Privacy

The short version

There are no accounts here. Typing your names into this site stores them in your own browser and nowhere else.

They reach us in two cases, both of which you choose: if you ask us to email you your preview, or if you decide to buy.

What stays in your browser

When you put your first names, your wedding date and a chosen design into the preview, we save them in your browser's local storage under a single key, aea.couple, so the page still knows them when you come back.

That entry never leaves your device on its own. It is not sent to us, it is not readable by anyone else, and clearing site data for this site removes it.

Your choice of language is stored the same way, under aea.locale.

If you ask us to email you your preview

Under the preview there is an optional field. Nothing on this site is withheld until you fill it in, and the preview works whether you do or not. While payment is not open, the same field appears beside the price, so that you can ask to be told when it is.

If you enter an address and tick the box, we store that address, the first names and date already in the preview, the design you were looking at, your language, which of the two tiers you had chosen if you asked from beside the price, and the moment you ticked the box. We store it so that we can send you the link and, if you have not bought, write to you once or twice about it.

We also store a salted, one way hash of your IP address, in order to stop the same machine submitting the form hundreds of times. The address itself is not stored and the hash cannot be turned back into it.

The legal basis is your consent, Article 6(1)(a) GDPR. You may withdraw it at any time by replying to any message we send, or by writing to the address in the legal notice, and we delete the entry. Withdrawing is as easy as giving it was.

An entry that never becomes a purchase is deleted after twelve months.

Cookies

This site sets no cookies. There is no cookie banner because there is nothing to ask you about.

Stripe's checkout runs on Stripe's own pages and sets cookies there. Stripe's privacy notice covers those.

What we measure

We count a small number of events, such as a page being reached or a checkout being started, so we know whether the page works.

The measurement is first party and cookieless. It sets no identifier, it builds no profile, and it cannot follow you to another site.

No advertising network, no social network and no third party analytics service is embedded in this site.

Server logs

Our hosting provider records ordinary access logs, including the IP address that made a request, in order to serve the page and to defend against attacks. Those logs are short lived and we do not use them to build a picture of a visitor.

When you buy

Checkout is Stripe's hosted page. You give Stripe your email address and your payment details.

Stripe tells us that the payment succeeded, gives us your email address and the amount, and we send it the names, the date and the design you chose here, so that your invitation can be built and the link emailed to you.

Stripe processes payment data as an independent controller under its own privacy notice, and in the United States as well as in the EU. Its transfers rest on the European Commission's standard contractual clauses.

If you send a commission brief

A commission brief arrives as an email and is read by a person. It is kept while the project runs and deleted when it closes.

How long we keep things

Records of a purchase are kept for as long as tax law requires, which in Germany is up to ten years.

Measurement is aggregated and holds nothing that points to a person.

Legal basis, for readers in the EU

Building and delivering your invitation, and taking payment for it, rest on Article 6(1)(b) GDPR, the performance of a contract.

Cookieless measurement and defence against attacks rest on Article 6(1)(f) GDPR, our legitimate interest in a service that works and stays up.

Keeping records of a sale rests on Article 6(1)(c) GDPR, a legal obligation.

Your rights

In the EU and the UK you have the right of access, rectification, erasure, restriction, data portability, and the right to object, under Articles 15 to 21 GDPR. Write to the email address in the legal notice; no particular form is needed, and we answer within a month.

You may also complain to a data protection supervisory authority, normally the one where you live.

In the United States, we do not sell or share personal information, and we do not use it for cross context behavioural advertising.

Children

This service is sold to adults. We do not knowingly collect anything from a child.