tasks, notes.
- App review (optional): star rating, written comment, and consent to publish it. On the public website we show only the aggregate star rating and comments whose authors agreed to publish them, without names.
- Transaction details: wedding website purchase identifier, payment date, billing address (if requested).
- Wedding coordinators additionally: business identification details (name or company name, Business ID (IČO), registered address) and a record of accepting the Coordinator Terms and the data processing agreement (version and time).
2. Wedding guests
- Basic details: full name (or nickname), household/family group.
- Contact details (optional): email address and phone number entered by the couple.
- Postal address and form of address (optional): entered by the couple in the Addresses and envelopes section for printing envelope addresses.
- RSVP details: attendance confirmation for the ceremony, reception meal, or evening party, plus number of plus-ones and children.
- Dietary requirements and allergies: voluntarily provided in the RSVP form (such as vegetarian, gluten-free, or food allergies).
3. Guests contributing photos (QR gallery)
- Photograph content: images taken and uploaded by guests on the wedding day.
- Technical metadata: upload timestamp and image dimensions. Sensitive EXIF metadata (such as exact GPS location) is stripped from public previews.
4. Suppliers
- Contact details and price quotes saved by the couple in the Suppliers section to manage their wedding budget.
3. Purposes and legal bases for processing
All processing of personal data takes place in accordance with Article 6(1) of the GDPR on the following legal bases:
| Purpose of processing | Data categories | Legal basis |
|---|---|---|
| Creating and managing your account, providing the planner | Email, name, wedding metadata | Performance of a contract (Art. 6(1)(b) GDPR) |
| Publishing the wedding website and collecting RSVP replies | Wedding website content, guest names, RSVP replies | Performance of a contract (Art. 6(1)(b) GDPR) |
| Contract with a wedding coordinator in the Studio and records of their payments | Business identification details (name or company name, Business ID (IČO), registered address), record of accepting the terms | Performance of a contract (Art. 6(1)(b) GDPR) and compliance with a legal obligation (Art. 6(1)(c) GDPR) |
| Invoicing and accounting when purchasing a wedding website | Billing details, payment history | Compliance with a legal obligation (Art. 6(1)(c) GDPR) |
| System security, fraud prevention, diagnostics | Operational logs, IP address, app version | Legitimate interest (Art. 6(1)(f) GDPR) |
| Measuring website and app usage (with consent) | Pseudonymous device and account identifier, visited pages and completed steps, technical browser or device information | Consent (Art. 6(1)(a) GDPR) |
| Planning tips and reminders, product news, and offers by email (with consent, which you can withdraw at any time via the link in every email or under More → Emails from us) | Email address, record of granting and withdrawing consent (timestamp, source, wording), planning state (whether you have a date, guests, and co-planners), sent emails | Consent (Art. 6(1)(a) GDPR, Section 7 of Czech Act No. 480/2004 Coll.) |
| Anonymous page-view counting without storing data on your device | Visited page, technical browser information | Legitimate interest (Art. 6(1)(f) GDPR) |
| Handling a supplier enquiry sent from the planner | Contact email and optional phone number, couple's names, wedding date and location, guest count, budget, and enquiry message | Performance of a contract (Art. 6(1)(b) GDPR) |
| Processing guest dietary requirements and allergies in RSVP | Dietary restriction details | Explicit consent of the guest (Art. 9(2)(a) GDPR) |
4. Special categories of data (diets and allergies)
Information about food allergies or health-related dietary restrictions constitutes a special category of personal data (data concerning health under Article 9 GDPR).
Guests fill in these details on the RSVP form completely voluntarily for a single purpose: allowing the couple to arrange suitable catering at the wedding reception. By submitting the form, the guest gives explicit consent to process this information for organising the wedding. The guest may withdraw this consent at any time by contacting the couple or our support team.
5. Data retention periods
We retain personal data only for as long as strictly necessary:
- Planner data and user account: For as long as your account remains active. You can request permanent and irreversible deletion of your account and wedding at any time in the application (More → Account → Delete account); we delete them within 30 days.
- Try without registration (sample wedding): A sample plan opened without an account — along with anything you enter in it — is deleted after 14 days of inactivity and no later than 60 days after it was opened. You can delete it immediately using the Delete sample button. Please do not enter real personal data of your guests into the sample. Your browser stores a session token so you can return to the sample; without it, the sample cannot function.
- Wedding website and guest photos: The website remains published for the paid period (2 years, with the option to extend). Once that period ends, guests can no longer view it, and 60 days later we delete the website and everything on it — including guest photos, invitation links, gift reservations, and song requests. We email you the deletion date in advance. If we refund a website payment, we delete the website by the next day. This does not apply when refunding an accidental duplicate payment for an order already covered by another payment; in that case, the website remains unchanged. Your guest list with RSVP replies and other planner data stay in your account.
- Email marketing consents: We keep a record of granting and withdrawing consent for planning tips and offers while your account is active. After account deletion, only a cryptographic hash of the email address, the timestamp, and the consent wording are retained for 3 years so we can demonstrate that emails were sent lawfully (Article 17(3)(e) GDPR).
- Wedding coordinator data: We keep a coordinator's business identification details and the record of accepting the Coordinator Terms while the account is active. Weddings a coordinator runs are deleted no later than 90 days after their participation in the Studio ends, unless agreed otherwise with us.
- App review: For the duration of your account, or until you delete your review in the application (More → App review).
- Payment records: Records of paid orders are retained for the period required by Czech tax regulations — up to 10 years from the end of the calendar year in which the payment took place.
- Supplier enquiries: Supplier enquiries are kept while you are planning the wedding and deleted together with the wedding, no later than 12 months after the wedding date.
6. Data recipients and authorised processors
Only vetted infrastructure providers essential to running the platform have access to your data:
- Supabase Inc. – secure database hosting, user authentication, and encrypted file storage (data centres in the European Union – Frankfurt, Germany).
- Resend Inc. – delivery of transactional and system emails (registration verification, partner invitation, RSVP confirmation) and emails with planning tips or offers where you have given consent.
- Vercel Inc. – web application hosting and global CDN delivery.
- PostHog Inc. – website and application usage analytics (data centre in the European Union – Frankfurt, Germany). See Section 10 for details.
- Better Stack – error tracking and operational logs (data centre in the US; see Section 7).
- Licensed payment gateway – payment processing when purchasing a wedding website. Svatební plán never processes or stores payment card numbers.
- Suppliers you enquire with – we first send them your wedding date, location, guest count, and budget; we share your contact details only once the supplier accepts the enquiry. Partner suppliers pay us a referral fee. Once a supplier receives your details, they act as an independent data controller.
7. International data transfers
Primary data storage takes place in data centres within the European Union. For certain technology sub-processors (such as email delivery or application error tracking), data may be transferred to the United States. Where this occurs, transfers are safeguarded in accordance with the GDPR through:
- The EU–U.S. Data Privacy Framework.
- Standard Contractual Clauses (SCCs) approved by the European Commission.
8. Your rights under the GDPR
As a data subject, you have the following rights under Articles 15 to 22 of the GDPR:
Right of access
The right to obtain confirmation of whether we process your data and to receive a copy of that data.
Right to rectification
The right to promptly correct inaccurate or incomplete data directly in the application.
Right to erasure
The right to permanent deletion of your data (“right to be forgotten”) where it is no longer needed or where you withdraw consent.
Right to data portability
The right to receive your data in a structured, commonly used, and machine-readable format (CSV, JSON, PDF).
Right to restriction of processing
The right to request a temporary restriction of processing — for example, while the accuracy of your data is being verified.
Right to object
The right to object to processing based on the controller's legitimate interests.
9. Supervisory authority and contact
You can exercise your rights by sending a request to:
If you believe the processing of your personal data breaches data protection law, you have the right to lodge a complaint with the supervisory authority:
Office for Personal Data Protection (Úřad pro ochranu osobních údajů – ÚOOÚ)
Pplk. Sochora 27, 170 00 Praha 7, Czech Republic
Web: www.uoou.cz
Email: posta@uoou.cz
10. Usage analytics and error tracking
To understand which parts of the website and planner help you and where people get stuck, we measure usage with PostHog. Application errors and operational logs are processed with Better Stack.
- Without your choice: on public pages we count only anonymous page views. Nothing is stored on your device (no cookies or local storage), views are not linked to your account, and no profile is created.
- With your consent: we store a random identifier on your device and, once you sign in, link usage measurement to your account identifier. We record visited pages and completed steps, such as creating a wedding or purchasing a wedding website.
- If you decline: usage measurement is turned off completely.
We never measure names, email addresses, guest details, RSVP replies, budget amounts, photos, or form contents. Query parameters and advertising identifiers are stripped from page URLs. We do not use screen recording or automatic click tracking. Wedding websites for guests are not measured at all.
When an application error occurs, we send a technical error report, the app version, and your account identifier so we can find and fix the bug. Personal data is scrubbed from error reports before sending.
You can change your consent at any time in your account settings (More → Account → Privacy) or via the Privacy settings link in the website footer. Usage data is kept for at most 12 months.