Privacy Notice — Vouwa
Last updated: 21 May 2026
1. Data Controller
VOUWA (Vouwa) — contact: privacy@vouwa.com
2. GDPR roles (couple and guests)
For guest data entered in the guest list and collected via RSVP, gallery, seating, and related features, the couple using the service is generally the data controller (they determine purposes and means toward their guests). VOUWA processes that data as a data processor on behalf of the couple, limited to operating the platform.
Guests should exercise GDPR rights primarily with the couple; VOUWA provides technical support on request at privacy@vouwa.com, subject to identity verification and coordination with the controller couple.
3. Purposes of processing
- Providing wedding invitation services and related features (RSVP, gift registry / wishlist, seating, gallery, shared playlist, and other active package features)
- Vendor collaboration pages via unique links, including content and comments
- Operational transactional email when configured
- Install-to-home-screen / web app behaviour, including service workers and necessary local storage
- Processing contact requests from industry professionals via the public form
- Collecting platform reviews from couples and guests, with optional publication subject to explicit consent and moderation
- Managing accounts for professional organizations when enabled by the platform operator
- Aggregated, anonymous website usage statistics (Vercel Web Analytics, no profiling cookies)
- Authentication, support, legal compliance, and security
4. Legal basis
Performance of a contract, legitimate interests (security, non-identifying aggregate statistics), consent where required (e.g. review publication, professionals’ form).
5. Categories of data processed
- Identification data: name, surname, email, phone
- Invitation data: RSVP, dietary preferences, allergies, children, seating, song suggestions / playlist entries
- Vendor-page data: content, comments, contacts designated by the couple
- Professionals’ form: name, email, phone, business name, message, organization type
- Reviews: rating (1–5), optional comment, public display name, language, publication consent; on the landing page, optionally a photo (URL set in moderation or the invite Open Graph image)
- Professional organizations and authorized users (roles, assignments), where configured
- Technical data: IP, user-agent, logs; strictly necessary session cookies (e.g. admin auth); local storage for invitation install
6. Recipients / Processors
- Supabase — database and authentication (EU)
- Vercel — hosting
- Vercel Web Analytics — aggregated navigation statistics, no tracking cookies, no persistent cross-site identifiers
- Transactional email provider (e.g. Resend), when enabled for service notifications
7. International transfers
When necessary, appropriate safeguards (SCCs, etc.) will be adopted.
8. Retention
Data is retained as long as needed to provide the service and satisfy legal obligations (typically up to 3 years unless otherwise requested).
Free trial (24 hours): self-service trial data kept for a maximum of 24 hours from account creation unless VOUWA confirms the account; then automatic deletion.
9. Data subject rights
Access, rectification, erasure, restriction, portability, objection. Contact: privacy@vouwa.com
Published reviews: withdraw consent or request removal at privacy@vouwa.com.
10. Cookies and similar technologies
Strictly necessary cookies: required for authentication and operation (e.g. admin session on Supabase). No consent required.
Statistics (Vercel Web Analytics): cookieless tool that does not set profiling cookies; collects aggregated data (e.g. page path without sensitive query parameters, device type, approximate country). Legal basis: legitimate interest. You can disable statistics via the site information banner (“Decline statistics”) or by clearing browser data; the choice is stored in localStorage on your device.
Invitation install / PWA: service workers and local storage may be used; removable via browser or OS settings.
We do not use advertising, remarketing, or cross-site profiling cookies.
11. Security
Technical and organizational measures: TLS encryption, access controls, backups.
12. Complaints
Complaints may be filed with the competent Data Protection Authority.
For requests: privacy@vouwa.com