Privacy Policy

1. Who is responsible

• For your account and your own details: SayJa (see the Terms), contact ryan@sayja.se. We are the "controller", which means we decide why and how that data is used.
• For your guests' details: you (the couple) are the controller and SayJa is your processor. Section 4 explains.

2. What data we hold

Dietary and access needs are extra sensitive. Things like halal, kosher, coeliac or wheelchair access can reveal religion or health, which the law calls "special category" data. So we store only what the caterer needs, guests agree to it when they answer, it is used only for catering and access planning, and only people who need it can see it. We never use it in analytics.

Children: we store the minimum, a name or slot and a kids' meal flag. Children have no accounts, and photos of children need a guardian's consent.

3. Why we may use data (legal basis)

The law says we need a reason for each use. Ours:

4. Guests' data: the couple is in charge

When a guest answers an RSVP, the couple decides what to ask and what to do with it. SayJa stores it and runs the tools on the couple's instructions. In legal terms the couple is the controller and SayJa is the processor. As processor, we promise:

• We use guest data only to run the couple's wedding, on their instructions.
• Our people who can reach it are bound by confidentiality and only see it when needed.
• We keep it secure: encryption in transit and at rest, access controls and backups.
• We use only the providers in section 6. We email the owner at least 30 days before adding or swapping one, and the couple can object.
• We help the couple answer guests' requests, and forward any guest request that reaches us within 5 working days.
• We tell the couple without undue delay, and within 48 hours, if we learn of a breach affecting guest data.
• When the wedding is deleted, the guest data goes with it (section 8). The couple can download it first.
• We give the couple the information they need to check we follow this, and allow reasonable checks, for example by questionnaire.
• We never sell guest data, use it for advertising, or use it to train AI models.
• We move data outside the EU/UK only with the safeguards in section 7.

Couples: tell your guests what you do with their details (we give you a short notice below), ask only for what you need, and use it only for the wedding.

We are a controller ourselves for a small amount of guest data: security logs and what we need to defend a legal claim.

5. For guests: the short version

6. Who else handles your data

These companies process data for us. We have a data processing agreement with each one.

Stripe also acts as a controller for its own fraud and legal checks, and its privacy policy applies to that. The AI provider will be named here before the feature is switched on. It will only receive what you choose to send, and we require that it does not train its models on your data. We use no other tools that see personal data, and no advertising or analytics tools.

7. Moving data between countries

We store your data in the EU. UK couples' data stored in the EU is allowed by UK rules, and EU data sent to the UK is covered by the European Commission's renewed UK decision, valid until 27 December 2031.

Some providers are based outside the EU or UK, or their staff can reach data from there (for example a US company). In those cases we rely on approved safeguards: the EU's Standard Contractual Clauses or the EU–US Data Privacy Framework, and for the UK the UK addendum or the UK–US data bridge.

8. How long we keep data

Receipts hold only your name, email, country, amount, date and VAT, and your VAT number and address if you gave them. They never include your wedding or guest details.

We may keep anonymous numbers (for example, weddings per month) that cannot identify anyone.

9. Your rights

You can ask us to show you your data, correct it, delete it, limit how we use it, move it to another service, or stop a use you object to. If you gave consent (for dietary needs or photos), you can take it back at any time. We make no automated decisions that affect you.

Most of this you can do yourself in the app:

Deleting is final: we ask twice, give a last warning, and ask you to type DELETE and your password. There is no grace period. Receipts are kept as the law requires (section 8). Anything else, email ryan@sayja.se. We answer within one month, free of charge, and may ask you to log in to confirm it is you.

Guests: you can see what the couple sees about you, opt out of the attendee list, choose whether the couple see when you open their messages, remove yourself from photos and delete your own uploads. For anything else, ask the couple first, since they decide how the details are used. Couples can edit or delete a guest at any time. If a guest writes to us, we pass it to the couple within 5 working days.

10. Cookies

SayJa uses essential cookies only: they keep you logged in, remember your language, and protect forms and logins. Stripe's checkout page may set its own cookies to stop fraud. We use no analytics, advertising or tracking cookies, and no social media pixels. In emails to guests who agreed to it, we add a small invisible image and tracked links so the couple can see when a message was opened or clicked. Guests who have not agreed get plain emails with no tracking, and can change their choice at any time. We do not track the couple or helpers this way. Essential cookies do not need your consent, so there is no cookie banner.

11. Keeping data safe

Data is encrypted in transit and at rest, each role sees only what it needs, personal links to guest pages are unguessable and can be revoked, and we back up regularly. If a breach puts your data at risk, we tell you without undue delay and tell the data authority where the law requires, within 72 hours.

12. Complaints

Write to ryan@sayja.se first, and we will reply within 30 days. You can also complain to the data authority:

You can complain where you live, where you work, or where you think the problem happened.

13. Changes and contact

We post new versions here with the date. For important changes we email you 30 days ahead. Questions: ryan@sayja.se, Buskvägen 3, 281 36 Hässleholm, Sweden.