What we do with the information in Sposera.
SIA Sposera, a company registered in Latvia under registration number 40203398310, runs this service and decides what happens to the information in it. Write to info@sposera.com about anything on this page, including any of the requests described below.
Your account: the email address you sign up with, a hashed password, and your name if you give one. Your wedding: everything you enter — guests and their contact details, dietary notes and replies, vendors, budgets, the schedule, seating, notes, and any pictures you upload. Much of this is other people’s information, given to you by them; you decide what goes in, and you should only put in what you need.
To run the service you asked for, to send the messages it depends on — an invitation to a partner, a password reset, an RSVP link — and to keep the service working and secure. We do not sell it, we do not use it to advertise to you, and we never pass your guest list to a vendor.
Hosting and the database sit with Hetzner, in Finland. Pictures you upload go to Hetzner Object Storage, also in Finland, and encrypted backups of the database to Hetzner Object Storage in Germany. Email is sent through Zoho. Error reports go to Sentry, which receives technical details of a fault and can include the page you were on. If you use “Sign in with Google”, Google confirms your address to us. If you use “Sign in with Facebook”, Meta gives us your name, your email address and an identifier for your Facebook account, and nothing else; we confirm the address ourselves with an emailed code. Where the Facebook button is shown, Meta’s sign-in script loads with the page, so Meta learns that it was opened. Each of these does its job on our instructions and for nothing else. When you buy a plan or a section, Paddle.com, our reseller and merchant of record, takes the payment: your card or other payment details, your billing address and, for a business, its name and VAT number go to Paddle, not to us, and Paddle handles them under its own privacy notice. Paddle tells us what was bought, for which wedding, the amount, and whether it was paid or refunded; we never see your card. On our public pages — the home page, pricing, the pages about each tool, the blog, sign-up and sign-in — and only if you allow it in the cookie banner, Google (Analytics and Ads) and Meta receive which of those pages were viewed, how the visitor arrived and, after signing up, that an account was created. They never receive anything from inside the app, from a wedding website or from an RSVP page. Google and Meta may process this in the United States, under the EU–US Data Privacy Framework.
We record which section was opened and when, so we know which parts of the app are used. Those records hold the section name, the action and the path — never what you typed, a guest’s details, or the text of a note. They are kept as counts after an account goes, and cannot be tied back to a person then. On the public pages, with your permission, Google Analytics counts visits and where they came from, and Google Ads and Meta tell us which of our ads lead to sign-ups.
A wedding is kept for a year after its wedding date. Sixty days after the date it becomes read-only; a year after the date the wedding and everything in it, uploaded pictures included, is deleted. Your account stays. We email you the day after the wedding, 7 days before it becomes read-only, and 30, 7 and 1 day before it is deleted, and you can download your guest list at any time until then. A wedding with no date is kept until you delete it. You can also delete it sooner yourself. The person who created a wedding deletes it by deleting their account; anyone else on it can delete their own account and leave the wedding with its creator. A deleted account is kept for 30 days, signed out and closed to guests, so it can be kept if that was a mistake; we email the date and a reminder 3 days before. After that the account and, for its creator, the wedding and everything in it, including uploaded pictures, are erased. A record of each purchase — what was bought, the amount and Paddle’s reference for it — is kept after that, without your name or email address, for our accounts. The database is backed up every night, encrypted, and each backup is deleted after 28 days, so a deletion reaches the backups within 28 days. Backups are used only to recover from a failure; if one is ever restored, every account deleted since it was made is deleted again.
You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it — in the app, or by writing to info@sposera.com. If you are a guest on somebody else’s wedding and want your details out of it, ask the couple first, since it is their list; write to us if that does not resolve it. You may also complain to the Data State Inspectorate in Latvia.
Inside the app we set no tracking cookies. Your browser keeps your sign-in token and small preferences — which columns you show, which view you left open — in local storage on your own device. On our public pages, analytics cookies (Google Analytics) and advertising cookies (Google Ads, Meta) are set only after you agree in the cookie banner, and you can allow one without the other. Your choice is kept on your device for six months; change or withdraw it at any time with "Cookie settings" at the bottom of those pages, which also deletes the cookies it can reach. Clearing your browser data clears all of it.
When you add a guest you are putting someone else’s details into the service. You decide what is held about them and for how long. We hold it on your behalf, do nothing else with it, and delete it when you delete them or the wedding.