Privacy policy

1. Who is responsible for your data

The controller of the data in the Alaturi.App platform is:

DevCraft Solutions S.R.L.
VAT ID RO49799513 · Trade Register J40/5988/2024
Registered office: B-dul Ficusului nr. 10B, cam. 1, Sector 1, Bucharest, Romania
Phone +40 748 989 573 · Email contact@devcraftsolutions.net

For any question about your data, write to us at the email address above.

The guests’ data is entered by the hosts: they decide whom to invite and what goes on the list.

3. What data we process and why

3.1 Buyers (event owners)

What

Email, name, billing address, country, tax ID (if you buy for a business) and payment references. We never receive card details; only Stripe has them. At activation we keep the date of the agreement, the IP address it came from and the version of the terms. If you withdraw from the contract, we keep the date of the request.

Why

To conclude and perform the contract, issue the invoice, keep the accounts and be able to prove the agreement given at activation.

Legal basis

The contract (Art. 6(1)(b) GDPR) and our legal obligations for invoicing and accounting (Art. 6(1)(c) GDPR).

How long

Order and invoice data, 10 years.

3.2 Hosts’ accounts

What

Email, password (only as a hash, never in plain text), chosen language, sign-in times and failed attempts. The addresses where the hosts choose to receive the emails with their guests’ replies.

Why

So you can sign in and manage the event. To protect accounts: after several failed attempts, the account is locked for 15 minutes.

Legal basis

The contract (Art. 6(1)(b) GDPR) and our legitimate interest in keeping accounts secure (Art. 6(1)(f) GDPR).

How long

Until the event is deleted. An account is deleted when it has no other event.

3.3 Guests

What

• the names the hosts put on the invitations;
• the replies: whether they come, companions, vegetarian meals and a message for the hosts;
• the table each person sits at, if the hosts use the seating planner;
• the photos uploaded to the album, with the name chosen by the person uploading them;
• the guest’s email address, if the hosts email them the invitation from the platform. We use it only to send that email and do not add it to the guest list.

Why

So the hosts can organise their event: send the invitations, receive the replies, seat the guests and collect the photos.

Legal basis

The hosts’ legitimate interest in organising their event and our contract with them (Art. 6(1)(f) and (b) GDPR).

Who sees it

The hosts. The album’s photos can be seen by anyone with the album’s link or its QR code.

How long

Until the event is deleted.

3.4 Menu notes (allergies, intolerances)

In their reply, guests can write about allergies or intolerances. These notes may reveal health data, which has special protection (Art. 9 GDPR). So:

• only guests who want to write them: the field is optional, and what a guest writes there is kept so the hosts can see it;
• only the hosts see them: in the event’s dashboard and in the guest list and seating plan they download or print; if they give the plan to the venue, so the menu is taken care of, they do so themselves;
• we never send them by email; the email to the hosts only says there is a note and points to the dashboard;
• they are deleted with the event.

The legal basis is your explicit consent (Art. 9(2)(a) GDPR), which you give by writing the note in this optional field. You can withdraw it at any time: delete the note on the same link and save your reply. If replies are closed, write to the hosts or to us.

3.5 Reports from the album

When someone reports a photo with the “Report” button, the photo and the reason reach us and the hosts. The reason stays next to the photo in the hosts’ dashboard until they delete or keep the photo, and goes with the event in any case. If you leave contact details, we use them only to tell you our decision. The legal basis is our legal obligation to handle notices under Regulation (EU) 2022/2065, the Digital Services Act (Art. 6(1)(c) GDPR).

3.6 WhatsApp messages

If you message us on WhatsApp, from the link on the site or in your account, we see your phone number, your profile name and what you write. We use them only to answer you. The message prepared in your account contains the event’s names and a short code for it, so we find it quickly; you can change it before sending. Messages go through WhatsApp, a Meta service, under its own terms. The legal basis is our legitimate interest in answering you and, if you are a customer, the contract (Art. 6(1)(f) and (b) GDPR). We do not use WhatsApp for advertising.

3.7 Cookies and technical data

• The devcraftsolutions.net website uses no cookies at all. The cookies below are only Alaturi.App’s.
• A session cookie (event.admin), only for signed-in hosts, to keep you signed in; it expires after 8 hours or when you sign out.
• An anti-forgery cookie for forms (.AspNetCore.Antiforgery.…), which protects them from requests sent in your name by other websites; it is deleted when you close the browser.
• Both are strictly necessary, so we do not ask for your consent (Romanian Law 506/2004, art. 4(5)); we only tell you what they are, in a short notice on the website and in the app. Your browser remembers that you closed the notice (localStorage), not a cookie. We use no analytics or marketing cookies.
• When you buy, you reach Stripe’s payment page, which uses its own cookies, for the payment and fraud prevention, under Stripe’s rules.
• So that passwords cannot be guessed, we count wrong sign-in attempts and requests for a new password per connection (IP address) and per email address, only in the server’s memory and for at most 15 minutes; in your account we keep only how many wrong passwords came in a row, until the next successful sign-in. After 3 wrong attempts, the sign-in page asks for an anti-robot check by Cloudflare (Turnstile): Cloudflare receives the IP address and some technical details about the browser and uses them only to tell a person from an automated program. After 10 wrong passwords in a row, the account is locked until a new password is chosen, and its holder receives the link for it by email. Legal basis: our legitimate interest in protecting accounts (Art. 6(1)(f) GDPR). The check is part of the security of the service you are using, so we do not ask for your consent to it.
• We count, per day, how many times the front page and the invitation, album and purchase pages are opened and how many different visitors opened them. A visitor is recognised only on that day, by a fingerprint computed from the IP address and the browser with a key chosen at random every day and kept only in memory; neither the address nor the fingerprint is saved. Only the daily totals reach the database, kept for a little over a year (400 days). Robots and link previews are not counted. Legal basis: our legitimate interest in knowing how much the service is used (Art. 6(1)(f) GDPR).
• The server keeps technical logs for security and troubleshooting. The secret links of the invitations and the album do not appear in the logs.

4. Who receives the data

The data lives on our own server in Romania. We do not sell it or use it for advertising. We share it only with these providers, as far as the service needs:

• Stripe Payments Europe, Ltd. (Ireland): processes card payments.
• Cloudflare: the network (tunnel) through which our server is reached; all traffic passes through it. Cloudflare also runs the anti-robot check at sign-in (Turnstile).
• The email hosting provider for devcraftsolutions.net: sends the platform’s emails.
• Oblio (Romania): the software we issue invoices with.
• ANAF, the Romanian tax authority: receives the invoices through e-Factura, as the law requires.
• WhatsApp (Meta Platforms Ireland Ltd.): only the messages you choose to send us there.

The hosts also see data (their guests’), and so may authorities, when the law requires it.

The links to Google Maps, Apple Maps and Waze on the invitation open only if you tap them; from there, those services’ own rules apply.

5. Transfers outside the European Union

Some providers may transfer data outside the European Union:

• Stripe, under its own data protection terms;
• Cloudflare, under the EU-US Data Privacy Framework or the standard contractual clauses approved by the European Commission;
• Meta (WhatsApp), likewise under the EU-US Data Privacy Framework or standard contractual clauses.

6. How long we keep data

If we ever restore an older backup, we delete again the events deleted since.

7. How we protect data

• The links of the invitations and the album are secret, impossible to guess, and not kept in the server’s logs.
• Passwords are stored only as hashes.
• After several failed sign-in attempts, the account is locked for 15 minutes.
• Each host has their own account. Only the hosts see the guests’ replies.
• Each event has its own space: a host sees only the events they were added to.
• The DevCraft team opens an event only to fix a problem or handle a request from its hosts, and every such access is logged.
• Photos lose their GPS and camera data in the browser, before they reach us.
• Our emails do not track whether they were opened.

8. Your rights

Under the GDPR, you have the right:

• of access: to know what data we hold about you and get a copy;
• to rectification: to have wrong data corrected;
• to erasure: to have data deleted, where the law allows;
• to restriction: to have processing limited, for example while we check a complaint;
• to portability: to get your data in a common format or have it sent to someone else;
• to object: to processing based on legitimate interest;
• to withdraw consent at any time, for what is based on consent (such as menu notes), without affecting what was done before.

To use your rights, write to us at contact@devcraftsolutions.net. We answer within one month. So that we never give your data to someone else, we may ask you to confirm it is you.

If you are a guest, you can also ask the hosts, who decide what goes on their list.

If you are not satisfied with our answer, you can complain to the Romanian data protection authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), www.dataprotection.ro, or to the authority of the EU country where you live.

9. Automated decisions

We make no decisions based solely on automated processing that produce legal effects for you or affect you in a similar way.

10. Children

Only adults can buy the service. The pages of a baptism or a birthday may show photos of children. The hosts decide what they publish and should share the album’s link only with their guests.

11. Changes to this policy

If we change this policy, we update the version and the date at the top. We announce important changes by email to the hosts of active events.