Privacy policy

[Operator name — completed at the commercial launch], [Legal form — completed at the commercial launch], [Registration number — completed at the commercial launch], with its registered office at [Registered office — completed at the commercial launch], operates the Ampersand platform at ampersand.events.

For any question about your data: [Contact address — completed at the commercial launch].

Data protection officer: [Name and contact, if required — completed at the commercial launch].

We are the controller for your account, the platform's security and our emails. The wedding's content (the guests, the photos, the capsule) we process on the couple's instructions. The split of roles is confirmed in the legal review.

Only the data that organising the wedding needs:

• Your account. Your email, name and role in the wedding, for the account, for signing in without a password (with a code by email or with Google) and for access rights.
• The wedding and the guests. The guests' names, families, children and emails, their replies and menu choices, from you and from the guests, for replies, tables and printed materials.
• Dietary restrictions. An optional field, for the kitchen list only, next to the name and table. We ask for no diagnosis, and the text never enters any automatically generated text.
• Photos and the capsule. Photos and videos uploaded by guests and the photographer, for the wedding gallery, with the originals in the couple's Google Drive; the capsule messages, which open one year after the wedding.
• Guest access. The personal link or QR code from the couple, the session it opens and, where the couple approves, the email address or Google account a guest uses to reach the photos.
• Profiles and the budget. What the couple and editors write about people, for organising and for the wedding newspaper; the budget and gifts, visible only to the couple and those they give access to.
• Technical data. Logs, IP address and request identifier, for security, debugging and abuse prevention.

We do not use your data or your guests' data for advertising and we do not sell it. The legal basis of each processing activity is confirmed in the legal review.

Ampersand uses Google in two places, only when you choose to:

• Signing in with Google. We ask for the openid, email and profile permissions. We receive your Google account identifier, email address, name and, if there is one, profile picture, to open your account and recognise you at your next sign-in.
• Google Drive. The couple can connect the wedding album in Google Drive with the drive.file permission. It shows us only the files Ampersand created or the couple explicitly chose in the app, not the rest of the Drive. We use it to copy approved photos into the album, keep track of them in the gallery and show them to the people the couple gave access to.
• Where and for how long. Account data is kept in the platform's database, in the European Union. The Drive access keys are kept encrypted, on the server only, until the album is disconnected or the wedding's data is deleted. The photos stay in the couple's Drive and are downloaded directly from Google; we do not delete or move them.
• How to withdraw access. In the app, from Photos › Drive connections › Disconnect: the access keys are deleted and the photos stay in Drive. At any time, from your Google account, at myaccount.google.com/permissions, where you remove Ampersand's access.

Ampersand's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use data received from Google for advertising, we do not sell it and we do not use it to train artificial intelligence models.

The providers that keep the platform running:

• Supabase: the database, authentication and temporary file storage, in the European Union (Frankfurt);
• Netlify: hosting the pages, through a global delivery network, with servers outside the European Union as well;
• Scaleway TEM: transactional emails (sign-in codes, team invitations, access requests), from France;
• Google Drive: the wedding album, in the couple's Google account; the couple's relationship with Google is their own;
• The AI provider: the wedding newspaper's texts; it receives no real data until its processing terms are confirmed, and dietary restrictions never reach it.

We pass data to authorities only when the law requires it. We do not promise that data never leaves the European Union: it is a promise we cannot verify for every provider.

The wedding's data

Until the site's access expires, 365 days after the wedding, plus 30 days; then it is deleted. An extension moves the date.

The capsule

Up to 30 days after it opens.

Photos awaiting approval

At most 7 days.

Generated archives

14 days after they are generated.

Backups

Rotated within at most 30 days.

Technical logs

30 days, with no personal content.

We never delete the originals in the couple's Google Drive, neither at expiry nor at cancellation.

You can ask for access to your data, its correction, erasure, restriction of processing and portability, and you can object to processing based on legitimate interest. You can withdraw your consent where we relied on it, without affecting what was processed before.

Write to [Contact address — completed at the commercial launch]. We reply within 30 days at most.

A guest can ask us to delete them, a photo or a contribution; we carry out the request within 30 days and let the couple know. A newspaper already printed cannot be withdrawn.

You can complain to Romania's National Supervisory Authority for Personal Data Processing. For the Republic of Moldova: [The competent authority in the Republic of Moldova — completed at the commercial launch].

Each wedding's data is isolated from the others. Access keys to providers live only on the server, never in the browser. If a security breach affects your data, we tell you and notify the authority within the legal deadlines.

When we change this policy, we publish the new version with its date. If the change really affects you, we tell you by email before it takes effect.