Privacy Policy

Who we are

Latido (“we”, “us”) operates this wedding-planning service. The data controller is [TODO: legal company name], registered at [TODO: address], company number [TODO], contact [TODO: privacy@yourdomain]. [TODO: appoint a Data Protection Officer / EU representative if required.]

What data we collect

• Account data: your name, email, phone, and authentication identifiers.
• Wedding content you create: guest list (names, contact details, RSVP status, plus-ones and dietary requirements — which may be health data), seating plans, budget, timeline, documents, and messages.
• Vendor data: vendor business details and contact people you add or engage.
• Marketplace listings: some venue/vendor listings are created from public sources (see below).
• Technical data: essential cookies, basic server logs, error diagnostics (Sentry — stack traces without your IP or personal details), and cookieless product-usage analytics (OpenPanel, hosted in the EU — which features are used, tied to your account ID, never to guest data or message content; legitimate interest in improving the service). We do not run advertising.

Why we use it & our lawful bases (GDPR Art. 6)

• To provide the service to you and your collaborators — performance of a contract.
• Guest & vendor data you upload — our legitimate interest in letting you plan your wedding; you are responsible for having a basis to share other people’s data.
• Dietary/health data — processed only to help you cater your event; [TODO: confirm the appropriate Art. 9 condition with counsel].
• Marketplace seeded listings — legitimate interest in operating a marketplace, balanced against the businesses’ rights.
• Security, legal compliance, and (if you opt in) Latido AI.

Who we share data with (sub-processors)

We use the following processors to run Latido. Each is bound by a data-processing agreement. [TODO: confirm a current DPA and a valid EU→US transfer mechanism for each US provider.]

Latido AI

If you use the optional “Latido AI” feature, the relevant vendor and wedding context is sent to Anthropic (Claude) to draft text you then review before saving. [TODO: confirm Anthropic’s DPA and a no-training / limited-retention commitment.] We never train models on your data ourselves.

International transfers

Some providers are outside the EEA (see table). Where that happens we rely on an adequacy decision or appropriate safeguards. [TODO: confirm mechanism per provider.]

How seeded marketplace listings work

Some listings were created from publicly available business information (including OpenStreetMap, © OpenStreetMap contributors under the ODbL) to help couples discover suppliers. We hold only minimal factual business information (name, public address, category, website). Such listings are not indexed by search engines until claimed, and a business can claim, correct, hide, or request removal from its listing page. We process this under legitimate interest, balanced against the businesses’ rights.

How long we keep it

We keep your data while your account is active and for a reasonable period afterwards, then delete or anonymise it, unless the law requires longer retention. [TODO: define concrete retention periods.]

Your rights

• Access, rectify, erase, restrict or object to processing, and data portability.
• Download a copy of your data and request account deletion from Settings → Privacy & your data.
• Withdraw consent at any time where processing relies on consent.
• Lodge a complaint with your supervisory authority — in Hungary, the NAIH (naih.hu). [TODO: confirm lead authority.]

Cookies

We use only essential cookies plus Google Maps on map pages. See our Cookie Policy.

Children

Latido is intended for adults. Guests you add may include minors; you are responsible for the lawfulness of including their data.

Changes & contact

We may update this policy and will note the date above. Questions: [TODO: privacy@yourdomain].