Privacy

DRAFT for a lawyer's review. This is not the final text.

ThirtySix Studios OÜ. Email: [email protected]. ThirtySix Studios OÜ is the controller under the GDPR and KVKK.

The account stores an email address and a sign in session. The profile can store a first name, a last name, a gender, a birth year, a city, languages, a short intro, an optional Instagram username and an optional LinkedIn username.

Didit checks the identity document and liveness. Biometric images and the identity document stay at Didit. NikaPass keeps the verified name, the birth year, the verification id, and the verification status. These records are deleted or anonymized 30 days after the wedding ends. If the person has another wedding that ends later, the profile stays until 30 days after that wedding ends.

A wedding stores partner names, the date, the venue, the capacity, the seat price, and the couple's payee name and IBAN so the guest can pay at the venue. An RSVP stores the guest name, the party size, notes, and an optional contact. A seat stores its status, table, and reference code. A receipt file is stored at Cloudinary.

Location is read only at check in, only to measure distance to the venue. The guest coordinates are not stored as a history. A push token can be stored on the device record.

Purposes and bases: the account, the listing, and the Wedding Pass are a contract. Biometric verification and the check in location are explicit consent. Strikes and bans are a legitimate interest in a safe venue.

Personal data of a wedding is deleted or anonymised 30 days after the wedding ends. For a guest who checked in, the attended entry stays: the couple's first names, the date, the city, and the cover photo, plus memory photos and reviews. Those stay until their author deletes them, the couple removes them, or an account is deleted. Everything else is deleted or anonymised 30 days after the wedding ends. Deleting the account removes the profile, the identity link and contact details at once; a hashed identity key and the strike count remain so a ban still applies.

Processors: Didit, RevenueCat, Resend, Cloudinary, the geocoder (Komoot Photon), and the host (Render and Neon in the European Union). Some processors may process data outside Turkey. Transfers use the KVKK standard contract and, where the GDPR applies, a recognised transfer tool.

You can ask for access, correction, deletion, restriction, objection, or a portable copy, and you can complain to a supervisory authority. Write to [email protected].

Other users see: a couple sees a guest's verified first name, age, city, languages, intro, average rating and number of weddings attended before deciding; a guest sees the couple's verified payee name and IBAN after check in. Automated decisions: a missed arrival after Still coming or a seat marked not received adds a strike, a seat marked not received freezes the account, and two strikes ban the verified identity. No person takes these decisions. You can contest one by writing to [email protected] and a person will review it. Security logs with the IP address are kept for 12 months. Processors also include Expo (push notifications), Sentry (error reports, EU) and Apple and Google (sign in and store purchases).