Privacy policy
Last updated: October 29, 2026
This policy explains what personal data WeWed collects, why, how long it is kept and what rights exist, in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Data Protection (LOPDGDD).
Data controller
The controller of the data is Iñaki Vázquez Romera, with tax ID 78762519P and address at C/Donantes 19, Bajo 2, 31500, Tudela (Navarra). Any question about personal data can be sent to hello@wewed.live.
Data collected and purposes
User account
When an account is created, the name, email address, password (stored encrypted and never visible) and preferred language are collected. They are used to give access to the account and its purchases, and to send the emails the service requires, such as the account confirmation or the password reset. Legal basis: performance of the contract entered into with the user (art. 6.1.b GDPR).
Purchases
For each purchase, the products, amount, date and payment reference are recorded, and an invoice showing the buyer's name and email address is issued and sent with the confirmation email. Payments are processed by Stripe: card details are entered directly in Stripe's secure forms and never reach WeWed's servers. Legal basis: performance of the contract and compliance with tax and accounting obligations (art. 6.1.b and 6.1.c GDPR).
Content of websites and invitations
The content the user adds in the editor is stored: names, the date and place of the wedding, the schedule, accommodation, gift list details (for example a bank account number) and photos. Before a photo is uploaded, it is resized and its metadata, location included, is removed. Once published, this content is visible to anyone who has the link. Legal basis: performance of the contract (art. 6.1.b GDPR).
Guests' responses
When a guest fills in the attendance form on a wedding website, their answers are stored: their name, whether they will attend and the other questions set up by the couple. Only the couple who own the website can see them, from their account. For this data, the couple is the controller and WeWed processes it on their behalf as a processor (art. 28 GDPR). If the couple asks for special categories of data, such as allergies or other health information, it is their responsibility to have a legal basis for collecting it.
Contact form
Messages sent through the contact form include the name, email address and message, and are answered by email. These messages are not stored in the database; they remain in WeWed's mailbox for as long as needed to deal with the request. Legal basis: legitimate interest in answering the questions received (art. 6.1.f GDPR).
Technical and security data
The servers record technical data such as the IP address, the pages requested and the date and time, to keep the service secure, prevent abuse (for example, by limiting repeated sign-in attempts) and fix errors. Legal basis: legitimate interest in protecting the service and its users (art. 6.1.f GDPR).
Usage statistics
Only if analytics cookies are accepted, Google Analytics records how the site is used: the pages visited, where the visit came from (for example a link or a campaign), the approximate location, the device and browser, and whether a purchase was completed. It is used to measure and improve the site and its promotion. Addresses are sent without their parameters, the data is not linked to the account, and it is not used for advertising. Legal basis: consent (art. 6.1.a GDPR), which can be withdrawn at any time from the cookie settings.
Information about the cookies used is available in the cookie policy.
Data is not sold, used for advertising, or used to make automated decisions or build profiles.
Retention periods
- Account, content of websites and invitations, and guests' responses: while the account is active. When the account is deleted from Settings, all of it is deleted, photos included.
- When the hosting period of a website or invitation ends and is not renewed, it stops being available, and its content, photos and guests' responses are deleted 3 months later.
- Purchase records and invoices: kept after the account is deleted, no longer linked to it, for the period required by commercial and tax law (6 years).
- Contact messages: up to 12 months after the request has been resolved.
- Server logs: a maximum of 30 days.
- Usage statistics (Google Analytics): 14 months.
Recipients of the data
Data is not sold or given to third parties, unless the law requires it. To provide the service, WeWed relies on the following providers, who process data on its behalf under the corresponding data processing agreements:
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting of the website, the database and the photos | European Union (Germany) |
| Stripe Payments Europe, Ltd. | Payment processing and fraud prevention | European Union (Ireland), with possible transfers to the United States |
| Resend (Plus Five Five, Inc.) | Sending emails (account, order confirmation, replies to the contact form) | United States |
| Google Ireland Limited | Usage statistics of the website (Google Analytics), only with consent | European Union (Ireland), with possible transfers to the United States |
International transfers
Some of these providers are in the United States or may access data from there. In those cases the transfer is covered by the EU–US Data Privacy Framework, where the provider is certified under it, or by the Standard Contractual Clauses approved by the European Commission.
Rights
Users can exercise the following rights at any time:
- Access: find out what personal data is processed.
- Rectification: correct data that is inaccurate or incomplete.
- Erasure: request that the data be deleted. The account can also be deleted directly from Settings.
- Objection: object to processing based on legitimate interest.
- Restriction: request that the processing of the data be restricted in certain cases.
- Portability: receive the data in a structured, commonly used, machine-readable format.
To exercise them, write to hello@wewed.live stating the right to be exercised. Proof of identity may be requested, and a reply will be given within one month. Wedding guests should contact the couple first, since the couple is responsible for their responses; WeWed will help them deal with the request.
If it is considered that the data has not been handled properly, a complaint can be lodged with the Spanish Data Protection Agency (www.aepd.es).
Security
Technical and organisational measures appropriate to the risk are applied, including encrypted connections (HTTPS), encrypted passwords, access to each account's data limited to its owner, and servers located in the European Union.
Minors
WeWed is intended for adults. Users must be at least 18 years old to create an account and make purchases.
Changes to this policy
This policy may be updated when the way data is processed or the applicable law changes. The new version will be published on this page with its date and, if the changes are significant, users will be notified by email.