Privacy Policy

1. Data Controller

The controller responsible for processing your personal data within the meaning of the General Data Protection Regulation (GDPR) and other applicable data protection laws is:

CreaCrate Productions e.U.
Lotte-Hass-Weg 2/11
1220 Vienna
Austria
Email (for data protection inquiries): privacy@thebigdaypage.com
Further company details are available in the Impressum.

2. General Information on Data Processing

This privacy policy applies to the use of our website and the web application known as "TheBigDayPage" (hereinafter referred to as "the service").

The provision of personal data is generally voluntary. However, some data is required for the functionality of our services. For example, user accounts, photo uploads, subscriptions, and payment processing via third-party providers (such as Stripe) require certain personal information to function properly.

If you do not provide the requested data, you may not be able to use specific features, such as accessing your personal wedding page, subscribing to paid photo gallery plans, or submitting contact forms.

This policy outlines the types of personal data we collect, the purposes and legal bases for processing this data, and your rights as a data subject.

3. Personal Data We Collect & Purposes of Processing

When visiting the website

Data collected: IP address, browser type, access time
Purpose: Technical functionality, IT security (e.g., protection against attacks), and usage analytics
Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest)
Storage period: Up to 30 days (EU processing by Vercel and Appwrite, with SCCs where transfers occur)

Vercel Web Analytics

We use Vercel Web Analytics to measure page views, routes, and aggregated usage patterns. This analytics setup does not use cookies and processes anonymous, aggregated data only. No personal identifiers or full IP addresses are stored for analytics, and session data is not retained beyond 24 hours. Data points may include page/route, referrer, device/browser type and version, network type, and country (ISO code). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, performant service and audience measurement without tracking). Provider: Vercel Inc. (EU processing with safeguards). Where transfers outside the EU occur, they are protected by Standard Contractual Clauses (Art. 46 GDPR). You can learn more in Vercel's privacy notices.

PostHog Product Analytics

We use PostHog to understand how users interact with the application (e.g., which template is selected, when wedding settings are saved, when media is uploaded, when a subscription plan is upgraded). PostHog is configured with in-memory persistence only — no cookies or localStorage are used, meaning no personal identifiers are stored between sessions. Data is processed exclusively on PostHog EU Cloud infrastructure (eu.i.posthog.com), ensuring all data remains within the European Union. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding product usage without personal profiling). Provider: PostHog Inc. (EU Cloud). You can learn more in PostHog's privacy policy.

Bot Detection (BotID)

We use bot detection technology (BotID) on certain endpoints to prevent automated abuse and fraud (e.g., newsletter sign-ups, payment initiation, media uploads, and email sending). This technology analyses device and browser environment signals — such as browser behaviour and JavaScript execution characteristics — to distinguish human visitors from automated bots. No personal profiles are created and the data is not used for advertising or tracking purposes. Processing is performed entirely within your browser; no fingerprint data is transmitted to third parties. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting our services from automated abuse and fraud).

When creating an account or using the app

Data collected: Email address, password (hashed), and wedding-related information such as couple’s names, wedding date, location, and personal messages
Purpose: Creating and managing user accounts, providing access to personal wedding pages, storing and displaying uploaded content
Legal basis: Art. 6 (1) lit. b GDPR (performance of a contract)

Deleting your account (self-service)

You can delete your account yourself at any time in your account settings (Settings → “Account” tab → “Delete account”). After you confirm with your e-mail address and — for password accounts — your password, your account, your wedding page and all associated data are permanently deleted at once: page content and address, uploaded photos and videos including guest contributions, QR codes and guest links, guest comments and reactions, activity logs and your login. There is no grace period and the deletion cannot be undone. You may also send an erasure request to privacy@thebigdaypage.com; we then run the same deletion routine on your behalf.

Partner accounts (partner.thebigdaypage.com) cannot use self-service deletion. Partners request erasure by e-mail to privacy@thebigdaypage.com; we carry out these requests manually and confirm by e-mail.

When using paid features (via Stripe)

Data collected: Email address, payment method, billing details, IP address
Purpose: Payment processing
Processor: Stripe Payments Europe Ltd.
Legal basis: Art. 6 (1) lit. b GDPR (performance of a contract)

When contacting us (e.g., via contact form)

Data collected: Email address, optionally name and message contents
Purpose: Responding to inquiries
Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in responding to inquiries)

Email communication

Sending emails

Service provider: Resend (servers located in Ireland)
Purpose: Delivering transactional system emails such as registration confirmations or subscription reminders
Legal basis: Art. 6 (1) lit. b and f GDPR (performance of a contract and legitimate interest)

Receiving emails

Service provider: Zoho Mail
Purpose: Receiving and handling incoming support inquiries
Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in responding to inquiries)
Note: Data may be processed in third countries (e.g., India, USA), safeguarded by EU Standard Contractual Clauses (Art. 46 GDPR)

Marketing and Reminder Emails

Purpose: From time to time, we may send emails with helpful reminders (e.g., post-wedding memory preservation tips), upgrade offers, or other promotional messages tailored to your account status (e.g., after your wedding date or after several months of free usage).
Legal basis: Art. 6 (1) lit. a GDPR (consent)
Note: These emails are only sent if you have explicitly opted in during registration. You can unsubscribe at any time via the link in the email or by contacting us at privacy@thebigdaypage.com.

Newsletter subscription

If you subscribe to our newsletter via our website (e.g., on the coming soon or landing page), we collect and process the following personal data:

Data collected: Email address, IP address at the time of registration, date and time of registration and confirmation (double-opt-in)
Purpose: To send you periodic updates, announcements, and marketing communications related to TheBigDayPage
Service provider: Resend (servers located in Ireland)
Legal basis: Art. 6 (1) lit. a GDPR (consent)
Note: You may withdraw your consent at any time by clicking the unsubscribe link included in every newsletter or by contacting us at privacy@thebigdaypage.com

Guest uploads to a wedding page (live wedding uploads)

If you are an invited guest and contribute content to a couple’s wedding page through a guest-upload link or QR code, we process the following data so that your contribution can be shown on that page.

Data collected: Photos and videos uploaded by guests (recorded videos include audio), an optional display name chosen by the guest, comments and reactions (“likes”), the guest’s IP address, and a randomly generated, pseudonymous guest-session identifier
Embedded metadata: Uploaded photos and videos may contain embedded technical metadata — for example, the time a photo was taken and, depending on the guest’s device settings, location data such as GPS coordinates. This metadata is stored together with the media file as provided by the guest’s device.
Camera and microphone: If a guest uses the in-browser camera, the browser requests access to the device camera and, when recording video, the microphone. Captured photos and videos stay on the guest’s device and are only transmitted to us when the guest actively chooses to upload them.
Purpose: Allowing invited guests to contribute photos and videos to a couple’s wedding page, displaying these contributions in the live feed and gallery, enabling the couple to moderate them, and protecting the feature against abuse
Legal basis. We rely on Art. 6 (1) lit. b GDPR for operating the guest-upload feature as part of our contract with the account holder. The publication of guest content on the page is governed by the account holder's own legal basis (see Roles above). For our own processing to secure and operate the feature — including the short-term use of a guest's IP address for abuse prevention — we rely on Art. 6 (1) lit. f GDPR (our legitimate interest in providing a functioning, abuse-resistant service); a balancing assessment is documented and available on request. A guest's own decision to upload content, choose a display name, comment or react is based on the guest's consent under Art. 6 (1) lit. a GDPR, given when the guest chooses to contribute. Where guest content reveals special categories of personal data within the meaning of Art. 9 GDPR (for example religious belief depicted in ceremony imagery), the corresponding Art. 9 condition — generally the explicit consent of the persons concerned — must be ensured by the account holder before such content is uploaded.
Storage period: Guest-uploaded media that the couple does not promote into their permanent gallery is automatically scheduled for deletion approximately 14 days after the guest-upload window closes. Promoted media is retained in line with the couple’s account and plan (see Section 7).

Please note: a photo taken on a smartphone may contain the location where it was taken. If you would prefer not to share this, you can turn off location data for your camera in your device settings before taking or uploading a photo.

Album download by the couple: The account holder can save guest contributions that were not rejected as a ZIP archive of the original files — in full resolution and including any embedded metadata, such as the time a photo was taken and, where present, GPS location data — and keep these copies outside the platform. For copies downloaded this way, the account holder is responsible as an independent controller (see Roles below); deletion within our systems does not affect them.

Roles and responsibilities. The account holder (the couple) decides whether to enable guest uploads, who receives the upload link, how long the upload window stays open, and which contributions remain visible. With regard to the guest content itself — the photos, videos, display names, comments and reactions shown on their wedding page — the account holder is the controller, and CreaCrate Productions e.U. acts as a processor providing the hosting and display infrastructure on the account holder's instructions. CreaCrate Productions e.U. acts as an independent controller for the limited processing it carries out for its own purposes, namely securing the feature against abuse (including the short-term processing of a guest's IP address), operating the upload session, and ensuring the technical integrity of the service. Account holders are responsible for informing their guests appropriately, for ensuring they have a valid legal basis for collecting and publishing content that depicts or records other people, and — where such content reveals special categories of data (for example religious belief shown in ceremony imagery) or depicts children — for ensuring an appropriate additional legal basis and any required consents are in place before uploading.

4. Legal Basis Summary

The following table summarizes the legal bases for different processing purposes:

Account creation & login: Art. 6 (1) lit. b GDPR (contract)
Website operation & security: Art. 6 (1) lit. f GDPR (legitimate interest)
Payment processing via Stripe: Art. 6 (1) lit. b GDPR (contract)
Support/contact requests: Art. 6 (1) lit. f GDPR (legitimate interest in responding to inquiries)
Hosting of wedding pages & galleries: Art. 6 (1) lit. b GDPR (contract)
Session/misuse protection: Art. 6 (1) lit. f GDPR (legitimate interest)
Guest uploads to a wedding page: operating the feature under Art. 6 (1) lit. b GDPR (contract with the account holder); our own security/abuse processing under Art. 6 (1) lit. f GDPR; the guest's own contribution under Art. 6 (1) lit. a GDPR (consent). Publication of guest content is governed by the account holder's own legal basis.

Email Scenarios & Legal Grounds

1. Registration: Account creation and confirmation – Art. 6 (1) lit. b GDPR
2. Password reset: Reset links – Art. 6 (1) lit. b GDPR
3. Subscription confirmation: Welcome email, Stripe confirmation – Art. 6 (1) lit. b GDPR
4. Payment reminders / failed payments: Notifications about subscription issues – Art. 6 (1) lit. b GDPR (performance of a contract)
5. Support replies: Replies to contact forms or emails – Art. 6 (1) lit. f GDPR (legitimate interest in responding to inquiries)
6. Functional updates (non-promotional): Feature information to active users – Art. 6 (1) lit. f GDPR
7. Promotional newsletters or campaigns: Only with explicit consent – Art. 6 (1) lit. a GDPR
8. Guest-upload reminders: Notifications to the couple shortly before and when their guest-upload window opens – Art. 6 (1) lit. b and f GDPR (performance of a contract and legitimate interest)

5. Data Recipients

Hosting: Vercel Inc. — EU processing, safeguarded by EU Standard Contractual Clauses (SCC) where transfers occur
Backend infrastructure: Appwrite Ltd. (Frankfurt, Germany) – acting as a data processor under Art. 28 GDPR
Media storage and delivery: Amazon Web Services (AWS S3) – used to store and serve uploaded media files; processing location depends on configured AWS region and may involve third-country transfers under appropriate safeguards.
Payment processing: Stripe Payments Europe Ltd.
Email/Newsletter sending: Resend Inc. (Ireland) – acting as processor under Art. 28 GDPR; data may be transferred under SCC if sub-processors are located outside the EU.
Email reception: Zoho Corporation – Data transfer to third countries (e.g., India, USA) based on SCC (Art. 46 GDPR)
Rate limiting and abuse prevention: Upstash, Inc. (Redis infrastructure) – used for request throttling on the main platform. Abuse prevention for guest uploads does not use Upstash; it relies on short-lived, in-memory rate-limit counters only (see Section 7).
Product analytics: PostHog Inc. (EU Cloud, eu.i.posthog.com) – in-memory only, no cross-session identifiers

6. Data Transfers to Third Countries

Where personal data is transferred to countries outside the EEA, we rely on appropriate safeguards under Art. 46 GDPR, in particular the European Commission’s Standard Contractual Clauses (SCCs), unless an adequacy decision applies. We also implement transfer impact assessments and supplementary safeguards where required.

Relevant service providers may include:

Stripe (payment processing)
Vercel (hosting and analytics)
Amazon Web Services (media storage and delivery)
Upstash (rate limiting and abuse prevention)
Zoho (email services)

7. Data Retention Periods

User account data: Retained for as long as the account exists. When you delete your account, all account and wedding-page data is deleted immediately (see Section 3, “Deleting your account”). We also delete the account with all of its data when a plan's grace period ends (see “Uploaded photos & videos” below), and we may delete unused free accounts (no wedding page set up, no date, hero image, details or activity, and no login for 60 days; after an e-mail notice at least 14 days in advance) as well as free accounts whose e-mail address was not confirmed within 7 days and whose page was never set up or used. Only the billing records, the partner ledger entries and — in the cases described below — a deletion record are kept.
Billing records: If you paid for a plan, the invoices and payment records held by our payment provider Stripe are retained for 7 years as required by § 132 BAO (Austrian Federal Fiscal Code), on the basis of Art. 17(3)(b) GDPR. The link between your former account and these records is removed; everything else is deleted.
Deletion record: When you delete your account yourself and the deletion completes, no record of it is retained — the deletion routine, its tests and this policy document how deletions are carried out (Art. 5(2) GDPR). A pseudonymous record is kept only where a deletion did not complete cleanly, or where we carried out the deletion for you on request or under the retention rules in Section 11 of our Terms (end of a plan's grace period, unused or unconfirmed accounts). It contains a salted hash of the e-mail address, the identifier of the deleted account (which no longer refers to any data), the date and channel of the request and a list of the data categories deleted or retained — no name, e-mail address, IP address, page address or content. Such records are kept for 3 years after completion and then deleted; records of deletions that have not been completed are kept until they are resolved.
Partner ledger: If a wedding partner referred you to us or set up your page for you, that partner’s commission and settlement entries are kept only where a settled transaction exists (a commission paid or approved for payout, a completed partner purchase) — for 7 years under § 132 BAO, on the basis of Art. 17(3)(b) GDPR. In those entries every reference to you or your page is replaced by a random identifier; only the accounting facts (partner, amount, currency, date, payment reference) remain. Where no settled transaction exists, the entries are deleted together with your account.
Backups: Encrypted database backups are kept for 7 days and rotate out automatically; deleted data disappears from the backups within that period and is not restored to active use except where required by law.
Uploaded photos & videos: Retained while your account is active. If a paid subscription ends through non-renewal, cancellation at period end or failed payment, the account and all of its content, including photos and videos, are deleted after a grace period of approximately 6 months (183 days) after entitlement ends. In entitlement-revocation cases such as a full refund or a lost payment dispute, this happens 30 days after the revocation event. If a free plan expires, the account and its content are deleted after an additional grace period of approximately 6 months. We notify you by e-mail at least 7 days before such a deletion. Deletion is performed by scheduled background jobs; once processed, it is permanent.
Guest-uploaded media (live wedding uploads): Photos and videos uploaded by guests are scheduled for deletion approximately 14 days after the guest-upload window closes, unless the couple promotes a contribution into their permanent gallery, in which case it follows the retention rules for uploaded media described above. Associated comments and reactions are removed together with the media.
Album-download ZIP archives: retained for the 7-day download window after creation and then automatically deleted by a scheduled background job.
Server logs (IP addresses): Up to 30 days
Guest-upload abuse-prevention data (IP-based rate-limit counters): held only transiently in server memory for the duration of a short rate-limit window — no longer than 15 minutes — and then automatically discarded. This data is not written to a database or any long-term store.
Support inquiries: Up to 6 months after resolution
Newsletter subscriptions: Newsletter data (email address, consent logs): Stored until you withdraw your consent or unsubscribe from the newsletter. After unsubscription, data may be retained for up to 6 months solely to document lawful consent withdrawal.

8. Data Subject Rights

Under the GDPR, you have the following rights regarding your personal data:

Right of access (Art. 15 GDPR): You have the right to know whether we process personal data about you and, if so, to receive a copy of that data along with additional information.
Right to rectification (Art. 16 GDPR): You have the right to request correction of inaccurate or incomplete data.
Right to erasure (Art. 17 GDPR): You can exercise this right yourself at any time via “Delete account” in your account settings; the deletion takes effect immediately. Alternatively, e-mail us and we will carry out the deletion for you. Section 3 describes what is deleted and Section 7 the retention exceptions.
Right to restriction of processing (Art. 18 GDPR): You may request that we limit the processing of your data in specific circumstances.
Right to data portability (Art. 20 GDPR): You have the right to obtain your personal data in a structured, commonly used format and transfer it to another controller.
Right to object (Art. 21 GDPR): You can object to the processing of your data based on our legitimate interests or for direct marketing purposes.
Right to withdraw consent (Art. 7(3) GDPR): If processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing based on consent before its withdrawal.
Right to lodge a complaint: If you believe your data protection rights have been violated, you can lodge a complaint with your local data protection authority. For Austria, this is the Datenschutzbehörde (DSB).

You may withdraw your consent at any time by contacting us at privacy@thebigdaypage.com.

We will respond to your request without undue delay and in any event within one month, in accordance with Art. 12 GDPR.

We do not carry out solely automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR.

If you contributed content (such as photos, videos or comments) to a wedding page as a guest, you can exercise your data-protection rights — including access to and erasure of your own contributions — by contacting us at privacy@thebigdaypage.com, or by asking the couple who created the page. Where we act on the couple’s behalf, we will forward your request to them or assist them in handling it. Because guest contributions are pseudonymous and not linked to a guest account, we may need additional information from you to locate the specific content you contributed before we can act on your request. Please also note that erasure within our systems does not extend to copies the couple has already downloaded via the album-download feature; for such copies, the couple is responsible as an independent controller.

9. Cookies & Similar Technologies

We use cookies and similar browser storage technologies only where technically necessary for the operation of the service. This includes session cookies used for authentication (via Appwrite), payment session cookies (via Stripe), and session storage used during newsletter confirmation and resend flows. Authentication is managed via a secure, HTTP-only Appwrite session cookie; no authentication tokens are written to localStorage — any tokens held in memory are cleared when the session ends.

These cookies and storage entries are used exclusively to provide core security and account functions and are not used for advertising purposes. They do not require consent under GDPR/ePrivacy where they are strictly necessary to provide the requested service. Accordingly, we do not use a cookie consent banner.

For detailed information on specific cookies and browser storage purposes, please refer to our Cookie Policy.

10. Changes to this Privacy Policy

We may update this privacy policy to reflect changes in our services, legal requirements, or technical developments. The date of the latest change will always be indicated below.

Last updated: July 20, 2026