Privacy Policy

1. Data controller

The data controller is FRAIM ApS, CVR no. 46713893, Vestbanevej 10, 2. tv, 2500 Valby, Denmark. Contact: hej@fraim.dk.

2. What we collect

• Account data: name, email, password hash, and workspace membership.
• Planning data: the content you add: guests and their RSVP/dietary details, budgets, vendors, seating, schedules, notes, and designs.
• Guest data: information you and your guests enter via RSVP links and the shared photo album.
• Payment data: handled by our payment provider; we store only the resulting entitlement status, not card numbers.
• Technical data: basic logs needed to run and secure the Service.

3. Why we use it & lawful basis

• To provide the Service (contract, Art. 6(1)(b)).
• To secure and improve the Service and prevent abuse (legitimate interests, Art. 6(1)(f)).
• To send service emails and, when a couple chooses it, text messages such as invites and RSVP notifications (contract / legitimate interests).
• For the Lucia AI assistant, only where you opt in per workspace (consent, Art. 6(1)(a)).
• To meet legal obligations (Art. 6(1)(c)).

4. Sharing & sub-processors

We do not sell personal data. We share it with vetted processors who act on our instructions:

• Stripe: payment processing.
• Resend: transactional email delivery.
• GatewayAPI: text-message (SMS) delivery, when a couple sends a guest their invitation by SMS. GatewayAPI processes the data in the EU; the message itself is delivered through the recipient's mobile carrier.
• Hetzner: hosting of the Service, and object storage for photos and attachments. Both in Finland (EU).
• Google (Gemini): AI processing. Your conversation data is sent to the model provider when you use the optional Lucia assistant. The same provider also processes the text of a supplier web page when you use "import from link" to prefill a record, and the draft text of a supplier message when you ask us to polish it before you send it.

See the Data Processing page for the processor terms.

5. AI features

Lucia is an AI assistant built on Google's Gemini model. She is off by default and each person in a workspace turns her on for themselves; that opt-in is your consent (Art. 6(1)(a)) and you can withdraw it at any time. When she is on, what you say or type, the page you are on, and your first name are sent to Google to generate her reply. Her replies are AI-generated, and the voice is synthetic audio.

We do not store your conversations with Lucia. They exist only in your browser for the length of the session. There is no conversation history on our servers, and Google processes them transiently to produce the reply. We deliberately keep the guest data she is shown to a minimum: guest email addresses, phone numbers and dietary notes are never included in what we send to the model.

Two smaller features use the same model without a voice assistant: importing a supplier from a web link sends that page's text for extraction, and polishing a supplier message sends your draft. Both run only when you trigger them.

6. Dietary and allergy information

Dietary and allergy notes can reveal health data or religious beliefs, which the GDPR treats as a special category (Art. 9). We ask guests to provide this about themselves through the RSVP form, behind a separate, explicit consent tick that names what it is for. That consent is our Art. 9(2)(a) condition. It is used only to plan catering for the wedding, is visible to the couple and their collaborators in the workspace, is never sent to the AI model, and is deleted when the guest clears it, declines the invitation, removes themselves, or when the workspace is deleted. A guest can withdraw this consent at any time without affecting their RSVP.

7. Beta waiting list

When you join the beta waiting list at justsayyes.dk/en/beta, we process your details to invite you to the beta and to tell you about it.

• Data: email address, your names, wedding date (if you have one), language, where you heard about us, which post brought you to the page (campaign parameters in the link), and when you consented, confirmed, were invited and created an account.
• Basis: your consent (GDPR Art. 6(1)(a)), given in the form and confirmed by clicking the link in our mail.
• Retention: a sign-up that is never confirmed is deleted automatically after 30 days. Confirmed sign-ups are deleted no later than 6 months after the beta ends, or earlier if you ask. If you create an account, the rest of this policy applies to the account.
• Withdrawal and erasure: you can withdraw your consent and have your sign-up deleted at any time by writing to hej@fraim.dk. This does not affect processing before you withdrew.

Usage statistics, error log and feedback

• Usage statistics: when you use the app, on the web or in our iPhone app, we record which pages or screens you open and roughly how long they stay open, with your account, your wedding, the kind of device (computer, phone or tablet) and whether it was the web or the iPhone app. We use it only ourselves, to see which parts of the Service are used and where people get stuck. No third-party analytics, no advertising identifiers, no IP address and nothing you write. Legal basis: our legitimate interest in improving the Service (Art. 6(1)(f)); you can object at any time by writing to us.
• Error log: when something fails on our servers we record the page, the time and a technical error message with email addresses, phone numbers, ids and quoted values removed. It is not linked to you or your wedding and is deleted 90 days after the error was last seen.
• Feedback you send us: the message, its kind (bug, translation, idea), your optional answers about what went wrong, any screenshots you attach or capture, the page or screen you were on, your device, browser or app version and language, and the element or text you pointed at, together with your account and wedding so we can reply. Feedback is a conversation: your replies and ours are kept with it, and we email you when we have answered. A screenshot shows what was on your screen, which can include your guests' names, so attach one only when you are happy for us to see it. To fix a problem we may copy the description and page into our private issue tracker at GitHub (USA, certified under the EU–US Data Privacy Framework), never your name, email address or screenshots. Handled conversations, with their replies and screenshots, are deleted 24 months after the last message.

8. International transfers

The Service is hosted, and your wedding photos and files are stored, with Hetzner in Finland (EU). Three of our processors may handle personal data outside the EEA, including in the United States: <strong>Stripe</strong> (payments), <strong>Resend</strong> (email delivery) and <strong>Google</strong> (the optional Lucia assistant, the “import from link” prefill, and polishing a draft message). For those transfers we rely on the safeguards set out in each provider’s own data processing agreement: the EU Standard Contractual Clauses and, where the provider is certified under it, the EU–US Data Privacy Framework.

9. Retention

We keep workspace data for as long as your workspace is active and as needed to provide the Service. Disposable-camera photos follow their own access window (with optional paid extensions). Beyond that we apply fixed limits: usage statistics are stripped of any link to you after 13 months and deleted after 25 months; the workspace activity history is deleted after 24 months; expired login sessions, guest RSVP links and camera links are deleted 30 days after they expire; the phone number on a text message sent to a guest is erased from our send log 90 days after sending; and an abandoned sign-up draft is deleted after 90 days. Server error records are deleted 90 days after the error was last seen, and handled feedback conversations, with their replies and screenshots, 24 months after the last message. You can ask us to delete your workspace; we will delete or anonymise data except where we must retain it by law.

10. Your rights

Under the GDPR you have the right to:

• access, rectify, or erase your personal data;
• restrict or object to processing;
• data portability;
• withdraw consent (e.g. turn off Lucia) at any time;
• lodge a complaint with the Danish Data Protection Agency (Datatilsynet).

To exercise these rights, contact hej@fraim.dk.

11. Cookies

We use a small number of essential cookies. see the Cookie Policy.

12. Children

You must be at least 18 to create an account. Guests are a different matter: a guest list can include children, and a guest entry may hold a child’s name and their dietary requirements or allergies. That information is entered by the couple or by the guest’s own household, and the couple decides what to ask for. We do not knowingly collect any other personal data about children, and we use it only to run the wedding. If you believe a child’s data is held here and should not be, contact us and we will delete it.

13. Changes

We will post any updates here with a new "last updated" date and notify you of material changes.