(Only a summary — the sections below govern.)
[Your full name or company name]
[Street address, postal code, city, Germany]
Email: inev-bit@mailbox.org
If you have appointed a Data Protection Officer, name them here: [DPO name/contact, or "not applicable"].
Please don't enter sensitive or private information into any free-text field. Avoid storing:
Most of the categories above are what GDPR Art. 9 calls "special category" data (health, religious or political beliefs, biometric or genetic data, sexual orientation) — we do not request, require, or want this data, and if it ends up in a free-text field anyway, we don't process, analyze, or use it for any purpose of our own; it simply sits there, encrypted at rest (§4), until you edit or delete it. More broadly, we apply data minimisation across the whole app: we only ask for the fields a feature actually needs to function, we don't request anything "just in case," and free-text fields exist because a wedding planner needs somewhere to write notes — not because we want that content. Like every other free-text field, our own staff only ever access the decrypted content of your wedding (guests, expenses, notes, messages) when strictly necessary to provide technical support you've asked for (e.g. troubleshooting a bug report) — never routinely, and never for any other purpose. To run the service, our administrator tools do list accounts with their e-mail address, display name, wedding name and the account-level usage data described in §3 (e.g. to answer support requests, stop abuse and carry out deletion requests). By using a free-text field, you're responsible for making sure you haven't put prohibited or sensitive information into it.
In short: most of what we collect rests on performing our contract with you (Art. 6(1)(b)) — you use MerrilyApp to organize your wedding, so we need to store your guest list, seating, expenses, and similar content to do that. A smaller set of aggregate, non-identifying signals (e.g. device type, active-day counts) rests on our legitimate interest in understanding and improving the app (Art. 6(1)(f)). Anything optional (language, self-declared country, marketing consent) rests on your consent (Art. 6(1)(a)), which you can withdraw at any time. The table below states the specific basis for each item.
| What | Why / legal basis |
|---|---|
| Email, hashed password, display name | Create and secure your account (Art. 6(1)(b)) |
| Date of birth (encrypted at rest, see §4) | Confirm you are at least 18, as our Terms require (Art. 6(1)(b), (c)). Not used for anything else; deleted with your account |
| When you accepted the Terms of Service, acknowledged this Privacy Policy, and which version | Prove the contract and keep a record if these texts change (Art. 6(1)(b), (f)) |
| Self-declared country | Aggregate usage statistics (Art. 6(1)(a)) |
| Language preference | Show the app in your language |
| Device type, the dates you were active, and how many minutes you used the app on each of those days (counted while the app is open in a browser tab you are using; the web app tells our server about once a minute) | Usage statistics to improve the app (e.g. how many people return versus visit once, how many use it at least 30 minutes a week). Stored per account and visible to our administrators; the days and minutes are deleted after 12 months, only anonymous totals are kept. Never sold or used for advertising (Art. 6(1)(f)) |
| Guest data (encrypted at rest, see §4) | Let you manage your guest list (Art. 6(1)(b), processor) |
| Expense entries and notes | Track your wedding budget (processor) |
| Helper contact info | Track who is helping you (processor) |
| Wedding name/date/location/budget | Power the dashboard (processor) |
| Invite links | Invite collaborators (processor) |
| IP address and time of security-relevant actions (sign-in attempts, two-factor checks, registrations, password resets, invite-link use, administrator actions) | Protect accounts and detect attacks, e.g. repeated failed sign-ins. Kept for up to 12 months (the oldest entries go earlier if the log reaches its size limit); attempt counters used for rate-limiting are deleted after 48 hours; an IP address that guessed wrong invite links several times is blocked from invite links for up to 24 hours and that block is kept with the security log; browser security reports (CSP) after 30 days. For a failed sign-in with an unknown address, only a shortened form of what was typed is kept (Art. 6(1)(f)) |
| Server access logs | Security and debugging (Art. 6(1)(f)) |
| Browser local storage: a short-lived login token (15 minutes) | Keep you signed in (Art. 6(1)(b)) |
Sign-in sessions: browser or device type, IP address, when you signed in and last used the app, and a sign-in cookie (wg_refresh, 30 days, readable only by our server) that renews your login | Keep you signed in safely, show you your signed-in devices and let you sign out of any of them (Settings → Signed-in devices). Deleted 30 days after the sign-in ends (Art. 6(1)(b), (f)) |
Known devices: a random browser id in a cookie (wg_device, about 13 months) or the mobile app's device type | E-mail you when someone signs in to your account from a device you haven't used before. Forgotten after 12 months without a sign-in (Art. 6(1)(f)) |
| Marketing consent (opt-in) | Send you occasional product updates, only if you opt in; you can withdraw (or give) consent at any time under Settings → Profile (Art. 6(1)(a)) |
| Support messages you send us (encrypted at rest, see §4) | Respond to your question, problem, or feedback (Art. 6(1)(b)) |
| Referral code, and which user referred you (if any) | Give the person who invited you free days of Luxe once you have kept a Premium, Luxe or Planner subscription for a set period (currently 30 days each) (Art. 6(1)(a)) |
| Emails you send to a marketplace vendor (your name, email, message and, if you give one, phone number) (encrypted at rest, see §4) | Sent directly to that vendor by email, with your registered email address as the reply address, so they can answer you (Art. 6(1)(b)) |
| Ratings and reviews you leave on a marketplace vendor (encrypted at rest, see §4) | Shown to every user of the app, alongside your display name, to help other couples choose a vendor — not limited to your own wedding's collaborators (Art. 6(1)(a)) |
| Email verification status | Confirm you control the email address you registered with, e.g. for account recovery (Art. 6(1)(f)) |
| Password-reset tokens | Let you reset a forgotten password; expire automatically after 60 minutes and are single-use (Art. 6(1)(b)) |
| Mobile push notification device token | Only if you use our mobile app and enable notifications: lets us alert you when a collaborator changes your wedding, your support ticket status changes, or as a reminder about your own wedding-planning progress (e.g. an unconfirmed guest list, pending RSVPs, or an upcoming wedding date); removed when you sign out (Art. 6(1)(a)) |
| Google account ID, email, and name | Only if you choose "Sign in with Google" instead of a password: lets Google confirm your identity to us so we can create or log you into your account; we never see or store your Google password (Art. 6(1)(b)) |
| Your plan (trial, Standard, Premium, Luxe, Planner), its end date, and your purchase history: plan, period, amount, payment provider, transaction ID, and any withdrawal; the invoices we send you for paid plans (invoice number, your name and e-mail as printed on them, amount) | Provide the plan you bought, remind you before it ends, handle withdrawals and refunds, and keep the records accounting law requires (kept for 8 years, also after you delete your account — see §6). We never see, receive, or store your card number or PayPal password — those are entered directly with Stripe or PayPal, and we only receive a payment confirmation and a transaction ID back (Art. 6(1)(b), (c)) |
We use only two cookies, both strictly necessary for signing in (no consent needed, §25(2) TDDDG):
wg_refresh renews your login and wg_device recognises your browser for new-device warnings. Neither is
used for tracking or advertising. The short login token, your active wedding and the language, theme and column choices you make
yourself live in local storage, only once you pick them, because the app needs them to show what you asked for
(§25(2) TDDDG). The "Sign in with Google" button is loaded from Google only after you allow it in the
cookie banner or under "Cookie preferences"; you can withdraw that at any time there.
Anonymous usage statistics. To improve the app and its plans we count how it is used — which tabs are opened, how often a plan limit is reached, how many people open Your plan, start a checkout and pay, how often our own upgrade banners are shown and clicked, and how many newsletter links are clicked or used to unsubscribe. These are stored only as daily totals, without your account, IP address or any device identifier. With your account we keep a few markers that feed those totals: the campaign link you signed up from (e.g. "utm:instagram/cpc/spring"), your app language, the last tab you opened, when you last reached a plan limit or saw a banner, and when your wedding got its first guest, seated guest and expense. They are deleted with your account, appear in your data export, and our statistics show only totals (e.g. how many sign-ups per country or language), never a list of people. No cookies, tracking pixels or third-party analytics are used for this (Art. 6(1)(f) GDPR — our legitimate interest in improving the service; you can object at any time, see §8).
Providing email, password, and accepting the Privacy Policy/Terms is required to create an account. Everything else is optional or collected only when you use the relevant feature. We do not use automated decision-making or profiling.
Passwords are stored only as bcrypt hashes. Every free-text field is encrypted at rest using a
dedicated server-held encryption key (DATA_ENCRYPTION_KEY), separate from password
hashing and separate from disk-level encryption. Fixed-choice fields (e.g., expense-paid toggle)
are not encrypted. Invite links are single-use, expire after 7 days, are stored only as a
one-way hash, and are rate-limited. Password-reset and e-mail-verification links are stored
only as a one-way hash too. All
traffic is encrypted via HTTPS. No security measure is perfect; we work continuously to keep
protections proportionate.
Users may export their own guest data to PDF. Exports are generated on demand — the export only happens when you click the button, never automatically or in advance — and contain only data from your own wedding. Each export is built in memory on our server and streamed straight back to your browser over HTTPS; it is never written to disk or stored anywhere on our servers, and never sent to any third party. You choose a password when exporting, which locks the PDF itself using standard AES-256 PDF encryption — anyone you don't share that password with cannot open the file, even if it later ends up somewhere you didn't intend.
We share data only with service providers who help us run the Service, acting as our processors under data-processing agreements, or — where you initiate it yourself — with an independent third party you're dealing with directly:
We do not sell or rent your data, and we do not currently use third-party advertising or analytics. Our optional referral program (see §3) only shares information between accounts you both already control on this Service — it doesn't involve an external third party.
If we introduce third-party advertising (beyond our own notices described in the summary at the top):
We keep each kind of data only as long as we need it for the purpose in §3, or as long as a law requires us to:
| Data | Kept for | How it ends |
|---|---|---|
| Account and weddings | Until you delete them | Deleted with your account or the wedding. Deleting your account deletes every wedding you own; weddings you only joined stay with their owner |
| Active days and active time | 12 months | Deleted automatically |
| Security log (IP address, time, type of action), IP blocks | 12 months | Deleted automatically; earlier if the log reaches its size limit. Rate-limit counters after 48 hours, browser security reports (CSP) after 30 days |
| Support messages | 3 years | Deleted automatically 3 years after your ticket was resolved (contract claims expire after 3 years, §195 BGB) |
| Record of a copy of your data we sent you | 3 years | Proof that we answered your request. The PDF password is deleted after 30 days; after you delete your account the record keeps no e-mail address |
| Payments (invoices, bank transfers, payment-provider receipts) | 8 years | Required by German tax and commercial law (§147 AO, §257 HGB). After you delete your account they are kept in a locked accounting record with your e-mail address and name, used for nothing else, and then deleted |
| Backups | 90 days | 7 days on our server, 90 days in our off-site backup (Google Cloud, EU) |
| Sign-in sessions and known devices | 30 days / 12 months | A session is deleted 30 days after it ended (signed out, expired after 30 days, or renewed); a known device after 12 months without a sign-in |
| Outgoing e-mail log (type and outcome only, no address) | 90 days | Deleted automatically |
| Anonymous statistics | Forever | Totals, and one anonymous row per deleted account (months instead of dates, an age band instead of your birth date, no name, e-mail address or account ID). This is no longer personal data |
Deleting your account (or a wedding) also removes the IP addresses from your security-log entries, and removes your name from "added by" notes in other couples' weddings. Collaborators deleting their accounts do not delete shared weddings.
Our own infrastructure — the application server and database — runs on Google Cloud Platform in the EU, and your data is stored only there; we don't maintain backup servers in any other region. Some of the processors listed in §5 (e.g. SMTP2GO, Firebase Cloud Messaging, Stripe, PayPal, and Google) may process or transfer data outside the EU/EEA as part of their own global infrastructure; where they do, they rely on their own appropriate safeguards (e.g. EU Standard Contractual Clauses or an adequacy decision).
Under GDPR, you have the right to:
Contact us at inev-bit@mailbox.org (or through Contact support in the app) to exercise these rights. We answer within one month, free of charge, after confirming the request comes from your account's e-mail address. For access or portability we send you a copy of all your data as one password-protected PDF: your data as readable tables together with how we handle it (purposes, recipients, how long we keep it, your rights), and the same data in a machine-readable JSON format, printed and attached inside the PDF. The password reaches you separately.
MerrilyApp is deployed worldwide, including to users in the United States. If you're a resident of California, you have rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA); residents of a growing number of other US states (e.g. Virginia, Colorado, Connecticut, Utah, and others with comprehensive privacy laws) have broadly similar rights under their own state's law. In every case, these are in addition to — not instead of — the GDPR rights in §8, and we handle a request under either framework the same way, through the same contact channel.
To exercise any US state privacy right, contact us at inev-bit@mailbox.org — the same address used for GDPR requests in §8. We may need to verify your identity before acting on a request, proportionate to the sensitivity of the data involved.
The Service is not directed at anyone under 16, and we do not knowingly collect data from children under that age.
We'll update this page whenever what we collect or how we process it changes. Material changes will be highlighted to registered users before they take effect.
Questions about this policy or your data: inev-bit@mailbox.org