Privacy Policy

1. Data controller

WEB APPS ARTISAN S.R.L., with registered office at Ale. Socului nr. 2, București, România (tax ID 49809200), is the controller of personal data collected through the waa.events platform, in accordance with Regulation (EU) 2016/679 (GDPR).

Data protection contact: support@waa.events

2. What data we collect

We collect the following categories of data:

• Account data: email address, name, phone number (optional)
• Invitation data: event name, location, date, personalised messages, uploaded photos
• RSVP data: names and responses of guests (attendance confirmations)
• Technical data: IP address, browser type, operating system, pages visited, session duration
• Payment data: processed securely through third-party providers — we do not store card details

Guests' data (names, phone numbers, emails, answers and notes) reaches us from the organizer, who fills in the guest list, and from the guests themselves, when they reply to the invitation. We process it to deliver the organizer's invitation — showing it, the replies, reminders and check-in — and we permanently delete it at the first of these moments: 30 days after the organizer deletes the event (until then the event can be restored), 90 days after the date of the event, or together with the organizer's account.

3. Purpose and legal basis for processing

We process your data for:

• Providing services — performance of contract (Art. 6(1)(b) GDPR)
• Account management — performance of contract (Art. 6(1)(b) GDPR)
• Service communications (confirmations, notifications) — performance of contract (Art. 6(1)(b) GDPR)
• Legal obligations (invoicing, archiving) — legal obligation (Art. 6(1)(c) GDPR)
• Platform improvement — legitimate interest (Art. 6(1)(f) GDPR)
• Writing assistant (optional) — generating, rewriting and translating invitation text with an AI provider, at your request — performance of contract and legitimate interest (Art. 6(1)(b) and (f) GDPR)

4. Recipients of data

Your data may be shared with:

• Cloud and infrastructure service providers (hosting, CDN)
• Authorised payment processors
• Transactional email services
• Artificial-intelligence service providers — for the writing assistant, only when you use it (see below)
• Public authorities, where required by law

We do not sell your personal data to third parties.

AI writing assistant (optional): when you use the feature to generate, rewrite or translate invitation text, the text of that field, the language code and a non-personal context hint (e.g. "the reception section") are sent to an artificial-intelligence service provider (for example Anthropic, OpenAI or Google, depending on the active configuration) to produce the suggestion. We do not send your account data or any personal data beyond the text you are editing. Under these providers' terms for API services, the text is not used to train their models, and retention at the provider is limited. The feature is optional: if you do not use it, no text is sent to these providers.

5. International transfers

Some service providers may be located outside the European Economic Area. Transfers are carried out with appropriate safeguards (standard contractual clauses approved by the European Commission or adequacy decisions).

The artificial-intelligence service providers used for the writing assistant may be located in the United States; transfers are carried out with the same appropriate safeguards.

6. Retention period

• Account data: for as long as the account exists. If you ask for its deletion, the account stays active for 14 more days, during which you can cancel the request; then the account and its data are permanently deleted.
• Invitations and their content (texts, photos): at most for as long as the account exists. When the account is deleted, the invitations stop working, and the texts and photos are permanently deleted.
• Guests' data (their names, phone numbers, emails, answers and notes, check-in arrivals and the announcements sent to them): 90 days after the date of the event. If the organizer deletes the event, the invitation can no longer be opened or answered; the guests' data is kept for 30 more days, while the event can still be restored, and is then permanently deleted. If the organizer deletes their account, it is deleted with it. Whichever of these comes first applies.
• Invoices: invoices and the billing details on them (name, address, email and, if you gave them, tax ID or national identification number and phone number) are kept for 10 years from the end of the financial year in which they were issued, including after the account is deleted, and are not anonymised (legal obligation). Together with them we keep the evidence of the country you paid from that VAT requires, including the IP address used at payment.
• Technical logs: about 30 days.
• Backups: we do not alter them after a deletion; they are replaced over time and expire within 9 months at most.

7. Your rights

Under GDPR, you have the right to:

• Access — request a copy of the data being processed
• Rectification — correction of inaccurate data
• Erasure — the "right to be forgotten", under the conditions set by law
• Restriction — limiting processing in certain situations
• Portability — receiving your data in a structured format
• Objection — to processing based on legitimate interest
• Withdrawal of consent — without affecting the lawfulness of prior processing

You can ask for your account's deletion directly in your account, under Security. It takes effect after 14 days, unless you cancel it in the meantime. There you can also download a file with your account data, events, payments and consents.

To exercise your rights, contact us at support@waa.events. You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) — www.dataprotection.ro.

8. Data security

We implement appropriate technical and organisational measures to protect data: HTTPS encryption, restricted access, continuous monitoring. In the event of a security incident affecting your data, you will be notified in accordance with legal requirements.

9. Cookies

We use cookies and similar technologies. Details in the Cookie Policy.

10. Changes to this policy

We may update this policy periodically. The date of the last update is shown at the beginning of this document. Continued use of the platform after changes are published constitutes acceptance of those changes.