Privacy policy
This policy explains what data Simha processes, why, for how long, and how to exercise your rights.
Who is responsible
For organizers’ accounts and payments, the controller is to be completed (to be completed), reachable at contact@simha.example.
For guests’ data (names, contact details, replies), the controller is the host organizing the celebration; Simha processes it on the host’s behalf under the data processing agreement.
Data processed
Organizers: name, email address, language, optionally phone; invitation content; purchases (without card details, handled by Stripe).
Guests: household and people’s names, phone or email, language, replies, number of people, menu choices. If the host asks, guests may indicate allergies or a level of kashrut: this information, which may reveal health data or religious beliefs, is entered only by the guest, is used only to organize the meal and is erased with everything else.
During and after the celebration: photos, guestbook messages, song requests and gifts (name, message, amount) posted by guests.
Why, and on what basis
Providing the service you asked for (contract); sending invitations, reminders and thank-you notes for the host (the host’s legitimate interest, guests can reply STOP or unsubscribe at any time); invoicing and accounting (legal obligation); securing the service and preventing fraud (legitimate interest).
We do not sell any data and do not use guests’ data for advertising.
Artificial intelligence
Writing help, translation and theme features send Anthropic’s AI service the event information (names of the people celebrated and of the hosts, dates, venues) or the description you typed, never guests’ contact details. Moderation of the photo wall and guestbook sends it the photos and texts posted by guests, without their contact details. Anthropic does not use them to train its models.
Retention
Guest data and celebration content: erased automatically 6 months after the event date, or 12 months if the host chooses (the keepsake page disappears at the same time). Gift amounts remain, without names, for the host’s accounting.
Organizer account: until deleted. Invoices: 10 years (accounting obligation). Technical logs: 30 days.
Processors and transfers
Vercel (hosting, European Union and United States), Neon (database, Frankfurt), Cloudflare (file storage and bot protection), Resend (email), Meta (WhatsApp), Twilio (SMS), Stripe (payments), Upstash (send queue), Anthropic (AI), Sentry (error tracking).
Some of these providers are located in the United States: transfers are covered by the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework.
Cookies
We use no advertising cookies. Page visits are measured anonymously, without cookies or identifiers, by Vercel Web Analytics. The only cookies are needed for the service: sign-in session, chosen language, and, if you arrive through a partner professional’s link, a 30-day cookie that credits them with their commission.
Your rights
You can request access, rectification, erasure or portability of your data, object to processing or ask for it to be restricted, by writing to contact@simha.example. Every personal invitation also contains a “Delete my data” link that immediately erases the guest’s information.
If you believe your rights are not respected, you can lodge a complaint with the CNIL (www.cnil.fr) or your local data protection authority.