Privacy policy
The German version of this page is the authoritative text; this English text is a courtesy translation. Read the German version
Version 1.0 · As of: 22 September 2026
1. Controller
Vitalii Bartashchuk (sole trader), Za vodou 161/2, 032 03 Liptovský Ján, Slovak Republic, IČO 54225337 (Trade Register of the District Office Liptovský Mikuláš). Contact: info@vaet.sk.
No data protection officer has been appointed; for privacy matters an e-mail to the address above is enough.
2. What data we process
- Host account: e-mail address and a display name derived from it (the part before the “@”). Its first word appears as “by …” on the invitation page and in the link preview image.
- Event: title, start and end, optional place text, optional “Details”, language of the invitation, visibility of guest names, and whether the place appears on the preview image. Anyone with the link can see the place text and details.
- A host’s or guest’s reply (RSVP): display name, yes / no or “maybe”, number of plus-ones (0–4) and, optionally, a comment (“I’m bringing …”).
- Guest token: a random identifier of which we store only a hash, so that you can change or delete your own reply later.
- Technical data: the IP address, solely to prevent abuse and to limit the number of requests (replies, creating events).
- Analytics: page views (path, referrer; no guest names) — only with your consent.
- Reports: name, e-mail address and details of the person reporting, when content is reported.
Self-registration: when someone requests a sign-in link on /host, we store the e-mail address and create a host account — before it is established that the address belongs to the person requesting it (it is only confirmed by clicking the link). An account that is never confirmed is deleted automatically, see section 5.
We process no guest phone numbers — there is no phone column. We collect no names of plus-ones, only a number. A display name is needed for a reply. We currently collect no guest e-mail address: the optional reminder feature is not active, the field is not shown, and an address submitted anyway is discarded on the server.
3. Purposes and legal bases (GDPR)
- Host account, invitation page, reply, calendar file — Art. 6(1)(b) (contract, or the service the guest requests by submitting).
- Analytics — Art. 6(1)(a) (consent; not active without consent).
- Security and abuse prevention, including the short-term processing of the IP address — Art. 6(1)(f).
- Handling reports and information to authorities — Art. 6(1)(c) (Arts. 16 and 17 DSA, § 13 ECG) or (f).
We use the host’s e-mail address only for sign-in, security and the deletion periods — not for advertising. There is no automated decision-making with legal effect. There is no public event directory and no profiling of guests across events. We do not sell data.
4. Recipients and processors
- Vercel — hosting of the web app (US company).
- Supabase — authentication and database, EU (Ireland).
- Resend — sending the sign-in e-mail.
- Vercel Web Analytics — page views, cookieless, only with consent.
Transfers to the USA. Vercel Inc. and Resend Inc. are established in the USA; Resend also stores e-mail content and logs in the USA when sending runs through the EU region. By Implementing Decision (EU) 2023/1795 the European Commission found that companies certified under the EU-US Data Privacy Framework provide an adequate level of protection (Art. 45 GDPR); both providers state that they are certified. In addition, the EU Standard Contractual Clauses (Art. 46(2)(c)) in the respective data-processing agreements apply. You can request details by e-mail.
Error-monitoring software (Sentry) is not integrated. The host’s WhatsApp client (Meta) is an independent controller.
5. Retention
- Guest data (display name, comment, token) — deleted 14 days after the end of the party; anonymised counts of statuses and plus-ones remain.
- Host profile — for as long as the account exists.
- Host account never confirmed — fully deleted after 14 days if the e-mail address was never confirmed, no sign-in ever took place and no event was created.
- Event data (title, times) — for as long as the host keeps them.
- Rate-limit entries (including the IP address) — the counting window is 10 minutes (replies) or 1 hour (creating events). For technical reasons an entry may remain until the same key is used again; it is then overwritten.
- Reports — the reporting person’s details until the procedure is closed, then only an anonymised note of the decision.
- Vercel Web Analytics — we do not store page views; retention is up to Vercel.
6. Cookies and local storage
- Host session — strictly necessary, for signing in.
- Guest token (only for the invitation page concerned) — strictly necessary; valid until 14 days after the end of the party, exactly as long as the data it unlocks.
- Consent status — strictly necessary; stores whether you accepted or declined, so we do not ask again.
- Language — strictly necessary; stores the display language you chose. No identifier, no analysis.
- Comment field notice — strictly necessary; remembers that you closed the one-time transparency notice.
- Analytics — not essential; stays off until you consent.
Analytics (Vercel Web Analytics) is cookieless and is only loaded after your consent.
7. WhatsApp — the host sends it themselves
The host opens wa.me or the share menu on their own device. The platform sends no WhatsApp messages and no SMS, calls no WhatsApp Cloud API, stores no address book and pre-fills no recipients. Our processing begins when a guest opens the link and enters something.
8. Who sees what
We are responsible for the platform. The host sees the replies to their own party and uses them to organise it — as a rule as a private, non-commercial activity. The service is meant for private parties; commercial use is not intended, which is why we do not offer a data-processing agreement.
- Guest names: “Only me” — the host alone. “Everyone who said yes” — visible to the host and to guests who said yes; the names of guests with a yes or maybe are shown. “Anyone with the link” — everyone who has the link.
- “I’m bringing …” comments: the host sees all comments. With “Anyone with the link”, everyone who can see the guest list sees them. With “Everyone who said yes”, the comments of guests who said yes themselves are visible. The app currently only sets “Only me”.
E-mail addresses never appear on the page. Link preview images never contain guest names.
9. Photos and minors
There is no photo upload for guests. The service is not directed at children under 14 (§ 4(4) of the Austrian Data Protection Act, DSG).
10. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time (with effect for the future) — via “Cookie settings” in the footer of every page. This clears your choice, the notice reappears and the optional analytics stops.
Guests can delete their reply via “Remove reply” on the invitation page while the token cookie exists (see section 6). Once it is gone, an e-mail to us or a message to the host is enough; the 14-day deletion also applies. To delete a host account, an e-mail to info@vaet.sk is enough — the account, its invitation pages and the guests’ replies are deleted in one step.
Right to lodge a complaint: you may lodge a complaint with a supervisory authority. Our lead authority is the Úrad na ochranu osobných údajov Slovenskej republiky (dataprotection.gov.sk); if you live in Austria you may also contact the Österreichische Datenschutzbehörde (DSB) (dsb.gv.at).
11. Changes to this policy
The version and date stated above apply. We announce material changes before they take effect; earlier versions are available on request.