Privacy policy

1. Data controllers

Nozzy is run by its founders. For any question about personal data you can write to info@nozzy.it.

2. What data we process

• Account data: email address and sign-in data.
• The content of the website you create: the couple's names, date, venue, texts, photos.
• Guest data you enter or guests provide: name, email or phone number, RSVP, plus-ones, notes and any food intolerances or allergies.
• Payment data: handled directly by Stripe; we do not store card details.
• Essential technical data: session cookies and language preference.
• Anonymous or pseudonymous usage data (pages visited, device, interactions), collected with PostHog only with your consent.

3. Purposes and legal bases

• Providing the service (creating, publishing and managing the website): performance of the contract.
• Handling payments and related obligations: contractual and legal obligation.
• Security, abuse prevention and technical operation: legitimate interest.
• Processing intolerances and allergies (health data, art. 9 GDPR): explicit consent of the person concerned, given when replying to the invitation.
• Measuring and analysing how the website is used (PostHog): consent, given through the cookie banner.

4. Roles: who controls guests' data

For guests' data, the couple who create the website are the data controllers; Nozzy acts as data processor, handling that data only to provide the service and following the couple's instructions.

5. Sub-processors

We use providers that process data on our behalf:

• Supabase — hosting, database and authentication.
• Vercel and Render — application hosting.
• Stripe — payment processing.
• Google (Gemini) — assisted writing of the website texts.
• PostHog — usage analytics (only with consent).

6. Transfers outside the EU

Some providers may process data outside the European Union. In that case the transfer relies on appropriate safeguards (e.g. the European Commission's Standard Contractual Clauses).

7. Retention

We keep data while the account and the website are active. Deleting the wedding from the dashboard erases the related data (website, guests, tables, registry, photos). Some data may be kept longer where the law requires it.

8. Your rights

You have the right to access, rectify, erase, restrict, object to and port your data. You can exercise them by writing to info@nozzy.it. You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

9. Changes

We may update this policy. The date at the top shows the latest revision.