Privacy Policy

Grá is a mobile wedding planning and guest experience application. We take the privacy of everyone who uses or is connected with Grá very seriously.

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights in relation to that data. It applies to the Grá mobile application, our website, and any associated services.

Grá is committed to full compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Irish Data Protection Acts 1988–2018. Our supervisory authority is the Data Protection Commission (DPC) of Ireland.

Data Controller: Lon Dubh Design Registered Address: 20 Bawnogue View, Kilkock, Kildare, Ireland Data Protection Contact: privacy@londubhdesign.ie

For any privacy-related queries, requests, or concerns, contact us at privacy@londubhdesign.ie or write to us at our registered address.

Grá involves several distinct categories of users, each with a different data relationship with us.

Host Data (Couples): When you register as a host and create a wedding event, we collect name, email address, wedding date, venue details, guest list data you upload, budget information, seating plan data, photos and media, communications via the Wedding Buzz feed, and vendor and planner booking information. Lawful basis: Performance of contract (Article 6(1)(b) GDPR).

Guest Data: Host-uploaded guest data is processed on the host's behalf as a data processor. If you create a Grá account, we collect your email address, login credentials, and any additional information you voluntarily provide. Lawful basis: Legitimate interest (host-uploaded data) and contract (guest account data).

Vendor Data: Business name, contact details, profile information, portfolio images, service descriptions, and booking and communication data. Lawful basis: Performance of contract and legitimate interest.

Planner Data: Business name, contact details, profile information, portfolio images, service descriptions, and event management data relating to client events. Planners may access guest data for the sole purpose of managing events on behalf of hosts. Lawful basis: Performance of contract and legitimate interest.

AI Assistant Data: When you use the in-app AI assistant (Cara), your messages and the assistant's responses are processed to deliver the feature and are stored against your account. Token usage is recorded for billing and quota management purposes. Lawful basis: Performance of contract.

Host account data: Your personal data is permanently deleted and your account is anonymised immediately upon account deletion. All event data associated with your account is permanently deleted at the same time.

Event data (guest lists, seating plans, RSVPs, budget, photos): Retained for 60 days after the wedding date, then permanently deleted. A paid Data Retention subscription is available to extend this period.

Guest account data: Your personal data is permanently deleted and your account is anonymised immediately upon account deletion. Your guest list entries on surviving events are anonymised at the same time.

Vendor and planner account data: Your personal data, profile, portfolio, and all associated storage assets are permanently deleted immediately upon account deletion.

AI assistant conversation data: Retained for the duration of the associated event, then deleted in line with event data retention policy.

Message board posts: Posts you have made to event message boards are anonymised upon account deletion. The content of posts is retained as part of the event record but is no longer associated with your identity.

Payment transaction records: Retained for 7 years in accordance with Irish tax and accounting requirements.

Audit records: An anonymous record containing no personal data is retained indefinitely for internal integrity and compliance purposes. This record contains only a random identifier, the roles you held, and a count of records affected at the time of deletion.

You may delete your Grá account at any time through the app settings. Account deletion is immediate and irreversible. The following actions are taken at the point of deletion:

All users: Your name, email address, phone number, and other personal identifiers are permanently deleted. Your account is anonymised — an internal identifier is retained solely for audit and integrity purposes and cannot be used to identify you.

Hosts: All event data you own, including guest lists, seating plans, RSVPs, budget information, photos, and communications, is permanently deleted immediately.

Cohosts: Your association with any events you were co-managing is removed. Guest list entries on those events are anonymised.

Guests: Your guest list entries on surviving events are anonymised. Any seating assignments or gift reservations associated with your account are released and the event host is notified.

Vendors: Your vendor profile, portfolio, services, and all associated media are permanently deleted. Hosts with confirmed bookings are notified.

Planners: Your planner profile, portfolio, and all associated media are permanently deleted. Hosts of events you were managing are notified.

If you wish to have your information removed from a host's guest list before deleting your account, contact the event host directly. For any other erasure requests, contact us at privacy@londubhdesign.ie.

You retain copyright in any photographs or content you upload to Grá. By uploading content to an event, you grant the event host and other authorised participants a non-exclusive, royalty-free licence to view and download that content within the Grá platform for the duration of the event and the 60-day post-event retention period.

Photographs of identifiable individuals constitute personal data under GDPR. Any person who appears in a photo may request its removal by contacting privacy@londubhdesign.ie. We will review and action such requests within 72 hours.

We do not sell your personal data. We share data only with:

• Supabase (our infrastructure provider) for data storage and processing within the EEA • Stripe for processing payments securely • TBC for the purpose of delivering in-app AI assistant features • Vendors and planners you choose to interact with • Law enforcement or regulatory authorities where required by law • In the event of a business transfer, with advance notice to you

As a data subject, you have the following rights:

• Right of access: request a copy of your personal data • Right to rectification: request correction of inaccurate data • Right to erasure: request deletion of your personal data • Right to restriction: request that we restrict processing • Right to data portability: request your data in a machine-readable format • Right to object: object to processing based on legitimate interest • Right to withdraw consent: where processing is based on consent

To exercise any of these rights, contact privacy@londubhdesign.ie. We will respond within 30 days. You have the right to lodge a complaint with the Data Protection Commission at www.dataprotection.ie.

Grá is not intended for use by persons under the age of 18. We do not knowingly collect data from minors. RSVP responses on behalf of children are submitted by a parent or guardian.

We implement appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, access controls, and regular security reviews. Our infrastructure is hosted by Supabase with EU data residency.

Email: privacy@londubhdesign.ie Data Protection Commission: www.dataprotection.ie | 01 765 0100