Privacy for guests

1. Who processes your data

The couple who invited you decide which data to collect and how to use it: they are the data controller.

Sponsalia is the tool their invitation was made with, and stores that data on their behalf, on their instructions and without using it for its own purposes.

For any request about your data you can go straight to the couple. If you cannot reach them, write to info@sponsalia.app and we will pass it on.

2. What the form collects

Your name was already on the list the couple prepared, along with the contact details they used to send you the invitation: they entered that themselves — we did not collect it.

From the RSVP form we receive only what you write:

• your first and last name;
• whether you are coming or not;
• whether children are coming with you and, for each one, their age band;
• any dietary requirements, if you choose to state them;
• if the couple ask for them: your arrival and departure day, whether you need the shuttle, where you are staying and your booking confirmation number;
• a message for the couple, if you want to leave one.

The couple ask for this travel information only if they turned those questions on, and it is used to arrange shuttles, rooms and arrivals. It stays inside the invitation: it lives as long as the invitation does and is deleted with it.

For the children in your party the form asks for an age band (0-2, 3-5, 6-11, 12-17), never a date of birth: it is what the caterer needs to order the right covers, the venue to plan high chairs, and the couple to arrange the tables. A child’s name and dietary requirements are optional, and you give them, answering for your party.

3. What it is used for

To organise the day: knowing how many people to expect, arranging the tables, telling the caterer how many covers and which menus are needed.

There is no other purpose. This data is not sold, it feeds no advertising, and the invitation pages carry no ad-tracking tools.

4. Dietary requirements

If you state an intolerance, an allergy or a choice tied to your religion, that detail says something about your health or your beliefs: the GDPR protects it more strictly than the rest (Art. 9).

That is why the form asks for an explicit tick before it is sent, and asks only if you have stated something. You can leave the field empty and tell the couple in person: your reply goes through all the same.

The consent can be withdrawn at any time: just ask the couple to delete that detail.

5. Who else sees it

Besides the couple, only the technical providers that keep the service running, bound by a contract and unable to use it for themselves:

• Supabase — the database where the invitation and the replies are stored;
• Vercel — the infrastructure the site runs on;
• Resend — delivery of service emails;
• Sentry — error reporting, for when a page breaks.

6. The seating assistant

If the couple use the automatic assistant to arrange the tables, your name is not sent to it: before every request names are replaced with meaningless labels (G1, G2, G3) and put back only in the answer the couple read.

Dietary requirements are not sent to it at all. Of the children it receives only the age band, never the name.

7. How long it is kept

Both deadlines are counted from the wedding day: the invitation is taken offline two months after it, and everything collected — your reply included — is permanently deleted after twelve months.

You remain free to ask for it to be deleted sooner.

8. Your rights

You can ask to see the data about you, to correct it, to delete it, to restrict its use, or to withdraw the consent you gave.

The request goes to the couple, who decide; if you prefer, write to info@sponsalia.app and we will pass it on.

If you think something is wrong, you can turn to the supervisory authority in your country (in Italy, the Garante per la protezione dei dati personali).

9. The full text

This page is a summary. The complete version, listing every provider and the legal basis for each purpose, is in Sponsalia’s privacy policy.