Privacy Notice

Effective from 2 November 2026, until withdrawn. This notice is made under Article 13 of the General Data Protection Regulation ((EU) 2016/679, GDPR) and the Hungarian Privacy Act (Act CXII of 2011).

1. The controller

Virágszekér Kft. (operator of Envelopio), registered office: 2700 Cegléd, Külső-Jászberényi út 2., Hungary, company registration number 13-09-178324, tax number 25434934-2-13, EU VAT number HU25434934
E-mail: [email protected]
We are not required to appoint a data protection officer (Article 37 GDPR), so we have none. For any privacy question, write to us at the contacts above.
We are established in Hungary only. We do not have a representative in other countries.

2. Two roles

Whose data?	Who is the controller?	Our role
The couple who use the Editor, open an account and buy; visitors of the website; subscribers to our newsletter; people who write to us	we are	controller (sections 3 to 9)
The guests of the invitations, and the names that the couple enters in the seating plan	the couple	processor (section 10, Annex 1 of the Terms)

3. Editor and watermarked preview

Without logging in, the content of the invitation (names, date, venue, programme, text, photos) is stored only in your browser; it does not reach us.
When logged in, we save the draft and the photos to your account so that you can continue on another device.
Purpose and legal basis: making the invitation; a step before the contract at your request (Article 6(1)(b) GDPR).
Retention: an unpaid draft stays in the account until you delete it or the account. Photos removed from the invitation are deleted automatically after one day.

4. Account

Data: name, e-mail address, the password in a non-reversible (hashed) form, the fact that the e-mail address has been confirmed, the identifier of the login session, favourites, whether you asked for the newsletter, and, if you upload one, your profile picture (visible only to you in the account and the header; the old one is deleted when you replace or remove it). Also: the language and country you use the website in.
Purpose and legal basis: running the account, managing invitations and guest replies (Article 6(1)(b)).
Retention: until the account is deleted. You can delete the account at any time on the “My account” page with one click; the invitations, guest replies, planner data, reviews and photos are then deleted too. If you had a paid order, we keep the accounting data (section 5) after the account is deleted, but we remove the name and e-mail address linked to the account.

5. Order, payment, invoicing

Data: name, e-mail, billing name and address, billing country, the items ordered and their amount and currency, the discount code, the Stripe transaction identifier, and the time of the order (of the acceptance of the Terms). We do not see card data.
Data to determine and prove VAT: when you order, we record your billing country, the country of your payment card and the country of your internet connection (derived from the IP address). We use them to show which VAT treatment applies to the order and to prove it to the tax authority.
Purpose and legal basis:
- performing the contract and keeping in touch: Article 6(1)(b);
- issuing and keeping the invoice, and the VAT records, including the evidence of the customer’s country: Article 6(1)(c), under the Hungarian accounting and tax law, for 8 years, and for at most 10 years where the EU VAT rules require it (for example for sales declared under the One Stop Shop scheme);
- proving the withdrawal statement and defending legal claims: Article 6(1)(f), until the end of the limitation period, in general 5 years.
Recipients:
- Stripe Payments Europe, Ltd. (Ireland), payment service provider. Because of fraud prevention and payment rules, Stripe also processes data as an independent controller for its own purposes. When you use Apple Pay or Google Pay, the notice of Apple or Google also applies.
- KBOSS.hu Kft. (Számlázz.hu, 1031 Budapest, Záhony utca 7., Hungary): issuing the invoice and reporting to the Hungarian tax authority as required; processor.
- The Hungarian tax authority (NAV; legal obligation, including the One Stop Shop returns), and the accountant of Virágszekér Kft. for the accounting obligations.

6. E-mails

6.1 System e-mails

Confirming the account, forgotten password, confirming the purchase and notifying you of a new guest reply are part of the service (Article 6(1)(b)). You cannot unsubscribe from them while the account exists. They are sent in the language of the website version you used.

6.2 Follow-up e-mails after an order

What they are: after the invitation is paid, a few short e-mails at key points of the planning (for example tips for sending, before and after the reply deadline, two weeks before the wedding, congratulations, a request for a review). The timing is calculated from the wedding date and the data of the invitation; from guest replies we use only the number of replies and of guests.
Legal basis: information related to the service you ordered (Article 6(1)(b)), and our legitimate interest (Article 6(1)(f)) in helping you get the most out of what you bought and asking for reviews.
Objection and unsubscribe: at the bottom of every follow-up e-mail with one click, and in the account. Service notices (for example that guest replies will be deleted soon) are sent regardless.
Retention: we record which e-mail was sent until the account is deleted, so that no e-mail is sent twice.

If you tick “Send me a letter now and then about new invitations” in the account, we send such letters on the basis of your consent (Article 6(1)(a), and Article 13 of Directive 2002/58/EC as implemented in the law of your country) until you withdraw it. We record the time and the text of the consent. You can untick it at any time, and you can unsubscribe in every such letter with one click.

Data: the name linked to the account (for the greeting) and the e-mail address. We write only to confirmed addresses.
Retention: we record which newsletter went to whom, and whether someone unsubscribed with the link in the letter, until the account is deleted, so that no letter goes twice. The time of the unsubscription is recorded with the consent.
We may use outside helpers to write the text of the letters; we do not give them names or e-mail addresses, and the list stays in our own system.

7. Reviews

Data: star rating, a “how likely are you to recommend” score, free text, and, if you separately allow it, the name to show (for example “Anna and Peter”), and with a separate tick your profile picture next to the review. We always show the profile picture currently set in the account; if you remove it, the review shows without a picture.
Purpose and legal basis: improving the service (Article 6(1)(f)). We show the review on the website only with your separate, express consent (Article 6(1)(a)), which you can withdraw at any time by writing to [email protected].
Retention: until the account is deleted; the display until you withdraw consent.
Authenticity of reviews: we publish reviews only from customers who placed their order with their account, and we do not pay for reviews. We do not filter the publication in favour of positive reviews.

8. Wedding planner, seating plan, budget

Data: the to-do list, the wedding date, the seating plan (tables, guest names, notes) and the budget items. Without logging in, the free planner is stored only in the browser.
Legal basis: Article 6(1)(b). Retention: until the account is deleted or you delete the data.
For the guest names and notes entered in the seating plan (for example meal needs), you are the controller and we store them as processor (section 10).

9. Cookies, measurement; correspondence

Cookies and measurement: described in detail in the Cookie notice. In short: the necessary cookies do not need consent; Google Analytics 4 and Microsoft Clarity (anonymous visit recordings and heat maps, without typed text) run only with the “Statistics” consent. The Meta Pixel (measuring our Facebook and Instagram ads) runs only with a separate “Marketing” consent (Article 6(1)(a)); for it we and Meta are joint controllers. We do not use a TikTok pixel. We send no events from our server to Meta (no Conversions API). On the invitation pages (the guests’ pages) there is no measurement at all.
If you write or phone us: we process the data in your message to answer you (Article 6(1)(b) or (f)). Messages sent to our contact address arrive through Cloudflare Email Routing in a Gmail mailbox (Google Ireland Ltd., see section 11). If the message is not related to an order, we keep it for 1 year after we close it; if it is, together with the order (section 5).

10. Guest data - we are the processor

The controller is the couple. A guest can exercise their rights mainly with the couple. If a guest contacts us, we forward the request and fulfil it on the couple’s instruction.
Data: the name the guest gives, attendance, and the answers to the questions the couple asked (for example number of guests, menu, message, song request).
Food allergies and special diets (health data, Article 9 GDPR): we store them only if the guest expressly consents with the checkbox under the field (Article 9(2)(a)); we record the fact of the consent with the reply. A guest can withdraw consent with the couple or with us at any time; the data is then deleted. The wording of the consent is in the annex below.
Retention: 90 days after the wedding, then automatic and permanent deletion (the invitation itself stays available for 12 months after the wedding, without replies). The couple can delete the invitation or the account earlier; the replies are then deleted at once.
Security: encrypted connection, links that cannot be guessed, optional access code, noindex, and only the couple sees the replies. There is no tracking cookie on the invitation page.
Gift list with reservation (if the couple switches it on): a guest can mark that they will bring an item; we then store the item, the name the guest may give, and a random identifier of the reserving device (bk_aj_eszkoz cookie, without IP address), so that the guest can cancel from the same device. Other guests see only that the item is reserved; only the couple sees the name. Retention: 90 days after the wedding, together with the replies.
Shared photo album (if the couple bought it): the photos and videos uploaded by guests, the name the uploader may give, and a random identifier of the uploader’s device (bk_album_eszkoz cookie, without IP address); a hash of the IP address for at most 2 days to filter out too many uploads. Location data is removed from photos resized in the browser; the metadata of original HEIC photos and videos (including location) remains. The couple is the controller here too: the couple decides whether guests see each other’s pictures and can delete any file. We delete the files automatically and permanently 60 days after the wedding, and the names given by uploaders at the latest on day 90; before that the couple can download them in one go. Storage: Cloudflare R2, in a separate, non-public store; the files can be reached only on the secret link and according to the couple’s visibility setting. There is no measuring or tracking cookie on the album page.

11. Processors and recipients

Provider	Task	Place	Role / safeguard
Stripe Payments Europe, Ltd. (Dublin, Ireland)	online payment (the methods offered on the payment page: card, Apple Pay, Google Pay, and for Poland BLIK and Przelewy24)	EU, and the USA through Stripe, Inc.	processor and independent controller; transfer to the USA under the DPF / SCCs
KBOSS.hu Kft. (Számlázz.hu, 1031 Budapest, Záhony utca 7.)	issuing the invoice, reporting to the tax authority	Hungary	processor
Cloudflare, Inc.	serving the website, the Editor and the invitations	USA / global CDN	processor, DPF / SCCs
Cloudflare, Inc. (D1 database, R2 storage)	account, editor, guest reply and planner data, photos	Western Europe (database)	processor, DPF / SCCs
Cloudflare, Inc. (Email Routing)	forwarding the mail sent to the contact address	USA / global CDN	processor, DPF / SCCs
Google Ireland Ltd. (Gmail)	mailbox that receives the messages sent to the contact address (they arrive through Cloudflare Email Routing)	EU / USA	processor, DPF / SCCs
Resend (Plus Five Five, Inc.)	system and follow-up e-mails, newsletter	EU sending region, US company	processor, SCCs
Google Ireland Ltd. (Google Analytics 4)	measuring visits, only with consent	EU / USA	processor, DPF / SCCs; see the Cookie notice
Microsoft Ireland Operations Ltd. / Microsoft Corporation (Clarity)	visit recording and heat map, only with consent, masked	EU / USA	processor, DPF / SCCs; see the Cookie notice
Meta Platforms Ireland Ltd. (Pixel)	ad measurement, only with Marketing consent	EU / USA	joint controller for collecting and passing on Pixel data; DPF
Anthropic, PBC (Claude, Claude Code)	AI-based assistant for operations and development (see below)	USA	processor, SCCs (business/API terms; does not train on the data)
X.AI LLC (Grok)	AI-based assistant for operations (see below)	USA	processor, SCCs (business/API terms; does not train on the data)
the accountant of Virágszekér Kft.	accounting, tax returns	Hungary	for the accounting obligations

We transfer data to a third country (the USA) under Article 45 GDPR (EU-US Data Privacy Framework) or Article 46 (standard contractual clauses).

AI-based assistants (AI agents). In operating and developing the site and in daily tasks (for example summarising orders and visits, managing ads and social content, drafting newsletters, troubleshooting, preparing answers to customer questions), agents built on the models of the AI providers above help us, under the direction and supervision of the managing director. Each has access only to the data its task needs, with its own access that can be revoked at any time (no shared passwords). Steps that affect the outside world (publishing, starting an ad, sending a newsletter, a refund) are approved by a person. The providers process the data only to fulfil the request and do not train their models on it (under their business and API terms). The agents do not make automated decisions about you.

12. Security

encrypted (HTTPS) connection everywhere;
passwords are stored only in a non-reversible form;
the accounts of the service providers (hosting, payment, invoicing, mail, analytics) are protected by strong passwords and two-step verification;
only the managing director, a person named by them who is bound to confidentiality, and the AI agents they supervise (section 11) have access to the data, each with their own revocable access and only as far as the task needs; we keep a register of the access;
notifications from Stripe are accepted only after the signature is checked;
automatic deletion when retention periods end; the restore points of the database disappear by themselves after 30 days;
an incident register. We report a risky personal data breach to the Hungarian authority (NAIH) within 72 hours and, if the risk is high, we also inform the data subjects.

13. Your rights

Access, correction, erasure, restriction, data portability, objection, and withdrawal of consent at any time (Articles 15 to 21 and 7(3) GDPR). In the “My account” page you can download guest replies yourself and delete the account. We answer any other request (for example correction of a name or e-mail address, a copy of your data) within 1 month. We make no automated decisions and do no profiling. Meta may use Pixel data on the basis of the Marketing consent for its own advertising purposes (for example ad targeting); you can stop this at any time by withdrawing the consent.

14. Complaints and remedies

Lead authority (where we are established): Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9-11.; postal address: 1363 Budapest, Pf. 9.; [email protected]; +36 (1) 391-1400; https://naih.hu.
You can also complain to the supervisory authority of the EU country where you live, where you work or where the infringement took place (Article 77 GDPR). The contact details of all supervisory authorities are on the website of the European Data Protection Board: https://www.edpb.europa.eu/about-edpb/our-members_en.
You can also go to court, including the court of your place of residence (Article 79 GDPR; Hungarian Privacy Act, section 23).

15. Changes

We tell you about a material change of this notice on the website and by e-mail.

The consent is the guest’s own declaration, so it is written in the first person. The checkbox is empty by default and appears only when the guest ticks a food-allergy category. There is no free-text field; the categories are: gluten-free, lactose-free, nut-free or peanut-free, egg-free, does not eat fish or seafood, other food allergy (“the couple will discuss it in person”). The venue receives only an anonymous total.

One guest

☐ I expressly consent that {couple_names} (the senders of the invitation, the controllers) process the food allergy I ticked, which is health data, solely to organise the meal at the wedding. The venue receives only an anonymous total. The data is stored on their behalf by the provider of the invitation and deleted by {deletion_date}. I can withdraw my consent at any time: until {deadline} on this link by removing the tick, and after that at {couple_contact}. Withdrawal does not make the earlier processing unlawful. Privacy notice

Several guests, each for themselves (all adults)

☐ We expressly consent that {couple_names} (the senders of the invitation, the controllers) process the food allergy we ticked, which is health data, solely to organise the meal at the wedding. (The rest of the text is the same, in the plural.) Each named member of the household gets a separate checkbox with this text; there is no single shared tick.

On behalf of a minor child (parent or legal representative)

☐ As a parent or legal representative, I expressly consent that {couple_names} process the food allergy of my child, {member_name}, which I ticked and which is health data, solely to organise the meal at the wedding. (The deletion and withdrawal text is the same as above.)

For an adult household member, the form does not allow a declaration on their behalf. If the member does not tick it himself or herself, the card shows: “Food allergies can only be given by the person concerned, or discuss it directly with the couple.”

Short notice at the bottom of the reply form

“Your reply goes to {couple_names} for organising the wedding. Giving a food allergy is voluntary, and it is sent only with your consent. The venue receives only a total. We delete the data after the wedding, at the latest by {deletion_date}. The invitation is run by Envelopio (Virágszekér Kft.) on behalf of the couple. Details: Privacy notice.”