Privacy Policy

Account Registration
When you create a Weddly account, we collect:
- Full name
- Email address
- Password (encrypted)
- Phone number (optional)
- Profile picture or avatar (optional)
- Billing address and payment information


Gallery and Media Information
When you create galleries and upload content, we collect:
- Gallery name, description, and slug
- Event date
- Cover images and media files
- Photos and videos uploaded by you or your guests
- Metadata associated with media (EXIF data, dimensions, timestamps)
- Captions and descriptions
- Gallery settings and configuration


Guest Information
When you invite guests to upload media, we collect:
- Guest name
- Guest email address (optional)
- Device identifiers (for tracking anonymous guest contributions)
- Guest comments and reactions to photos
- Upload activity logs


Payment Information
When you subscribe to a paid plan, we collect:
- Billing address
- Payment method details (credit card, debit card information)
- Billing history and transaction records
- Subscription preferences

Note: Payment information is processed by Stripe, our third-party payment processor. We do not store complete credit card numbers on our servers.


Communication
When you contact us, we collect:
- Email address
- Name
- Subject and content of your message
- Any attachments you provide


User Profile Information
- Customizable profile information you choose to provide
- Preferences and settings
- Support interactions and feedback


Consent Verification Data
When you provide consent for specific actions (such as changing a gallery URL, accepting terms, requesting data export, or deleting your account), we collect additional information to verify the authenticity of your consent and maintain a legally compliant audit trail:
- IP Address: To verify the geographic location and authenticity of the consent
- User Agent String: Browser type, version, operating system, and device information to identify the device used to provide consent
- Timestamp: The exact date and time consent was given
- Consent Context: Details about what you consented to (e.g., old and new values for URL changes)
- Consent Status: Whether consent was given or revoked

This information is collected under our legitimate interest in maintaining GDPR-compliant consent records and protecting both you and Weddly from fraudulent activity. Consent records are retained for 6 years to meet legal compliance requirements for demonstrating valid consent.

You can view your consent history in your account settings. This data is used solely for legal compliance and consent verification purposes and is not used for marketing or profiling.

Usage Data
- Pages visited and time spent
- Features used and interactions with the Service
- Gallery access patterns
- Download and export activities
- Search queries
- Clicks and mouse movements
- Referral sources


Device Information
- Device type, model, and operating system
- Browser type and version
- IP address and geolocation (approximate)
- Unique device identifiers
- Mobile advertising IDs
- Device settings


Cookies and Similar Technologies
- Session identifiers
- Authentication tokens
- User preferences
- Analytics data
- Advertising identifiers


Log Data
- Server logs containing IP addresses
- Access timestamps
- Browser type and language
- Pages accessed and referrer URLs
- Error logs and system events


Analytics
- Page views and session duration
- Feature usage patterns
- Conversion events
- User behavior flows
- Performance metrics

Service Providers
- Stripe (payment processing)
- Supabase (database and authentication)
- Analytics providers
- Email service providers


Third-Party Integrations
- Information from social media platforms (if you authorize OAuth login)
- Information shared by other Weddly users about you

- Providing, maintaining, and improving the Service
- Processing transactions and sending transaction confirmations
- Creating and managing your account
- Enabling you to create galleries and upload media
- Facilitating guest uploads and interactions
- Storing and retrieving your photos and videos

- Sending transactional emails (account confirmations, password resets)
- Responding to your inquiries and support requests
- Sending service updates and announcements
- Notifying you of changes to our policies
- Sending survey requests and feedback requests

- Customizing content and recommendations
- Remembering your preferences and settings
- Improving user experience based on your interactions
- Providing personalized features (theme selection, language preferences)

- Sending promotional emails and special offers (with your consent)
- Conducting marketing campaigns
- Creating targeted advertising content
- Analyzing marketing effectiveness
- Developing new features based on user demand

- Understanding user behavior and usage patterns
- Measuring engagement and satisfaction
- Identifying popular features and improvements
- Conducting A/B testing
- Generating aggregate analytics reports

- Detecting and preventing fraud, abuse, and security incidents
- Protecting against malicious activity
- Enforcing our Terms of Service
- Protecting user rights and property
- Complying with legal obligations
- Investigating suspected violations of law

- Complying with applicable laws and regulations
- Responding to legal requests and court orders
- Protecting against legal liability
- Enforcing contractual agreements

- Service improvement and optimization
- Fraud prevention and security
- Marketing and business purposes (balanced against your rights)
- Analytics and user behavior analysis

- Providing the Service as contracted
- Processing payments
- Fulfilling your requests

- Marketing communications (unless based on legitimate interests)
- Non-essential cookies
- Analytics
- Optional features and integrations

- Compliance with tax and financial regulations
- Responding to government requests
- Protecting user safety

- Protecting your health and safety
- Preventing harm

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

With Service Providers:
- Stripe: payment processing
- Supabase: database services and authentication
- Analytics providers: usage and behavior analysis
- Email service providers: transactional and marketing communications
- Cloud hosting providers: infrastructure and data storage
- Customer support tools: support ticket management

With Other Users:
- Gallery owners can see guest names, emails, and contribution records
- Guests invited to galleries can see uploaded media and other guests' contributions
- Team members can see shared gallery information (if team feature is enabled)

For Legal Reasons:
- When required by law, court order, or government request
- To protect against fraud or security threats
- To enforce our Terms of Service
- To protect user rights, property, and safety

Business Transfers:
- If Weddly is acquired, merges, or undergoes bankruptcy, your information may be transferred as part of that transaction

With Your Consent:
- When you explicitly authorize data sharing
- For features that require third-party integrations

We may share aggregate, anonymized, or de-identified data that cannot reasonably be used to identify you:
- Industry benchmarks and statistics
- Usage patterns and trends
- Research and insights (for academic or industry purposes)

Account Information:
- Retained for the duration of your account
- Retained for [X years] after account deletion for legal compliance

Gallery Content (Photos/Videos):
- Retained for as long as your account is active
- Deleted within [30 days] of account deletion
- You can delete specific content at any time

Payment and Billing Information:
- Retained for [7 years] for tax and accounting purposes
- Credit card information deleted after transaction completion

Support Communications:
- Retained for [3 years] for customer service and dispute resolution

Log Data:
- Server logs retained for [90 days]
- Security logs retained for [1 year]

Cookies:
- Session cookies: deleted when you close your browser
- Persistent cookies: deleted after [1 year] of inactivity
- You can delete cookies at any time through browser settings

Guest Information:
- Retained for the duration of the gallery
- Deleted when gallery is deleted
- You can remove guest data at any time

Consent Records:
- Retained for 6 years from the date consent was given
- Required for GDPR compliance and demonstrating valid consent
- Includes IP address, user agent, timestamp, and consent details
- Cannot be deleted during the retention period as they serve as legal proof of consent

Upon request, we will delete your personal information except:
- When required by law
- When necessary for contractual obligations
- When necessary for dispute resolution
- When needed for security purposes
- Backup copies (deleted within [90 days])

You have the right to:
- Access the personal information we hold about you
- Receive your data in a portable format (data export)
- Request a copy of your information in common formats

To exercise: Submit a request through your account settings or contact us at [privacy@weddly.com]

You have the right to:
- Correct inaccurate information
- Update outdated information
- Complete incomplete information

To exercise: Update your profile directly through account settings or contact us

You have the right to:
- Delete your account and associated data
- Request removal of specific information
- Exceptions: legally required records, dispute resolution, security

To exercise: Request deletion through account settings or contact us

You have the right to:
- Limit how we use your information
- Restrict processing for specific purposes
- Maintain data without processing it

To exercise: Contact us at [privacy@weddly.com]

You have the right to object to:
- Marketing communications
- Profiling and analytics
- Automated decision-making

To exercise: Click "unsubscribe" in emails or adjust settings in your account

You can withdraw consent for:
- Marketing communications
- Non-essential cookies
- Analytics
- Optional features

To exercise: Update your preferences in account settings or contact us

We do not use fully automated decision-making that produces legal or similarly significant effects. However, we use:
- Algorithmic content recommendations
- Fraud detection
- Spam filtering

You can request human review of these decisions.

You can:
- Opt out of promotional emails
- Adjust communication frequency
- Change notification preferences
- Customize marketing topics

You can:
- Disable cookies through browser settings
- Clear cookies manually
- Opt out of analytics cookies

Note: Some features may not function properly if you disable essential cookies

If you are a California resident:
- Right to know what personal information is collected
- Right to know whether personal information is sold or disclosed
- Right to delete personal information (with exceptions)
- Right to opt out of the "sale" of personal information
- Right to non-discrimination for exercising your rights

We do not sell your personal information in the traditional sense but may share it with service providers in ways that could be considered "sales" under CCPA. You have the right to opt out.

To exercise: Submit a request at [https://weddly.com/privacy-request]

If you are a Brazilian resident:
- Right to access your personal data
- Right to correct incomplete or inaccurate data
- Right to anonymization, blocking, or deletion
- Right to data portability
- Right to delete data collected with consent
- Right to information about data sharing
- Right to revoke consent
- Right to lodge a complaint with the National Data Protection Authority (ANPD)

If you are a Canadian resident:
- Right to access your personal information
- Right to correct your information
- Right to request accuracy correction
- Right to know how your information is used
- Right to opt out of marketing
- Right to lodge a complaint with the Privacy Commissioner

If you are in the United Kingdom:
- All GDPR rights apply (see Section 7.1-7.7)
- Right to lodge a complaint with the Information Commissioner's Office (ICO)
- Right to obtain confirmation of lawfulness of processing

We implement comprehensive security measures to protect your information:

Encryption:
- All data in transit is encrypted using TLS/SSL protocols
- Sensitive data at rest is encrypted using industry-standard encryption
- Database-level encryption for stored media

Access Control:
- Role-based access control (RBAC)
- Principle of least privilege
- Multi-factor authentication (MFA) for sensitive operations

Infrastructure Security:
- Secure cloud hosting with Supabase/AWS
- Regular security audits and penetration testing
- DDoS protection and rate limiting
- Web application firewall

Data Protection:
- Secure password hashing (bcrypt)
- No plain-text password storage
- Automatic session timeouts
- Secure cookie handling

Operational Security:
- Regular security training for staff
- Background checks for employees
- Confidentiality agreements
- Incident response procedures

While we use reasonable security measures, no system is completely secure. We cannot guarantee absolute security. You are responsible for:
- Maintaining the confidentiality of your password
- Protecting your login credentials
- Reporting unauthorized access
- Keeping your device and software updated

Weddly operates primarily in the United States. Your information may be:
- Processed in the United States
- Stored on servers located in the United States
- Accessed by employees in the United States

For users in the EEA, UK, or Switzerland:
- Data is transferred under Standard Contractual Clauses (SCCs)
- Adequacy decisions may apply
- You have rights to object to transfers

By using Weddly, you consent to the transfer of your information to countries that may have different data protection laws. Some countries may not have the same level of protection as your home country.

Your Rights:
- As outlined in Section 7.1-7.7
- Full GDPR protections apply

Our Obligations:
- Data Protection Impact Assessments (DPIA)
- Lawful basis for processing
- Data Processing Agreements available
- 30-day response timeline for requests

Legal Basis Summary:
- Contractual: Service provision and payment processing
- Consent: Marketing and analytics
- Legitimate Interests: Service improvement, fraud prevention, analytics
- Legal Obligation: Tax and regulatory compliance

Your Rights:
- All GDPR rights apply (UK GDPR)
- Data Protection Act 2018 protections
- ICO jurisdiction

Your Rights:
- Federal Data Protection Act (FADP) compliance
- Similar to GDPR protections
- Swiss data protection authority oversight

Your Rights:
- Access to your information
- Correction of information
- Opt-out of marketing
- Complaint to Privacy Commissioner

Your Rights:
- All rights in Section 7.11
- LGPD compliance
- ANPD complaint authority