Privacy Notice — Nupty

Last updated: 2026-08-08

Controller: DBRSZ-2022 Kft. (Hungary), e-mail: [email protected]. Full company details are in the Imprint. No data protection officer has been appointed. This notice covers the Nupty application, its RSVP survey pages and related messaging. EN and HU versions are equally applicable; the HU version prevails for data subjects in Hungary.

1. Who this notice covers

In short: three groups — planners, their guests, and site visitors.

(a) Organizers — account holders; (b) Guests — people whose details an Organizer enters and who may respond via a survey link (see Section 8, written specifically for Guests); (c) Visitors of our web pages (see the Cookie Policy).

2. What data we process

In short: your account, your wedding plans, your guest list, your messages and your payments — and nothing we don't need.

Messaging today is by e-mail, delivered via our e-mail provider (Resend); other channels such as SMS may be added later. Messaging data is processed only where such channels or features are used.

2.1 Dietary information — special note. Dietary entries (e.g., allergies, or kosher/halal preferences) can reveal health data or religious beliefs — "special category" data under GDPR Art. 9. Dietary information is optional. By choosing to enter it — a clear affirmative act, taken after the on-screen notice explaining that it is used for catering only — the guest gives explicit consent (Art. 9(2)(a)) to share it with the couple and their caterer for catering only. This consent is withdrawable any time via the same survey link, through which the guest can also review and correct the data. Where an Organizer enters dietary data on a guest's behalf, the Organizer confirms doing so with the guest's knowledge and agreement. Dietary data is shown only to the Organizer and in exports intended for the caterer.

3. Why we process it and on what legal basis

In short: to run the product you asked for; a few things for safety and legal duty; nothing is sold, ever.

We do not sell personal data, do not use it for third-party advertising, and do not profile Guests.

4. Who receives data (processors and recipients)

In short: a short, named list of service providers who work for us under contract — and the people you yourself share your workspace with.

We update the list of processors before engaging a new one; the current list is available on request at [email protected]. Within your workspace, data is visible to the people the Organizer invites, per the permission levels the Organizer sets. Authorities receive data only where the law compels us.

5. International transfers

In short: EU hosting; where a provider processes data in the US, we rely on the EU–US Data Privacy Framework or Standard Contractual Clauses.

Primary storage is in the EU. Where a provider in Section 4 processes data outside the EEA (typically the US), the transfer relies on an adequacy mechanism (e.g., the EU–US Data Privacy Framework, where the provider is certified) or Standard Contractual Clauses with supplementary measures — verified per provider before engagement and reflected in the current processor list. UK data subjects: UK Extension to the DPF / UK Addendum to the SCCs.

6. How long we keep data

In short: we keep your workspace and account data while your account exists; ask us to delete it and we act within 30 days; invoices stay 8 years because tax law says so.

7. Your rights

In short: see it, fix it, take it, delete it — and complain if we let you down.

You may request access, rectification, erasure, restriction, portability, and object to legitimate-interest processing; consent can be withdrawn any time without affecting prior processing. You can download a copy of your wedding plan yourself in Settings → Your data. For a copy of all your data, write to [email protected]; we respond within 30 days. You may complain to the supervisory authority: in Hungary, NAIH (Nemzeti Adatvédelmi és Információszabadság Hatóság, naih.hu); elsewhere in the EU, your local authority; in the UK, the ICO. Judicial remedy is also available.

8. If you are a Guest

In short: your host put you on their guest list; we only use your details to run their RSVP, and you can see, fix or remove them.

Your data (name, contact, and your own survey answers) came from your host — the person organizing the wedding — or from you, when you filled in the survey. We process it solely so your host can administer their event: your invitation status, headcount, dietary needs (only if you choose to share them — you may leave those blank), accommodation and transport needs. We never use your data for advertising and never contact you for any purpose other than the wedding you were invited to. Your data is deleted per Section 6. You may at any time ask us or your host to access, correct or delete your data ([email protected]); note that deletion may mean your host has to manage your RSVP outside the app. Full rights: Section 7.

9. US residents (CCPA-style disclosures)

In short: we don't sell or share your data, and you have the usual California-style rights even though we're likely below the legal thresholds.

DBRSZ-2022 Kft. does not "sell" or "share" personal information as defined by the CCPA/CPRA, and processes no sensitive personal information except as described in 2.1 (used only to provide the service, never for inference). California and other US-state residents may exercise access, deletion and correction rights via [email protected]; we do not discriminate for exercising rights. Categories collected: identifiers, commercial information, internet activity, and the content you provide — as detailed in Section 2.

10. Security

Encryption in transit and at rest, access controls and least-privilege permissions, webhook signature verification, provider DPAs, regular backups, and staff confidentiality obligations. No system is perfectly secure; incidents affecting your rights will be notified per GDPR Arts. 33–34.

11. Children

Accounts require age 18+. We do not knowingly collect data from children as users. Guest records may include minors (e.g., a family's children for headcount and meals) — entered by the responsible adult host, used only for event administration, and deleted per Section 6.

12. Plans from AI assistants, the connector and API keys

In short: your AI assistant can hand your plan to Nupty. Until you sign up and save it, it stays in your browser; we never see your chat; and you decide what an assistant or a key may do with your plan.

12.1 What a hand-off contains. When you ask an AI assistant (such as ChatGPT, Claude, Gemini or Le Chat) to send your plan to Nupty, it gives you a link or a block of text. It can hold your names, the date or season, the region, a guest count, a budget and currency, what matters most to you, vendor ideas, a guest list (names, plus-ones, number of children), moments of the day and to-dos. We do not accept guests' e-mail addresses or phone numbers, dietary, health or religious details, web links or files, or your conversation with the assistant. If an assistant sends any of these, they are left out, and the preview tells you so.

12.2 Before you sign up, the plan stays with you. In a link, the plan sits after the "#", a part of the address that browsers do not send to any server. A pasted plan is read the same way. Either way it is checked and shown to you in your browser only. If you continue to sign-up, your browser keeps the plan on your device for up to 7 days so you can finish, and then deletes it; "Delete this draft" removes it at once. None of the plan's content reaches us until you are signed in and press "Save to my planner"; before that we only receive the counts described in 12.6.

12.3 When you save it. The plan is sent to us once, checked again and added to your planner. From then on it is ordinary wedding data (Section 2): your part is processed to provide the Service (Art. 6(1)(b)), and guest names as described in Sections 3 and 8. To make sure a double click or a second device does not add the same plan twice, we keep a short claim record (which account claimed which hand-off) for 24 hours; it is then deleted automatically. We also note on your workspace which assistant the plan came from and how (for example "ChatGPT, link"), so we can tell how people find us; this note contains no plan content.

12.4 The Nupty connector. Where Nupty offers an app or connector for an AI assistant, you connect it yourself: you sign in to Nupty and approve the access on a consent screen. The access is limited to your own wedding plan and to what that screen lists (for example reading your guest list or adding to-dos). It never covers billing, payments, your account settings or anyone else's data. You can disconnect it at any time in Settings or in the assistant, and the access ends at once. What the connector reads from your plan is passed to the assistant because you asked for it.

12.5 API keys. In Settings you can create personal API keys so that a script or an AI agent can read, or read and change, your own wedding. A key is shown once; we store only a fingerprint of it, never the key. A key can never reach billing, account deletion, key management, sending invitations or other couples' data. Changes made with a key appear in your activity log (kept for 365 days). Revoking a key in Settings stops it immediately. Please keep your keys secret: anyone holding a key can do what it allows until you revoke it.

12.6 Usage events. To see whether this feature works and to spot abuse, our servers record short technical events: a plan was opened, whether it could be read, sign-up was started, a plan was saved, a saved plan was used within 7 days, an API key or the connector was used (or refused, or rate-limited), and an automated agent (such as GPTBot or ClaudeBot) read our public documentation for AI assistants. These events contain only categories and counts (which assistant, link, paste or connector, how many guests or to-dos) and one-way pseudonymous codes in place of account and key identifiers. They never contain names, e-mail addresses, IP addresses or anything written in your plan. They are kept in our own logging system at our hosting provider in the EU (Hetzner, Germany) for 14 days. Our product analytics (PostHog, Section 4) receives the same kind of counts. Legal basis: Art. 6(1)(f), our legitimate interest in running, improving and protecting the Service; you can object at [email protected].

12.7 The assistant is not Nupty. What you tell an AI assistant is between you and its provider (for example OpenAI, Anthropic, Google or Mistral) and is governed by their own terms and privacy policies, including how long they keep your conversation and whether they use it. We only receive what is handed to us as described above, never the conversation itself, and we do not use plans received this way to train AI models.

13. Changes

We will notify account holders of material changes in-app or by e-mail at least 15 days before they take effect. Effective date of this version: 2026-08-08.