Privacy policy

This Privacy Policy describes how Plan de Mariage processes personal data in connection with the Platform (user account, weddings, guests, guest websites, and related features).

It complements the Terms of Use and the Terms and Conditions of Sale.

Person responsible for the protection of personal information (Law 25, Quebec): in accordance with Quebec's Act to modernize legislative provisions as regards the protection of personal information (Law 25), the person responsible for the protection of personal information within Plan de Mariage can be reached at the following address: [email protected].

General contact: [email protected].

Roles (depending on the data involved):

• For Account data (creation, login, support, security), the Platform publisher acts as the data controller.
• For data entered by an organizer about third parties (for example guests, collaborators, or guest website content), the organizer generally acts as the data controller, and the publisher intervenes to provide the Platform (hosting, display, backups, and related technical services).

If you are a guest and wish to exercise your rights regarding data managed by an organizer, we may direct you to the relevant organizer where appropriate.

Depending on how you use the service, we may process the following categories of data:

• Account data: email address, password (hashed), session tokens, settings, and preferences.
• Wedding data: wedding name, date, steps or schedule, guest website configuration, team, and subdomain.
• Guest data: names, groups, status, RSVP responses, and information entered by the organizer.
• Seating chart data: tables or other items, positions, and assignments.
• Budget data: categories, amounts, due dates, and entered information depending on the fields used.
• Tasks: lists, columns, labels, and progress status.
• Guest website content: text, images, information, and contacts.
• Files: uploaded images (for example avatar, wedding visuals, or guest website visuals).
• Technical data: logs, diagnostics, synchronization events, and technical information related to the browser or terminal.
• Payment: we do not store card data; we may process transaction-related status or activation information (for example technical identifiers, activated plan, and dates).

Processing is carried out in particular for the following purposes:

• Account creation and management, authentication, and security.
• Provision of features (guests, seating chart, budget, tasks, guest website, collaboration).
• Support and user relationship management.
• Payment and billing management (via Paddle).
• Abuse prevention and service reliability improvement (anti-bot, anti-fraud, security logs).

Depending on your country and the applicable framework, legal bases may include contract performance, compliance with legal obligations, legitimate interest (security or anti-fraud), and or consent (for certain trackers).

Data may be accessible to the publisher and, where necessary, to technical service providers acting as processors.

• Hosting / storage / logs: Amazon Web Services (AWS) (for example compute, APIs, file storage, messaging and events, monitoring, and logs). Depending on the configuration, this may notably include services such as AWS Lambda, API Gateway, S3, SNS, and CloudWatch.
• Network / CDN / protection: Cloudflare (for example DNS, proxy or CDN, DDoS protection, and, depending on configuration, security filtering).
• Database: database services (for example Firestore).
• Email delivery: transactional email delivery provider (for example Resend).
• Security / anti-abuse: Cloudflare Turnstile (anti-bot or anti-abuse) during registration and or login.
• Payments / billing: Paddle (Merchant of Record) for checkout, invoicing, and tax collection.
• Third-party login (if enabled): Google (Google account sign-in or authentication).

The exact list of subprocessors and their policies may evolve. The published version is authoritative as of the consultation date.

The Platform is operated from Canada (Quebec). Depending on the technical organization and the service providers used, data may be processed or accessible from other countries, including the United States and or the European Union.

Where international transfers are necessary, we implement appropriate safeguards under applicable law (for example standard contractual clauses, security measures, and related safeguards), where required.

We retain data for a period proportionate to the purposes pursued, then delete or anonymize it, subject to legal obligations and technical backups.

• Account: retained for as long as the account is active, then deleted or anonymized after a deletion request or after a prolonged period of inactivity.
• Wedding data: retained for as long as the wedding is active, then deleted or anonymized after a deletion request or after a prolonged period of inactivity.
• Technical and security logs: retained for a limited period (for example 12 months) for diagnostic, prevention, and security purposes.
• Backups: data may remain in technical backups for a limited period and are purged according to defined cycles.
• Billing or payment data: billing documents and data are handled by Paddle according to its own obligations and policies.

Depending on applicable law (for example the GDPR in the EU or Quebec's Law 25), you may exercise rights of access, rectification, deletion, objection, restriction, and portability, and may withdraw your consent where processing is based on consent.

You may exercise your rights by writing to [email protected]. We may request proof of identity where necessary.

The Platform may use trackers and or local storage (localStorage) for technical purposes (for example offline mode, memorizing settings, and synchronization).

For more information, see the Cookie Policy.

We implement reasonable technical and organizational measures to protect data (access controls, separation of environments, access limitation, anti-abuse measures, backups, and related safeguards). No measure can guarantee absolute security.

This Policy may be modified for technical, legal, or commercial reasons. The applicable version is the one published online on the consultation date.