Privacy policy

oneday.cards is run by FOP Rakhletskyi Yurii Ihorovych, a sole proprietor registered in Ukraine, at 9 Romana Kupchynskoho St, apt 229, Ternopil, Ternopil Oblast, Ukraine. For anything about your data, write to contact@oneday.cards. All our details are on the Company details page.

We are responsible for the data you give us as a customer: we are its controller. For your guests’ RSVP answers, you are the controller, and we process them on your behalf.

When you order and while we work together:

• your names, the wedding date, the plan and the languages you choose;
• how to reach you: an email address;
• what you send for the invitation: texts, photos, music, places and the plan of the day;
• our emails to each other;
• payment records: what you bought, the amount, the currency and the date, your name and email. Card details go straight to the payment provider; we never see them.

When anyone opens our site or an invitation, the hosting provider records technical data in server logs, such as the IP address, the browser and the page requested. We use it only to run the service and keep it secure.

When guests answer an invitation, the couple who invited them decides what is asked and what happens to the answers. The couple is the controller; oneday.cards stores the answers for them as a processor, under our data processing terms.

What is stored: the answers to the questions the couple chose, typically names, whether you come and with how many people, children and their ages, travel and accommodation needs, a song wish and a message; plus the time of the answer and a random code made by your browser, so that a changed answer replaces the old one.

Where: in a private Google Sheet in our Google account, shared with the couple. The couple also gets an email for each answer.

Who sees it: the couple, and the people at oneday.cards who work on their invitation.

When it is deleted: 3 months after the wedding, or at the end of the hosting period if the couple asks to keep the answers longer.

We never use guests’ answers for our own purposes: no marketing, no profiling, no statistics across events.

If you are a guest and want to see, correct or delete your answer, ask the couple, or write to us at contact@oneday.cards with your name and the invitation link. We pass your request to the couple within 2 working days; if they do not reply within 10 days, we act on it ourselves.

• To take your order, build, publish and host your invitation, and answer your questions: to perform our contract with you (GDPR Art. 6(1)(b)).
• To issue receipts and keep accounting records: because the law requires it (Art. 6(1)(c)).
• To keep the service secure and prevent abuse, using server logs: our legitimate interest (Art. 6(1)(f)).
• To count visits to our site without identifying anyone: our legitimate interest in knowing which pages help.
• To store guests’ answers: on the couple’s instructions; the legal basis is the couple’s.

We do not send newsletters. If we ever do, only to people who ask for them.

The Law of Ukraine “On Personal Data Protection” provides similar grounds: your consent, a contract with you, a duty under the law or a legitimate interest.

We use a few providers. Each gets only what it needs for its job:

• Vercel (United States): hosts our site and every invitation, and keeps the server logs.
• Google (United States and other countries): Google Sheets and Apps Script store guests’ RSVP answers and send the couple an email for each answer.
• Zoho Mail (EU data centre): our email.
• Resend (United States): sends the emails about your order to us and to you. PostHog (EU, Frankfurt): counts visits to oneday.cards in cookieless mode, without storing IP addresses. It runs on our site only, never on invitations.
• LiqPay (PrivatBank) (Ukraine): takes card payments under its own privacy rules.

Before we add or replace a provider that handles guests’ answers, we tell the couples.

We do not sell personal data and do not share it with advertisers.

We are based in Ukraine, so the data you send us is handled in Ukraine.

Vercel and Google may process data in the United States and other countries. Both use the EU Standard Contractual Clauses (2021) as the safeguard for these transfers.

• Guests’ RSVP answers: deleted 3 months after the wedding, or at the end of the hosting period if the couple asks to keep them.
• The invitation (texts, photos, music): for the hosting period of the plan. We email the couple 30 days before the end, then delete it; backups within the next 30 days.
• Order details and messages: while we work on your order and your invitation is online, then deleted, except what the law requires us to keep.
• Receipts and accounting records: as long as tax law requires; in Ukraine, at least 1095 days.
• Server logs: a short time, under the hosting provider’s own rules.
• Visit statistics: kept only as totals that identify no one.

You can ask us to:

• show you the data we hold about you and give you a copy;
• correct it;
• delete it;
• limit how we use it, or stop using it where we rely on our legitimate interest;
• send it to you or to another service in a common format;
• withdraw a consent you gave, at any time.

Write to contact@oneday.cards. We answer within one month. We may ask you to confirm who you are, for example by writing from the address we know.

Some data we must keep by law, such as receipts; if that applies, we tell you.

You can complain to a data protection authority: in the EU, the one in the country where you live or work (for example UODO in Poland); in the UK, the ICO; in Ukraine, the Ukrainian Parliament Commissioner for Human Rights. We would be glad to hear from you first.

Our site and the invitations set no cookies. To count visits we use PostHog in its cookieless mode: it stores nothing in your browser, does not keep IP addresses and identifies no one. More on the Cookies page.

To stop being counted, turn on Do Not Track in your browser (we honour it) or use any content blocker.

Ordering is for adults: you must be 18 or older. Guests may mention their children in an RSVP (names and ages, so the couple can plan). Parents give these details for their children, and they are deleted with the rest of the answers.

• Everything travels over HTTPS.
• Guests’ answers never go into an invitation’s code. The RSVP form only accepts answers and never shows stored ones.
• The answer sheet is private: apart from us, only the couple can open it.
• Invitations are on private links that search engines do not index.
• Only the people working on an order can see its data.

If a breach puts your data at risk, we tell you without undue delay; for guests’ answers, we tell the couple within 48 hours.

When we change this policy, we update the date at the top. If a change matters to you, we tell customers by email before it applies.

This policy is published in English and Ukrainian; both versions say the same.