Privacy policy

1. Who is responsible for data

Хендекс ЕООД, Company ID 208780173, Bulgaria, 4002 Plovdiv, Zapaden district, 6 Bratiya Street, floor 3. Email: office@hoskay.com. Phone: +359 89 249 6435.

This policy covers Wedding Studio. For accounts, correspondence and our contractual obligations, the controller is Хендекс ЕООД. For guest data determined and managed by a couple for their event, processing roles and terms are agreed before the customer service is activated.

2. What data we use and why

• Name, email, account and authentication details — for sign-in, support and security. Passwords are handled by the authentication provider; we do not store them as plain text in our own database.
• The couple's names, date, programme, venues and design — to create the invitation and organise the event.
• Guest details and responses — for example names, attendance and preferences entered by the organiser or by a guest through a personal invitation.
• Photos, an optional uploader name and file details — for the photo gallery. The uploader's name is visible only to the organiser. Approved photos can be viewed through a separate shared link.
• When payments are enabled: package, amount, status and payment identifier. Card details are entered with the payment provider.
• Support messages and limited technical data for security and troubleshooting.

3. Legal bases and choice

We use necessary data to perform a contract or requested pre-contractual steps, meet legal obligations, and pursue legitimate interests in security and protecting rights. Where consent is required, it must be separate and voluntary and can be withdrawn. Health data, including allergies, requires an appropriate basis under the special rules; an explicit consent flow is being prepared before the public customer service opens. You can give this information directly to the organiser instead of through the platform.

4. Who can view content

The organiser controls their wedding data and sharing. Recipients of personal invitations and photo links can view the content accessible through them. We share data with technical providers only for the relevant service, and with competent authorities where required by law. We do not use guest lists for advertising campaigns or sell guests as advertising audiences. Using photos in our marketing requires a separate lawful basis.

5. Technical providers and international transfers

The working website uses OpenAI Sites for hosting and access, and Cloudflare for execution, database and files. Supabase for customer authentication and Stripe for payments are prepared but are not yet enabled for customers. Data may also be processed outside the EEA depending on the provider; applicable agreements and international transfer safeguards will be confirmed before public customer service. We do not promise storage exclusively in Bulgaria.

Provider policies: OpenAI, Cloudflare, Supabase, Stripe.

6. Retention periods

For the forthcoming paid packages, invitations and wedding photos will be retained for up to 6 months after the wedding date. Save any photos and data you need on your own device before this period ends. Automatic access expiry and deletion under this policy are being prepared before the paid service opens; the current private working project does not automatically delete data by date.

In the current working project, data is retained until the work is complete or a deletion request is fulfilled. For the forthcoming service, accounts and support correspondence are kept as needed for the contract; accounting records and evidence of rights are kept for the applicable statutory period. Deleting content does not automatically erase information we are legally required to retain. Request specific information about your data at office@hoskay.com.

7. Your rights

Where applicable, you may request information, access, correction, deletion, restriction and portability, and object to processing. Send requests to office@hoskay.com. We respond within GDPR time limits and may verify your identity without requesting unnecessary data. You have the right to complain to the Commission for Personal Data Protection. We do not carry out automated guest profiling or decisions with legal effects.

8. Photos, children and security

Upload photos and data only with an appropriate lawful basis, particularly concerning children and other guests. Do not publish unnecessary information. Safeguards include access checks, personal gallery links and approval before photo sharing. No system guarantees absolute security. If you suspect a link has been shared improperly, disable or replace it and contact us.

9. Cookies and changes

Details are in the cookie policy. Changes to this policy are published with a date. We will provide the necessary information before using data for new purposes.