Privacy policy

Data controller

The controller for data collected through this site is Cécile Missol EI, 25 Bd des Dames, 13002 Marseille, France, reachable at hello@unfurlme.love (data protection contact: hello@unfurlme.love).

For their guests' RSVP replies, the couples using the service are themselves the controller of that data towards their guests: Cécile Missol EI then acts as a processor, on the couple's behalf, to collect, display and export those replies.

Data we collect

Purchase activation: the Etsy order number and email address entered on the activation page, to verify the purchase and create access.

Account and sign-in: an email address (there is no password; sign-in uses a single-use magic link emailed to you).

Invitation content: text, dates, venue details and photographs the couple enters or uploads themselves to build their invitation.

Guest replies (RSVP): name, email address (optional, depending on the couple's settings), attendance, number of guests, dietary needs and a message, plus a non-reversible hash of the replying IP address used to throttle abuse (the raw IP address is never stored).

No payment or banking data is ever collected on this site: payment for the initial purchase happens entirely on Etsy.

Purposes and legal bases

Performance of the contract with the buyer: verifying the purchase, creating and hosting the invitation, sending sign-in links and service notifications (GDPR Article 6.1.b).

Managing RSVP replies on the couple's behalf, based on performing the service the couple set up for their own guests (Article 6.1.b and, for the relationship between the couple and their guests, the couple's legitimate interest in organising their event).

Security and abuse prevention (per-IP rate limiting, detecting fraudulent activation requests): legitimate interest (Article 6.1.f).

Who receives this data

Data is processed by Cécile Missol EI and by the following technical processors: Cloudflare, Inc. (application hosting, the D1 database and R2 photo storage) and Resend (Resend, Inc., transactional email delivery: sign-in links, activation confirmations, RSVP notifications).

This data is never sold, rented, used for advertising, or shared with any other third party beyond what the law requires.

Hosting and transfers

Application hosting and photo storage (Cloudflare R2, EU jurisdiction) are provided within the European Union. The database (Cloudflare D1) is configured with a Western Europe location hint; as of today this remains a technical indication rather than a strict contractual residency guarantee outside a Cloudflare Enterprise plan — this nuance is stated here in full transparency.

Resend, our transactional email provider, may process recipient email addresses to deliver messages; consult its privacy policy for the safeguards that apply to any transfer outside the EU.

Retention periods

Rejected or unconfirmed activation requests: kept for up to 12 months for evidence and anti-abuse purposes, then deleted.

Account and invitation: kept for the hosting period included with the purchase (18 months from publication), then deleted unless the couple separately purchases a renewal.

Guest replies (RSVP): kept for 6 months after the event date entered by the couple, then automatically deleted, unless the couple requests earlier deletion.

Admin audit log (activation approvals and refusals): kept for 3 years, for evidence and service security.

Security

Passwordless sign-in (a single-use, short-lived magic link), encryption in transit (HTTPS), salted hashing of IP addresses kept for anti-abuse purposes, and access control on the admin back office all reduce the risk of unauthorised access. No system is infallible; any significant data breach will be notified in accordance with GDPR Articles 33 and 34.

Cookies and trackers

This site sets no advertising cookie and no third-party audience-measurement tracker. Only cookies strictly necessary for the service are used: a sign-in session cookie (Better Auth), a language-preference cookie, and a technical cookie remembering that the personal-data information banner has been read. These cookies do not require prior consent and never track you across other sites.

Your rights

Under the GDPR, you have the right to access, rectify, erase and restrict the processing of your data, as well as a right to data portability and a right to object on legitimate grounds. To exercise these rights, write to hello@unfurlme.love or hello@unfurlme.love describing your request; you will receive a reply within one month.

You also have the right to lodge a complaint with the competent supervisory authority — in France, the CNIL (www.cnil.fr) — if you believe your rights are not being respected.

If you are a guest and wish to exercise your rights over an RSVP reply you submitted, you may contact the couple who created the invitation directly, or write to hello@unfurlme.love, who will forward your request.

Contact

For any question about your personal data: hello@unfurlme.love or hello@unfurlme.love.