Privacy Policy

1. Data Controller

The data controller responsible for processing your personal data is:

This Privacy Policy explains how Stellar Moments ("we", "us", "our", or the "Service") collects, uses, stores, and protects your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), Greek Law 4624/2019 on the protection of personal data, and all other applicable data protection legislation.

2. Data We Collect

We collect and process the following categories of personal data:

2.1 Account Data

• Full name
• Email address
• Password (stored in hashed form)
• Profile picture (if provided via Google OAuth)
• Language preference

2.2 Event Data

• Event name, date, venue name and address, description
• Floor plan layout and seating arrangements
• Venue images you upload
• Guest website content (public URL slug, schedule, announcements, and portal settings)
• Guest photographs, if you turn on the photo camera: pictures uploaded through your private camera link, stored for that event. Phones remove location data before upload. A guest may add a name, or skip it. That name is visible to the event's hosts. You can hide or delete any picture, and deleting the event deletes the pictures.

2.3 Invitee Data

When you add invitees to your events, you provide us with their personal data. You are the data controller for your invitees' data, and we act as a data processor on your behalf. You are responsible for ensuring you have a lawful basis to share this data with us. This data may include:

• First and last name
• Email address and phone number
• RSVP status
• Dietary restrictions
• Family member names and details
• Group/category and relationship data
• Table and seating assignment

2.4 Payment Data

When you purchase Couple Pro (one-time) or subscribe to Planner Pro, payment processing is handled entirely by Stripe, Inc. We do not store your credit card numbers or full payment details. We store your Stripe customer ID, purchase records for one-time Couple Pro payments, and subscription status for Planner Pro to manage your account and entitlements.

2.5 Technical Data

• Browser type and version
• Device type and operating system
• IP address
• Pages visited and usage patterns
• Referring website
• Timestamps of access

3. Legal Basis for Processing

We process your personal data based on the following legal grounds under Article 6 of the GDPR:

• Performance of a contract (Art. 6(1)(b)): To provide you with the Service, manage your account, process purchases and subscriptions, and deliver the features you use.
• Legitimate interests (Art. 6(1)(f)): To improve our Service, ensure security, prevent fraud, and communicate with you about service-related matters.
• Consent (Art. 6(1)(a)): Where we rely on your consent, such as for optional analytics or marketing communications. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): To comply with applicable legal requirements, such as tax and accounting obligations under Greek law.

4. How We Use Your Data

• To create and manage your account
• To provide, maintain, and improve the Service
• To process your Couple Pro purchases and Planner Pro subscription payments
• To send RSVP invitation emails on your behalf
• To send a one-time wishes email to couple event owners the day before their event
• To provide customer support
• To ensure the security and integrity of the Service
• To comply with legal obligations
• To analyze how the Service is used and improve features (only with your consent via our cookie banner)
• To generate AI-powered insights for seating arrangements (data is processed transiently and not stored by AI providers)

5. Data Sharing and Third-Party Services

We share your data with the following third-party service providers who act as data processors on our behalf:

We do not sell your personal data to third parties. We do not share your data with any third party for their own marketing purposes.

6. International Data Transfers

Some of our service providers are located outside the European Economic Area (EEA). When your data is transferred outside the EEA, we ensure appropriate safeguards are in place, including:

• EU Standard Contractual Clauses (SCCs) approved by the European Commission
• EU-US Data Privacy Framework adequacy decisions
• Binding corporate rules where applicable

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with the Service. Specifically:

• Account data: Retained until you delete your account, after which it is permanently erased within 30 days.
• Event and invitee data: Retained until you delete the event or your account.
• Purchase and subscription records: Retained for up to 5 years after the last transaction to comply with Greek tax and accounting regulations (Greek Tax Procedure Code, Law 4174/2013) and to manage your account entitlements.
• Technical logs: Retained for up to 12 months for security and debugging purposes.

8. Your Rights

Under the GDPR and Greek Law 4624/2019, you have the following rights regarding your personal data:

• Right of access (Art. 15): Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten").
• Right to restriction (Art. 18): Request that we restrict processing of your data.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3)): Where processing is based on consent, withdraw it at any time.
• Right to lodge a complaint: You have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA/ΑΠΔΠΧ):

  Hellenic Data Protection Authority (ΑΠΔΠΧ)

  Kifisias 1-3, 115 23, Athens, Greece

  Tel: +30 210 6475600 | Email: contact@dpa.gr

  Website: www.dpa.gr

To exercise any of these rights, please contact us via our Contact Form. We will respond to your request within 30 days as required by the GDPR.

9. Cookies and Local Storage

Stellar Moments uses cookies and local storage for the following purposes:

Essential (no consent required)

• Authentication: To maintain your session and keep you signed in.
• Language preference: To remember your selected language (English or Greek).
• Theme preference: To remember your light/dark mode setting.
• Cookie consent: To remember whether you accepted or declined optional analytics.

These are essential for the Service to function and do not require consent under Article 5(3) of the ePrivacy Directive (2002/58/EC), except where noted below for analytics.

Analytics (with your consent)

When you click "Accept" on our cookie banner, we use PostHog to collect usage analytics (such as pages visited, features used, and technical diagnostics) to improve the Service. PostHog may set cookies or use similar technologies in your browser. We do not use advertising or cross-site tracking cookies.

You can decline analytics via the cookie banner, clear site data in your browser, or contact us to withdraw consent at any time.

10. Security Measures

We implement appropriate technical and organisational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including:

• Encryption in transit (TLS/HTTPS) and at rest
• Secure password hashing (bcrypt)
• Row-level security policies on our database
• Regular security audits and vulnerability assessments
• Access controls and principle of least privilege
• JWT-based authentication with automatic token refresh

11. Children's Privacy

The Service is not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If you become aware that a child under 16 has provided us with personal data, please contact us and we will take steps to delete such data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on the Service with a new "Last updated" date. We encourage you to review this policy periodically. Continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us through our Contact Form.