Privacy policy

Who is responsible

Lysela (sole trader), company registration number 19921023-3855, is the data controller for information about visitors to this site and about you as someone who buys a wedding page. Questions about personal data go to info@lysela.se.

For guests' data on a finished wedding page, the couple is the data controller. We process it on the couple's behalf as a data processor, under the data processing agreement. We are responsible ourselves for security on the platform and for deletion on the timeline below. If you are a guest and have questions about your data, you can contact the couple or us directly.

Visiting this site

This site does not set cookies for tracking or advertising, so there is no cookie banner. Here is what happens when you visit it:

• Visit statistics. When statistics are switched on we use Plausible, which counts page views without cookies and without storing IP addresses. We can see how many people open an example or reach the pricing page, not who.
• Spam protection in guest forms. The forms on couples’ pages (RSVP, guestbook, song wishes and carpooling) use Cloudflare Turnstile to stop automated spam. Cloudflare sees your IP address and some browser signals for that check, but sets no tracking cookies. All we learn is whether the check passed, nothing about you.
• Error reporting. If something breaks, a technical error report is sent to Sentry: which page, which browser, what went wrong. The report can include your IP address and is deleted after 90 days. It never includes what you have written in a form.
• RSVP replies. When a guest has replied, the day is saved in the guest's browser, so the site can show that the reply arrived. Names and answers are not saved there.
• The examples. The RSVP forms in the examples send nothing. The couples are fictional and what you write there never leaves your browser.
• Trying a page. What you make while trying a wedding website stays in your browser. If you choose to save the page, you get an account with your email address, and the page’s text and choices are stored with us so that you can carry on from another computer or phone. The page is saved when you enter your address, before you have signed in, and the button in the email opens it for 30 days for whoever has the email. Photos stay in the browser. If you never sign in, the account is deleted after 30 days, and a saved draft nobody has changed for a year is deleted together with the account. While signed in you can delete the account yourself at once. Basis: the contract with you, since you asked us to save the page. If you tick that you want email from us, we send tips before the wedding and reminders about your page until you stop them, with the link in the emails, in the editor or by deleting the account. Basis for those emails: your consent, and we keep a record of when you gave it. We also keep a record of which of the emails we have sent, so that nobody gets the same one twice, and it is deleted with the account. We cannot see who opens the emails or clicks the links in them.
• Email to us. If you write to us, we keep the message for as long as we need it to reply and follow up, and for no more than two years.

The legal basis for statistics and error reporting is our legitimate interest in understanding and running the site. For email, the basis is answering your question.

Purchase and account

When you buy a wedding page, we handle:

• Account details: name and email address, and the email address of the partner you invite. No passwords: you sign in with a link or code in the email, with Google or with Facebook. Basis: the contract with you.
• Purchase details: the tier chosen, price, time, receipt, and your choice about the right of withdrawal. Payment is handled by Stripe, which is independently responsible for the card details; we only see that the payment went through and the last four digits. Basis: the contract, and the Swedish Bookkeeping Act, which requires us to keep receipts for 7 years.
• The page's content: text, images, locations and schedule, which you enter yourself. Basis: the contract.
• Messages from us: receipt, welcome email and reminders before your page's time runs out. This is what the service needs in order to work, not a newsletter. If we want to send anything else, we ask first.

We do not sell your data and do not share it with anyone beyond the providers listed below.

Signing in with Google

You can sign in with your Google account instead of a link in the email. This is optional, and the link in the email always works.

• What we receive from Google. Your email address, that Google has verified it, and an identifier that Google uses for your account. We do not ask for your name, profile picture, contacts, calendar or anything else from your Google account.
• What we use it for. Only to sign you in and link the sign-in to your account with us. When you save your page in Prova, the account is created with your email address from Google. The admin creates no new accounts: there you are only signed in if an account with your email address already exists, from the purchase or from your partner's invitation.
• Where it is stored. Together with your account, in our sign-in service (Supabase) in Stockholm, Sweden.
• Who receives it. No one. The information from Google is not shared with anyone else, not sold, and not used for advertising or to train AI models.
• How long. As long as the account exists. When the account is closed, the link to Google is also deleted.
• Revoking access. You can remove Lysela from your Google account at any time at myaccount.google.com/permissions. You then sign in with the link in the email instead.

Lysela's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Signing in with Facebook

You can save a page or sign in with your Facebook account instead of a code or link in the email. This is optional, and email always works. The sign-in is provided by Meta Platforms Ireland Limited, and we receive the information only when you choose Facebook yourself.

• What we receive from Facebook. Your name, your email address if Facebook has one, and an identifier that Facebook gives your account for Lysela only. We do not keep the name. We do not fetch your profile picture, friends, posts or anything else from your Facebook account.
• What we use it for. We use the identifier to recognise you when you sign in. The email address becomes your account's address once you have accepted it, or once you have confirmed another address with a code. If there is already an account with the address, we send a code to it before we connect the account to Facebook, because Facebook does not promise that the address is confirmed. Emails about your page go only to the address you accepted, and tips and reminders only if you said yes to them.
• Where it is stored. Together with your account, in our database and sign-in service (Supabase) in Stockholm, Sweden.
• Who receives it. No one. The information from Facebook is not shared with anyone else, not sold, and not used for advertising. Meta sees that you sign in with us and is independently responsible for your Facebook account.
• How long. As long as the account exists. If you remove Lysela in Facebook under Apps and websites, we delete the identifier, and the account stays with your email address. When the account is closed, the connection to Facebook is also deleted. How to do it is on the page about deleting your data.

Guests on the couple's pages

When a guest answers an RSVP on a couple's page, the guest gives their name, whether they are coming or not, which parts of the day and which buses apply, and, optionally, an email address, information about allergies or special diet, and a message to the couple.

Allergies and special diet are health data, a special category of personal data under article 9 of the GDPR. Because of this:

• The field is optional and the guest gives the information with explicit consent, which is shown next to the field in the form.
• The field is meant for diet and allergies, nothing else, and is limited in length.
• The information is used only so the couple can order the right food, and is exported to whoever cooks the food, such as the restaurant or the caterer, as a list with no information other than name and diet.
• The information is anonymised 6 months after the wedding, whether or not the couple extends their page.

The email address is there so the couple can reach the guest, for example if something changes before the wedding. The couple sees it next to the answer in their list and in the file they can download. We send no email to it and use it for nothing else. The form is protected against spam with a hidden field and a limit on the number of answers per connection; no third-party tracking is included.

On some pages guests can also add photos from the party, with a name if they like, and offer or ask for a lift with a name, a town and a phone number or email address. Photos are re-made on our server before they are stored, so that location data and other hidden information in the file is removed, and they only appear once the couple has approved them. Contact details for lifts are shown only to people who can open the page. On Premium pages guests can also record a voice greeting for the couple, with a name if they like. Only the couple hears it, in their admin, and it is never played on the page. The couple is responsible for this information, and we handle it on the couple's behalf.

Where data is stored and for how long

The couples' pages, accounts and all guest answers are stored in a database in Stockholm. The server functions that receive the answers run in Stockholm. Backups are taken daily.

The data follows a fixed timeline counted from the wedding day:

Account details are deleted when the account is closed. Receipts are kept for 7 years under the Bookkeeping Act. The couple can ask at any time for the page to be deleted early, and guests can ask the couple to remove their answer.

Providers we use

The following providers process data on our behalf for the couples' pages. They are bound by agreements matching this one.

The sales site and sign-in also use:

Guests' answers are stored in Sweden, and the emails we send never contain them. Some providers are American companies, and for them the European Commission's standard contractual clauses apply and, where applicable, the EU–US Data Privacy Framework. If we change provider, the list here is updated and the couples are told in advance.

Your rights

You have the right to:

• find out what data we hold about you and get a copy,
• have incorrect data corrected,
• have data deleted, once it is no longer needed or you withdraw a consent,
• receive your data in a machine-readable format; the couple can export their whole page as JSON and the guest list as CSV in admin,
• object to processing based on legitimate interest,
• complain to Integritetsskyddsmyndigheten (IMY, the Swedish Authority for Privacy Protection), imy.se, if you think we handle your data wrongly.

Write to info@lysela.se. We reply within a month. Guests can contact the couple, who can correct or remove an answer directly in admin, or us directly.

Changes and contact

We update this text when the service or our providers change. The date at the top shows the latest version. Major changes affecting the couples' or guests' data are announced to the couples by email.

Lysela (sole trader)
Hållövägen 12, 121 32 Enskededalen
info@lysela.se