Privacy Policy

1. Data controller

The data controller is DripBuild di Stefano Frediani, a sole trader based in Roma (Italy), Italian VAT no. 18679611006.

For any request regarding your data, write to info@sponsalia.app.

2. What data we collect

We process different categories of data depending on how you use the service:

• Account data (customers): name and email, handled through our authentication provider.
• Invitation content: the couple’s names, date, schedule, texts, FAQs and the guest list (names) you enter.
• RSVP data, provided by guests: attendance, any dietary needs or notes, whether children attend, and an optional message.
• Payment data: handled directly by the payment provider; Sponsalia does not store your card details.
• Technical data: the minimum needed to operate the service securely (e.g. a session cookie and a language-preference cookie) and, only if you consent to them, the ad-measurement cookies described in the Cookie Policy.
• Error reports: when a page breaks we collect the error message, the page it happened on and the kind of browser, so we can fix it. Your name and email are not attached to them.
• Conversations with the help assistant: if you use it, we keep what you write to it and what it answers, along with the language and the page you asked from. We need them to answer you and to understand what is hard to find in the product.

3. Why we process data and on what legal basis

• To provide the service (create, publish and manage the invite, collect RSVPs): performance of the contract (Art. 6.1.b GDPR).
• To handle payment: performance of the contract and legal obligations (Art. 6.1.b and 6.1.c).
• To send service communications (e.g. confirmations, account notices): performance of the contract.
• To send commercial communications (tips and news about Sponsalia): your consent (Art. 6.1.a), optional and withdrawable at any time — see section 4.
• To measure how well our ads work, i.e. to see which ad you arrived from and whether you then created an invitation: your consent (Art. 6.1.a), asked for through the cookie banner and withdrawable whenever you like — see the Cookie Policy.
• To translate your invitation automatically into the languages you choose: performance of the contract (Art. 6.1.b).
• To suggest a seating arrangement, if you turn the assistant on: performance of the contract (Art. 6.1.b), at your request and only when you use it.
• To ensure security, fix malfunctions and prevent abuse: legitimate interest (Art. 6.1.f).

As a customer you decide which guest data to enter: for that data Sponsalia acts as a technical provider and you are responsible for processing it lawfully.

4. Commercial communications

If you have given us your consent, we email you tips and news about Sponsalia. It is optional: refusing it, or withdrawing it later, takes nothing away from the service you bought.

You can change your mind whenever you like, in two equally simple ways: the “Emails from us” switch in your dashboard, or the unsubscribe link at the foot of every promotional email, which works in one click without signing in.

If you have purchased an invite we may write to you about services similar to ours, under Art. 130(4) of the Italian Privacy Code; there too, every message carries the means to object.

None of this covers service emails about your own invite — RSVPs, expiry warnings, payment receipts. They are not marketing and keep arriving whether or not you consented.

We keep the date of your choice and where it was made: that is the proof Art. 7(1) GDPR requires us to be able to produce.

5. Providers that process data on our behalf

To run the service we rely on trusted providers (data processors), including:

• Clerk — authentication and account management.
• Supabase — database and storage of service data.
• Vercel — application hosting.
• Stripe — payment processing.
• Resend — transactional email delivery.
• Sentry — application error reporting, so we learn something broke without waiting for you to tell us.
• DeepL — automatic translation of your invitation’s texts into the languages you choose.
• Vercel AI Gateway and Google — the models that translate when DeepL is unavailable or does not cover the language, and that suggest the seating arrangement and table names, only if you turn it on.

Two of these deserve a note, because they receive data you entered rather than only technical data. To DeepL we send the invitation texts to be translated, including the couple’s names; when DeepL is unavailable or does not cover the language you picked, those same texts go to a Google model through the Vercel AI Gateway instead, so your invitation is not left in a single language.

Your guests’ names, by contrast, never reach the seating assistant: before every request we replace them with meaningless labels (G1, G2, G3), and put them back only in the answer you read. The model receives those labels, which household each guest belongs to, and the instructions you give it (who sits with whom, who is a child, who needs an accessible seat). Dietary requirements are not sent to it at all. The mapping between label and person exists only for the length of the request and is stored nowhere.

The assistant runs only when you ask it to, and under those providers’ contractual terms the data sent is not used to train their models. If you would rather not use it, tables can be arranged by hand.

Some providers may process data outside the European Union: where they do, the transfer is based on appropriate safeguards (e.g. the EU Commission’s standard contractual clauses).

Separately, if you consent to marketing cookies, some data about your visit to the public site is sent to Meta Platforms Ireland Limited (Facebook, Instagram), which also uses it for its own purposes and therefore acts not as a processor on our behalf but as an independent controller. Consent can be withdrawn at any time and without consequence: see the Cookie Policy. No data is sent to Meta from the invitation pages guests see.

6. How long we keep data

We keep data for as long as needed to provide the service. For the invitation and your guests’ replies there are two deadlines, both counted from the wedding date you enter:

• the invitation stays published online until two months after the wedding date; after that it is taken offline and the link no longer resolves;
• the invitation’s data, including RSVPs and guest contact details, is permanently deleted twelve months after the wedding date. Until then you can export it from your account.
• conversations with the help assistant are kept for twelve months from when they happen, and are deleted together with your account if you close it sooner.

Thirty days before each of those deadlines we email the address linked to your account, so you can download what you need or ask us to step in.

You remain free to request deletion at any time, including before those deadlines. Payment-related data is kept for as long as required by tax and accounting obligations.

7. Your rights

At any time you can exercise your GDPR rights:

• access, rectification and erasure of your data;
• restriction of and objection to processing;
• data portability;
• withdrawal of consent, where processing is based on it.

To exercise them, write to info@sponsalia.app. You also have the right to lodge a complaint with a supervisory authority (in Italy, the Garante per la protezione dei dati personali).

8. Changes to this policy

We may update this policy over time. The version published on this page, with its date, is the one in force.