Privacy Policy

1. Who We Are

Occavia, operated by [COMPANY LEGAL NAME AND REGISTERED ADDRESS] from the country of Georgia (Sakartvelo), is the data controller for the personal data described in this policy. For the information your guests submit to your invitation, you, the host, are the controller and we process it on your behalf. Contact: hello@occavia.com.

2. Data We Collect

Account data: your email address and, if you sign in with Google, your Google account name and profile photo.

Event content: names, event date, venue, story text, schedule, and any other information you enter while building your invitation.

Uploaded media: photos and videos you upload as a cover image or to an event gallery, stored in Cloudflare R2.

Guest data: names, attendance, party size, companions, dietary notes, answers to your RSVP questions, personal messages, guestbook entries, comments and reactions, quiz answers and seating — submitted by your guests or added by you — including guests’ email addresses and phone numbers where you or they provide them (for example on your guest list or RSVP form). Guests may also upload photos and videos and may choose to use the AI photo booth.

AI photo booth: when a guest uses it, their photo is sent to our AI providers to create a styled picture, together with an automated description of the people in the photo (such as skin tone and hair) so that the result stays recognisable. The photo and the result are stored with the event. Guests are told this before the photo is sent.

Other data you give us: the recipient’s name, email address and message when you buy a gift; the email address you enter for a Save the Date; the messages and contact details you send through our support chat or contact forms; and, if you join our partner programme, your payout and tax details and a log of the clicks on your referral links.

Payment data: your purchase is processed entirely by Paddle. We receive only a transaction reference, the product purchased, the amount, and your country (used for tax purposes). Your card number and payment credentials are never transmitted to or stored by us.

Technical and usage data: IP address, browser type, device type, pages visited, and error logs, collected automatically as you use the service.

3. How We Use Your Data

To operate and deliver the service: create and host your invitation page, show RSVPs and the guest photo wall in your dashboard, and send transactional emails (e.g., sign-in links, RSVP notifications). Legal basis: performance of a contract.

To run the features you and your guests choose: send reminders and notifications by email and, where available, WhatsApp; translate your invitation text automatically when you ask us to; create AI photo booth images; and answer support requests, including with an AI assistant. Legal basis: performance of a contract and, for the AI photo booth, the guest’s consent.

To keep invitations safe: photos uploaded to an invitation are checked automatically by an AI moderation service for unlawful or harmful content. Legal basis: legitimate interests.

To process payments: pass a checkout session to Paddle and reconcile the completed transaction. Legal basis: performance of a contract.

To keep the service secure and prevent fraud: monitor for suspicious activity and enforce our acceptable-use rules. Legal basis: legitimate interests.

To comply with legal obligations: respond to valid legal requests from authorities, keep tax records. Legal basis: legal obligation.

4. Cookies

We use necessary cookies to keep you signed in (a secure session cookie) and to remember preferences such as your chosen currency and any partner referral. We use Google Analytics in consent mode: until you accept analytics cookies in our banner it sets no cookies and sends only cookieless, aggregated signals, and it sets analytics cookies only after you accept. You can decline or withdraw your consent at any time. We do not use advertising or cross-site tracking cookies.

With your consent, we also use PostHog on our marketing and checkout pages to understand how visitors navigate and where they encounter difficulty. It records anonymised session replays; everything you type into a form is masked and is never captured, and we never record network request or response contents. It loads only after you accept analytics cookies in our banner — never on the published invitation pages your guests visit, and never on your private dashboard — and you can withdraw your consent at any time.

5. Data Storage & Security

Structured data (accounts, event content, RSVPs) is stored in Supabase, a managed PostgreSQL service. Access is restricted by row-level security policies so each user can access only their own data.

Media files (photos and videos) are stored in Cloudflare R2. Files are served via signed or public URLs. Uploads are restricted to reasonable file-size limits.

All data is encrypted in transit using TLS. Secrets and API keys are stored server-side and never exposed to the browser.

6. Data Retention

Account and event data is kept while your account is active. Photos and videos uploaded to an invitation are kept until 6 months after the event date and then permanently deleted; RSVPs and written wishes stay until you delete the event or your account. If you delete your account, your events, guest RSVPs and uploads are removed from our live systems within 30 days, and copies in our encrypted backups are deleted as those backups are rotated. After deletion we keep limited records where the law or our legitimate interests require it: payment and tax records (see below), security and audit logs, and support and partner-programme records.

If you delete a specific event, all guest RSVPs, messages, and uploaded media for that event are permanently deleted.

Payment transaction records are retained for the period required by applicable tax and financial law (typically 7 years).

7. Sub-processors

We share personal data with the following trusted sub-processors to operate the service:

Supabase, Inc. (USA) — database, authentication, and server functions. Data is stored in the EU region (Frankfurt). Privacy policy: supabase.com/privacy.

Cloudflare, Inc. (USA) — media storage (R2) and content delivery. Data is stored according to Cloudflare's data localisation settings. Privacy policy: cloudflare.com/privacypolicy.

Paddle.com Market Limited (UK/Ireland) — payment processing as Merchant of Record. Paddle is responsible for collecting and processing your payment information. Privacy policy: paddle.com/privacy.

Google LLC (USA) — optional Google Sign-In (OAuth 2.0), used only if you choose to sign in with Google.

PostHog Inc. (United States), using its EU Cloud region — product analytics and anonymised session replay on our marketing and checkout pages, loaded only after you accept analytics cookies. Data is stored and processed within the EU. Privacy policy: posthog.com/privacy.

Vercel Inc. (USA) — hosting of our website and server functions, run in the EU region (Frankfurt).

Google LLC (USA) — Google Analytics, in consent mode (see Cookies).

Cloudflare, Inc. (USA) — Turnstile bot protection on our forms.

OpenAI, L.L.C. (USA) — creating AI photo booth images and other AI features.

Anthropic PBC (USA) — describing the people in AI photo booth photos, automated moderation of uploaded photos, and our AI support assistant.

Resend, Inc. (USA) — sending emails such as sign-in links, RSVP notifications and reminders.

Meta Platforms Ireland Ltd. (WhatsApp) — sending reminders by WhatsApp, where available.

Microsoft Corporation (Azure Translator) — automatic translation of invitation text when you request it.

Upstash, Inc. (USA) — rate limiting, which uses IP addresses, and our live support chat.

Functional Software, Inc. (Sentry) (USA) — error monitoring.

Telegram — notifying our support staff of new support messages.

GitHub, Inc. (USA) — running our encrypted backups.

8. International Transfers

Several of the sub-processors listed above are based outside the European Economic Area (EEA) and the United Kingdom, mostly in the United States. Where personal data is transferred to a country without an adequacy decision, we rely on Standard Contractual Clauses (SCCs) or other appropriate safeguards offered by those providers.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data: (a) Access — request a copy of the data we hold about you; (b) Rectification — ask us to correct inaccurate data; (c) Erasure — ask us to delete your data ("right to be forgotten"); (d) Data portability — receive your data in a machine-readable format; (e) Restriction — ask us to restrict how we process your data; (f) Objection — object to processing based on legitimate interests.

To exercise any of these rights, email us at hello@occavia.com with your request. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority.

10. Children

You must be 18 or over to create an account (see our Terms). The service is not directed at children, and we do not knowingly collect personal data from children under 16 other than through content a host or guest chooses to share, such as a family photo on an invitation or photo wall. Hosts and guests are responsible for having permission to share images of children. If you believe we hold a child’s data that should be removed, contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy here with a revised "Updated" date. For significant changes that affect how we use your data, we will also notify you by email.

12. Contact

For any questions about this Privacy Policy or to exercise your data rights, contact us at: hello@occavia.com.