Privacy policy

Controller and contact

The controller for account, billing and platform operations is WeKinly. Privacy requests can be submitted through the Contact page. For guest lists and organizer-selected event content, the organizer may also act as an independent controller and WeKinly processes that data to provide the service.

Information we process

We process account details, event content, RSVP responses, guestbook messages, uploaded media and technical data required to provide and secure the service.

• Account name, email and password hash
• Event details, guest responses and invitation delivery records
• Photos and videos submitted to event galleries
• Security logs, language and consent preferences

Why we process it

We use data to provide the service, authenticate users, deliver invitations, prevent abuse, respond to requests and - only with consent - understand product usage through analytics.

Legal bases

Account, event, guest and transaction data is processed to perform the contract. Billing records are kept to comply with tax and accounting law. Security, fraud prevention, troubleshooting and legal claims rely on legitimate interests after balancing individual rights. Optional analytics relies on consent, which may be withdrawn at any time.

Payments

Stripe collects and processes card and billing data under its own privacy terms. WeKinly receives transaction identifiers, product, amount, currency, status and limited billing details, but does not store full card numbers or card security codes.

Sharing and processors

Data may be handled by hosting, database, storage and email delivery providers acting under our instructions. GA4, Google Tag Manager and Microsoft Clarity run only after analytics consent; Meta browser and server-side measurement runs only after marketing consent. We do not sell personal data.

International transfers

Some providers may process data outside the EEA. Where required, transfers use an adequacy decision, Standard Contractual Clauses or another lawful safeguard. Details may be requested from the privacy contact.

Retention

Account and event data is kept while active and then deleted or anonymised under operational schedules. Security and delivery logs are retained only as reasonably needed. Transaction, invoice and accounting data is kept for legally required periods. Backups are overwritten on a rolling schedule.

Your rights and complaints

Subject to the GDPR, you may request access, correction, deletion, restriction or portability, object to legitimate-interest processing and withdraw consent. You may complain to the Bulgarian Commission for Personal Data Protection or your local EEA supervisory authority. We may verify identity before acting.

Children and automated decisions

The organizer service is intended for adults. Do not intentionally upload sensitive data unless lawful and necessary. We do not make decisions with legal or similarly significant effects solely by automated means.