Legal

Privacy Policy

Last updated: 5 October 2026

Who we are

Our Weddings (https://wedding.zerodown.top) is operated by Ruben Cipriano, Sole trader (Empresário em Nome Individual), NIF 264424018, Rua Doutor Mário Sacramento, 18, 2695-747 São João da Talha, Portugal. For anything about your personal data, write to [email protected] — the same address as for help with the service; a subject saying it is about your data gets it to the right place.

This policy covers everyone the service touches: couples who create a wedding site, the people they add to help run it, their guests, anyone who visits a page, and anyone who contacts us.

Two roles: ours, and the couple's

We are the controller for accounts, purchases, support requests, the security of the service, moderation of reported content, and the records described below that we keep for our own obligations.

For what a wedding site collects from its guests — RSVPs, photos and videos, quiz entries — the couple decides what to ask and why, so the couple is the controller and we handle that data on their behalf, under our data processing agreement. If you are a guest, the couple can answer most questions about their site fastest, but you can always come to us too.

What we collect, and why

Your account (if you sign in): your name, email address and profile picture link as your sign-in provider (Google, Facebook or Microsoft) shares them, which provider you used and your id there, your role, and which version of our terms you accepted and when. We use it to sign you in and run your account, because you asked us to (performance of a contract).
A couple's wedding site: what the couple writes — their names, the date, story, schedule, places and map location, a gift section with the payment details they choose to publish — plus its settings, the addresses that receive its notifications, and the people added as its admins. A site's design (colours, fonts) is not personal data. A site is visible to whoever has its link, and is also listed publicly if the couple chooses. We process this to provide the service the couple asked for (performance of a contract).
RSVPs: the name you give, whether you are coming, how many are in your party, your message and, if the couple asks, a dietary note. The dietary note is optional, and when a couple switches the question off nothing is stored for it even if it is sent. Dietary notes can reveal health or religious information, so only share what you are comfortable with. We also store the IP address the reply came from, for abuse prevention, and remove it after 30 days. If you were signed in, the reply is linked to your account.
Photos and videos you upload, and anyone who appears in them: the file, its caption and original file name, when it was uploaded, and your account if you were signed in. We remove location and other hidden metadata (EXIF) when a file is uploaded, which saves photos again rather than keeping them byte for byte; on a plan that keeps a web-quality copy, we also reduce each photo to that size (shown on the pricing page). We make smaller copies of photos and a phone-friendly copy of videos, and check every file for malware. We also check images, and sampled frames of videos, automatically for explicit content (see “Automatic screening of uploaded images” below).
Slideshow music, if a couple adds music to their venue slideshow: either a file they upload, with its file name (used as the track's title) and which account confirmed they have the right to use it, and when; or a copy of a track they chose from Openverse, with its title, artist, licence and where it came from. We check every music file for malware. What a couple types into the music search is sent to Openverse by our server. We use this to play the music the couple chose (performance of a contract).
Quiz (signed-in players only): your answers and score. Your name and profile picture appear on that wedding's leaderboard.
Reports about a photo or video: the reason you pick, any details you write, your name and email address if you choose to leave them, your account or device id, and your IP address. The couple sees the reason, your details and whether you were signed in — never your name, email address, account, device id or IP address. We use reports to take down content that should not be there, and your name and email only to tell you what was decided (legal obligation and legitimate interest).
Support requests: your name, email address, the topic, your messages, the wedding you mention (if any), and your account if you were signed in. A request goes to us, not to the couple. We use it to answer you (legitimate interest, or our contract with you if you are a customer).
Purchases: the plan, amounts, currency, dates, Stripe's invoices (for subscriptions) and receipts, and the payment status. Payment itself happens on Stripe's page: Stripe collects your card or payment details and a billing name and address, and we never see your card details. We need this to sell you the plan (contract) and keep the records tax law requires (legal obligation). To recognise a card that was withdrawn from or refunded on one account being used on another, we also keep with the payment Stripe's fingerprint of the card (an identifier Stripe makes for a card; it is not the card number and does not let us read it) for 180 days, and we use your record of withdrawals and refunds from the last six months, matched by account, email address and tax number, to apply the rule in our terms of sale on buying again after repeated withdrawals. The purpose is to prevent abuse of the right of withdrawal (legitimate interest); you can object, see "Your rights".
Your profile and invoice details: the full name you give (it starts as the name your sign-in provider reports, which it refreshes in its own copy each time you sign in), your country and language, the confirmation that you are 18 or older and when you gave it (we do not ask for or keep your date of birth), and, only if you want them on an invoice, a name and a tax number (NIF). The name and tax number go to our certified invoicing provider to issue the invoice; without a NIF the invoice is issued to "Consumidor final". We use them to sell to you and invoice you (contract and legal obligation) and to make sure buyers are adults (legitimate interest). You can change them under Account, Your profile.
Emails we send: a summary of new RSVPs (each guest's name, answer, party size, dietary note and message), sent daily, weekly or monthly as the couple chooses and only when there are new ones, to the addresses the couple chose — or, if they chose none, to the couple and their site admins, never to us; order confirmations and payment problems, to the buyer; replies to support requests, to the person who asked. We send no marketing emails. We keep a record of each email for 90 days after it is delivered.
Browser notifications (optional, off unless you switch them on in your admin): if you do, we store the address and encryption keys your browser gives us for that device, a label for it (such as “Chrome on Windows”) and when it last received a message, only to send you pop-ups about your own wedding or, for our administrators, about the platform. You can turn them off per device in the same place (or in your browser's settings), which deletes what we hold; deleting your account deletes it too.
Technical and security data: when you use the site our servers log your IP address, browser (user agent), the page or action, the time, and your account id if you are signed in. Important actions — signing in, sending an RSVP, administrative changes — are also written to a security log with the IP address, browser and account email. A random device id kept in your browser (see our cookie page) is used to stop one device flooding a gallery with uploads and to attribute reports. We use all this to keep the service secure and working (legitimate interest).
What happens in your account, and the errors you run into (account holders only; never visitors who are not signed in). So that we can help when something goes wrong, and keep your account secure, we keep a record of what happens in it: that you signed in, or a sign-in was refused; that you created or changed your wedding site, its sections, design, invitation or settings (which things changed, not what you wrote); that an upload, a video or a checkout started, finished or failed, with a reason code (for a payment, the error code Stripe gave); that you opened a support request; and a short report when the app shows you an error or an action fails on our side (which page and action, the error's name, a short text of it with addresses and numbers blanked, and a reference code). A failed upload by a signed-in guest on a couple's wedding is also shown to our support team with that couple's account. Each record carries the wedding it belongs to and a reference code of the request, which is what lets us find it when you quote it from an error message; the same records are also written to our server logs. We do not record with them your IP address or browser, which pages you look at, what you type, the contents of messages, photos or forms, or card details, and we do not replay your session. Our support team reads them when you ask for help or when they suggest something is wrong (for example a payment that keeps failing), and an automatic check lists the accounts that may need help; it decides nothing about you and sends our team a count, never a name. We use them to provide the service you asked for and to keep it secure and working (performance of a contract and legitimate interest).
Visitor statistics: we count visits — how many different IP addresses and devices, which pages (including which wedding pages), errors and response times — from the server logs above, for our own use. The underlying logs are deleted after 14 days (legitimate interest). A second, cookieless count, made in your browser, is described under "Statistics of visits" below.
Spam checks on public forms (RSVP, support requests): our own spam-check service, which runs on our servers, examines what you type and keeps an encrypted copy for 14 days. Only if it cannot load does the form fall back to hCaptcha, which then receives your IP address and browser details (legitimate interest).
A record that you were shown a notice: when you send an RSVP or upload a photo, we record that the short notice on that form was on screen, which version of its wording, the time, your device id or account, your IP address and your browser. It is how we can show that we told you. For account holders we record which version of our terms and this policy was in force when they signed in.
Your country, for prices: our network provider tells us which country a visit comes from, and the pricing page uses it to quote plans in your currency. We do not store it.

We do not sell personal data, use it for advertising, or build profiles. We do not make decisions about you by automated means alone. Three automatic steps hand something to a person: in moderation, a photo reported by three different people, or reported as illegal, is hidden until a person looks at it (see our Terms of Service); a photo our software flags as possibly explicit is withheld until a person looks at it (see “Automatic screening of uploaded images” below); and when you have withdrawn from or been refunded in full for two purchases within six months, your next purchase is sent to our support team, where a person decides. It never changes a refund.

Cookies and browser storage

We only use what the site needs to work: the __Host-token cookie that keeps you signed in, the __Host-oauth_state cookie that protects sign-in, a __Host-site_pin_ cookie that remembers a wedding's PIN once you have typed it, the wedding_currency cookie that remembers a currency you picked, the ow_lang cookie that remembers the language you chose, the wedding_device_id value in your browser storage, and a queue in your browser that holds photos until they finish uploading. Our network provider (Cloudflare) and, only as a fallback, hCaptcha set their own security cookies. There are no analytics or advertising cookies, which is why you are not asked to accept any: our visit statistics (below) use none, and the only thing they can leave on your device is a setting you choose to switch on yourself. The full list, item by item.

Statistics of visits

We count visits to the public pages of the site, to understand what is used and to improve the service. We do it with Umami, an open-source tool that runs on our own servers: nothing is sent to an analytics company, it sets no cookies and no tracking identifier in your browser, it follows nobody from site to site, and we share the statistics with no one. Each page view records:

the page's path, without anything after a “?” or “#” — and a wedding's own address is replaced by a placeholder, so the statistics never say which wedding;
the website you came from (its domain only);
your browser, operating system, device type, screen size and language;
your country, worked out from your IP address on our server. The IP address itself is not stored;
how quickly the page loaded and responded (timings such as the time to show the main content), as numbers only, to find slow pages.

We also record four actions by name, with nothing about you: sign-up started, wedding created, checkout started (a plan or a photo pack, no amount) and purchase completed.

It never runs on the sign-in, account and admin pages, in a couple's own wedding editor, or on a private wedding (one with a site PIN, or one the couple closed); the four action names are the only thing sent from the account area, with no page address. We keep the statistics for 12 months and then delete them automatically. The legal basis is our legitimate interest in understanding and improving the service (Art. 6(1)(f) GDPR). You can object at any time: switch on “Don't count my visits” on our cookie page, let your browser send Do Not Track or Global Privacy Control, or write to us.

Who can see your data

The couple and the people they add as site admins see their site's RSVPs, photos, quiz entries and reports (without who filed them: no name, email address, account, device id or IP address).
Guests of a wedding see what the couple publishes, approved photos in the gallery and the quiz leaderboard, and can play the music the couple added to the slideshow.
Us. The operator is the only person with administrator access to the platform, and that access reaches all data, including any wedding's guest data. We use it only to run, support and secure the service, when a couple asks us to help with their site, or when the law requires it.
Service providers, listed below, only for what they do for us.
Authorities, only where the law obliges us to hand data over.

Service providers and where your data is

Our servers are in the European Union: the main server in France and a second one in Germany, with backups in the Netherlands. Photos and videos are stored in a private bucket at Backblaze B2, in its EU region (Amsterdam, Netherlands): that is their primary store, not a backup, and the main server only holds working copies while an upload is checked and resized. Our spam check, malware scanning, logs and statistics run on our own servers. Slideshow music is kept in the same store: when a couple chooses or previews a track from Openverse, our server downloads it from the site that hosts it (such as Jamendo or Freesound), so that site sees our server, never the couple, their guests or the venue's screen. These outside organisations receive personal data:

Server4You — HEG US Inc., St. Louis, USA
Our main server: runs the website and the database, and checks and resizes uploads (malware scan) before they go to their store.
Data:
The service's data: accounts, wedding sites, RSVPs, support requests, the emails you send us, billing records and logs; photos and videos only as working copies while they are checked and resized.
Where:
Strasbourg, France (EU)
Transfer safeguard:
Stored in the EU (Strasbourg), on a server only we administer, under a GDPR processor agreement (Art. 28) signed on 28 September 2026. HEG US Inc. is a US company that is not certified under the EU-US Data Privacy Framework; the GoDaddy group company that runs its platform, GoDaddy Operating Company LLC, is certified. We have asked HEG US Inc. for the EU Standard Contractual Clauses.
ZAP-Hosting — ZAP-Hosting GmbH, Münster, Germany
Our second server: helps carry traffic to the site, keeps a live read-only copy of the database, and serves a read-only copy of the site while the main server is down.
Data:
A full copy of the database, requests passing through (including IP addresses), and short-lived copies of photos while the read-only copy is in use.
Where:
Germany (EU)
Backblaze B2 — Backblaze, Inc. (USA)
The primary store for photos and videos, and off-site backups.
Data:
Photos and videos uploaded to wedding sites (the store itself), and backups of the database and of our servers' data.
Where:
EU region (Amsterdam, Netherlands)
Transfer safeguard:
Stored in the EU. Backblaze is a US company, certified under the EU-US Data Privacy Framework.
Cloudflare — Cloudflare, Inc. (USA)
Sits in front of the site: DNS, the encrypted connection, protection against attacks and bots, and caching of pages and photos.
Data:
Every request to the site, including IP address, browser details and what is sent or uploaded; cached copies of photos.
Where:
Global network; Cloudflare is based in the USA
Transfer safeguard:
EU-US Data Privacy Framework (Cloudflare is certified) and Standard Contractual Clauses.
Brevo — Sendinblue SAS, Paris, France
Delivers the emails the service sends.
Data:
The recipient's email address and the content of the email — for example the RSVP summary sent to the couple (each guest's name, answer, party size, message and any dietary note), a receipt, or a reply to a support request.
Where:
France (EU)
hCaptcha — Intuition Machines, Inc. (USA)
Back-up spam check on public forms (RSVP, support requests), used only when our own spam check cannot load.
Data:
IP address, browser details and how the check was completed.
Where:
USA
Transfer safeguard:
EU-US Data Privacy Framework (certified) and Standard Contractual Clauses.
Stripe — Stripe Payments Europe, Limited (Ireland)
Takes payments for paid plans. You enter your card or payment details on Stripe's own page; we never see them.
Data:
The buyer's email, name and payment details, the plan and amount; Stripe also keeps what payment and anti-fraud law require.
Where:
Ireland (EU) and the USA
Transfer safeguard:
EU-US Data Privacy Framework (Stripe is certified) and Standard Contractual Clauses.
Facturalusa — Infolusa - Soluções Informáticas (Facturalusa, certified invoicing software no. 2652/AT), Portugal
Issues the certified invoices and credit notes for payments and refunds, communicates them to the Tax Authority, and e-mails them to the buyer.
Data:
The buyer's name, email address and country, their NIF if they gave one, and what was bought and for how much. The documents are kept as long as tax law requires (10 years).
Where:
Portugal (EU)
OpenStreetMap Foundation — OpenStreetMap Foundation (United Kingdom)
Map tiles on a wedding page that shows a map, and the address search couples use to place that map.
Data:
Your IP address and browser details, because your browser loads the map directly from them; the address typed into the search.
Where:
United Kingdom
Transfer safeguard:
EU adequacy decision for the United Kingdom.
Role:
Decides for itself how it uses this data, under its own privacy policy.
Openverse (WordPress.org)
The search behind the music a couple can choose for their venue slideshow.
Data:
The words a couple types into that search, sent by our server: not their name, account or IP address. Please don't type personal details there.
Where:
United States
Transfer safeguard:
No identifying data is sent: only search words, from our server, never linked to who typed them.
Role:
Decides for itself how it uses this data, under its own privacy policy.
Google, Facebook or Microsoft — The sign-in provider you choose
Sign-in. Only the provider you pick is involved, and it tells us who you are.
Data:
Your name, email address and profile picture, as the provider shares them; the provider also knows you signed in to us.
Where:
Depends on the provider (EU and/or USA)
Transfer safeguard:
Under the provider's own terms with you.
Role:
Decides for itself how it uses this data, under its own privacy policy.

Couples can find the processor terms, and how we tell them about a new provider, in our data processing agreement.

If you are outside the European Union

The service is run from Portugal and your data is stored in the EU, so the EU General Data Protection Regulation (GDPR) applies to it wherever you are, and everyone gets the rights described below. Some of the providers above process data in the United States; the safeguard for each is listed with it.

In the Philippines, you are also protected by the Data Privacy Act of 2012 (Republic Act No. 10173). When you use the service, your personal data is sent to and stored in the EU, and handled by the providers above; we remain responsible for it wherever it is processed, and protect it as this policy describes. Our Data Protection Officer for the purposes of the Act is Ruben Cipriano, reachable at [email protected]. Your rights under the Act — to be informed, to access your data, to object, to have it corrected, to have it erased or blocked, to receive a copy you can take elsewhere, and to be compensated for damage — can be exercised by writing to that address. You can also complain to the National Privacy Commission.

How long we keep it

Accounts: until you delete yours. Signed-in sessions end 7 days after your last visit.
Wedding sites, RSVPs, photos, quiz entries and in-app notifications: until the couple deletes them, deletes the wedding, or deletes their account, except photos and videos on the free plan (next item). When a paid plan ends, the site stops being published, but nothing is deleted automatically: the couple can still export it or delete it.
Photos and videos uploaded to a wedding on the free plan: deleted 7 days after its upload window closes. That window closes 48 hours after the start of the wedding day, at the end of the day after the wedding (UTC), however early it opened. The couple gets reminder emails 3 days and 1 day before, with a link to download everything. The site, its pages and its RSVPs stay.
Slideshow music: until the couple replaces or removes it, deletes the wedding, or deletes their account, and then until the backups age out (below). A track played as a preview in the music search is kept on our server for up to 15 minutes.
The IP address on an RSVP: 30 days.
Server logs and visitor statistics: 14 days.
Statistics of visits (the cookieless count): 12 months.
Security log (including IP addresses and browsers): 180 days.
The record of what happens in your account and the errors you run into: 180 days; deleted with your account, and included in the copy of your data you can download.
Spam-check copies of form contents: 14 days.
Records of emails we sent: 90 days after delivery. The record of an email that could not be delivered has no automatic deletion date yet.
Support requests: once a request is closed, one year (365 days) after its last message; sooner if you delete your account. A reply re-opens it and restarts the clock.
Emails you send us at [email protected], kept on our own mail server: about support or anything else, 1 year after the last message of the conversation; privacy, data-protection and other legal requests, 5 years, as evidence of how we handled them.
Reports about content: kept with the moderation record. There is currently no automatic deletion date for them.
Notice and acceptance records: the IP address and browser on them are removed after 180 days. A guest's record is deleted with the wedding; an account holder's acceptance record is deleted after 5 years. These records outlive your account on purpose — without them we could not show that past processing was lawful — but on erasure they are stripped of everything that identifies you.
Invoices and payment records: 10 years, as Portuguese tax law requires. If you delete your account they are kept, but detached from you.
The card fingerprint on a payment: 180 days after the payment. A note that a person was asked to look at the payment stays with the payment record, without the fingerprint.
Deleted or replaced photos and videos: they disappear from the site at once, and we ask Cloudflare to drop its cached copies straight away. The copy in storage is held for 30 days by a retention lock, which protects against accidental or malicious deletion, and is erased when the lock expires, so erasure is complete within 30 days.
Backups: database backups for up to about 21 days (we keep 14 days of changes, plus the weekly full copy they build on); whole-server snapshots, which include working copies of uploaded files, for up to 12 months (daily for a week, weekly for five weeks, then monthly). Something you delete disappears from backups as they age out; we do not restore it except to recover from a failure.

How we protect it

All traffic is encrypted (HTTPS). Sign-in goes through Google, Facebook or Microsoft, so there are no passwords for us to lose. Couples and their site admins can only reach their own weddings. Uploads are scanned for malware and have their location data removed. Public forms are rate-limited and spam-checked. Administrative actions are logged. Server snapshots are encrypted before they leave our servers; database backups are sent over an encrypted connection to a private store but are not yet encrypted by us before upload. Photos and videos are sent to their store over an encrypted connection; we do not encrypt them ourselves before upload. We test restoring the database from its backups every month.

Your rights

You can ask for access to your data or a copy of it, have it corrected or deleted, restrict how we use it, object to what we do on the basis of legitimate interests, and receive it in a portable format. We answer within one month, and usually much sooner.

If you have an account, you can do most of this yourself from your account. The download includes your account, the content of the weddings you own, the RSVPs you sent while signed in, your photo and quiz records, your notice and acceptance history, your support requests, the reports you filed while signed in, your billing records and the security log of your own actions. Photo and video FILES are not in it; couples download those as a separate archive for each wedding, from plans and billing or from the Photos tab of the wedding's admin. Deleting your account deletes the weddings you own and everything in them, the photos you uploaded anywhere, your quiz entries, your RSVPs sent while signed in and your support requests; billing records and the security and acceptance records described above are kept without your identity, and so are the reports you filed, as the record of how the reported content was handled — without your account, device id, IP address, contact details or the words you wrote.

If you replied or uploaded without an account, ask the couple, or write to [email protected] and we will act on it or pass it to the couple, whichever the request needs. To have a photo of you taken down, you can also use the report button on the photo.

You have the right to complain to a data-protection authority — in Portugal that is the Comissão Nacional de Proteção de Dados (CNPD), and you may equally complain to the authority where you live or work (Article 77 GDPR), or, in the Philippines, to the National Privacy Commission.

Uploading photos of others

Please only upload photos and videos you have the right to share. They are visible to the wedding's guests. If an image includes you and you want it removed, ask the couple, report it, or write to [email protected].

You must be at least 16 to create an account, and we do not knowingly keep an account holder's data from anyone younger: if we learn we do, we delete it. Photos and videos that show children are the responsibility of the person who uploads them and of the couple whose site shows them: upload them only if you have the right to, including the agreement of a parent or guardian. The couple can hide or delete any photo on their site at any time.

Automatic screening of uploaded images

To keep the service safe, we automatically analyse the images that people upload to a wedding site, and sampled frames of uploaded videos, for explicit content. The analysis is done by software that runs on our own servers in the European Union: no image, frame or result is sent to any other organisation, and no outside provider is involved.

Why, and on what basis: to keep the service safe and to enforce our Terms of Service by preventing the publication of explicit or unlawful content. The legal basis is our legitimate interest in doing so (Art. 6(1)(f) GDPR). You can object at any time by writing to [email protected].

What is kept: a score (a number between 0 and 1) and the outcome (clear, held for review, or blocked), stored with the file's record and deleted with it. It is not used to profile anyone, and it does not identify the people shown in an image.

A person decides: nothing is decided by the software alone with no way back. An image it flags is withheld, so guests do not see it, until a person has looked: the couple whose site it was uploaded to, or us as the operator of the platform. They can restore it or delete it. The person who uploaded it is told that it cannot be published, and can write to [email protected] to contest that; a person will look again.

Changes to this policy

When we change this policy we update the date at the top. If a change affects how we use data you have already given us, we will tell account holders by email before it takes effect.

← Back home·Terms of Service·Cookies