Privacy Policy

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any information relating to an identified or identifiable natural person (Art. 4(1) GDPR).

The controller within the meaning of Art. 4(7) GDPR for data processing on this website is:

Cem Deniz Kabakci
Feldstr. 52
13585 Berlin
Germany

Email: withthislink@gmail.com

We have not appointed a data protection officer, as the conditions of Art. 37(1) GDPR are not met.

As the controller, we observe the principles of Art. 5(1) GDPR and are able to demonstrate compliance with them (accountability pursuant to Art. 5(2) GDPR). We maintain a record of processing activities pursuant to Art. 30 GDPR.

Third-party data in invitation content (Art. 14 GDPR)

Through the invitation content created by users, we store personal data of third parties (i.e. persons named or depicted in invitation content) that the respective creator provides and that is not collected directly from those persons. As we have no contact details for these persons, individually informing them under Art. 14 GDPR would be impossible or involve a disproportionate effort (Art. 14(5)(b) GDPR).

As compensating measures, the creator warrants that they have an appropriate legal basis or the consent of the data subjects concerned (see the "Invitation content you create" section and our Terms and Conditions). Affected persons may contact us at any time via the contact address stated in the "Controller" section in order to exercise their rights or request the removal of content concerning them.

How Event Photo Albums Work

As a paid add-on, you can create a photo album linked to your invitation to share your wedding photos and videos with your guests after the event. You upload the files yourself (for example, your photographer's delivery or photos shared by friends) and can allow other registered users, such as your guests, to contribute their own photos and videos (see "Contributions to an Album"). Guests view and download the album through your invitation link, protected by an access code that we generate for your album and that you share with them (and can renew). Up to 12 photos you choose as highlights are shown on the invitation itself, without the access code.

Controller and Legal Bases

We are the controller within the meaning of Art. 4(7) GDPR for storing and delivering album files. You decide which photos and videos you upload, whom you admit as contributors, and with whom the album is shared. You must hold the necessary rights to every file you upload yourself, in particular the consent of the people shown under the right to one's own image (Sections 22 and 23 KUG, German Art Copyright Act) unless an exception applies, as well as the copyright, and you must inform your guests that photos and videos of the event are shared in the album.

Toward you, the legal basis is the performance of the contract for the album add-on (Art. 6(1)(b) GDPR). For personal data of guests who are shown in the files or who took them, the legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in providing the album you ordered so that you can share the photos and videos of your event with the guests of that event. We take the guests' interests into account through the following measures: the album listing can only be opened with the access code (except for the highlights mentioned above); contributions from contributors you have not marked as trusted appear in the album only after your approval, and we delete rejected contributions promptly; the files are stored under long, random, unguessable URLs; the album page and our users' invitations are marked for search engines not to index them (noindex); we do not use face recognition and do not analyze album content automatically, apart from the hash matching against known abuse material described below; the files are stored only for a limited time (see below); and we remove content on request.

This concerns photos and videos in which guests appear, and the metadata contained in the original files (for example capture time, camera model, GPS location). We receive the files from the person who created the album or from the contributors that person has admitted, and generally not from the people shown themselves. Recipients are the people who are given the invitation link and the access code (anyone who knows the invitation link sees the highlights), and Cloudflare (storage and delivery of the files) and Convex (storage of the metadata) as our service providers. When we review a report or an objection, we look at the files concerned (Art. 6(1)(c) GDPR in conjunction with Art. 16 of Regulation (EU) 2022/2065, and Art. 6(1)(f) GDPR).

Guests can object to the processing of files that show them or that they took under Art. 21 GDPR and request their erasure under Art. 17 GDPR. To do so, a message via our report form or to the email address given in the "Controller" section is enough. We then remove the content concerned ourselves or have the person who created the album remove it. For your own account data, the other sections of this privacy policy apply.

What We Store

We store the original file exactly as you upload it, together with a preview (approx. 1600px) and a thumbnail (approx. 400px) that are generated in your browser before upload. We also store the file name, size, file type, capture time (taken from the file's EXIF data where available, otherwise the file's last-modified time), and image or video dimensions as metadata.

Metadata in Original Files

Unlike the invitation images described under "Image Storage and Delivery (CDN)" below, which are re-encoded and stripped of metadata, the original files in your photo album are stored exactly as uploaded, including any embedded EXIF and other metadata (such as GPS location, camera model, and capture time). Anyone who downloads an original file receives this metadata. If you do not want to share a photo's location, remove it from the file yourself before uploading.

Storage, Delivery, and Retention

Album files are stored in the Cloudflare R2 object storage described under "Image Storage and Delivery (CDN)" below and delivered through the same CDN under long, random, unguessable URLs; the international-transfer safeguards described there apply equally here. The access code protects the album listing, not the individual files: anyone who obtains a file's URL can open it directly. As with other CDN-delivered content, copies already cached at CDN edges may remain accessible for up to 24 hours after deletion.

An album and its files are deleted 30 days after the album expires. The album expires at the earlier of one year after the event date (as defined in our Terms under "Photo Albums") or 540 days (about 18 months) after the album was activated. You can delete individual files or the entire album at any time before expiry, and deleting your account deletes all of your albums, in each case including contributions from other users; deletion from storage is carried out in batches shortly after the request. The legal basis for this processing is, toward you, the performance of the contract for the album add-on (Art. 6(1)(b) GDPR) and, toward guests who are shown in the files or who took them, our legitimate interest (Art. 6(1)(f) GDPR), as described above under "Controller and Legal Bases".

Contributions to an Album

If the owner of an album has turned on contributions, registered users can ask them for permission to contribute their own photos and videos. If you do, we process, in addition to your account data, your request (for which album and when), the time at which you accepted the terms for contributions in our Terms with it, its status (requested, admitted, marked as trusted, or declined), the storage you may use, which files you uploaded, and whether they are still awaiting approval. For the files themselves and their metadata, the sections "What We Store" and "Metadata in Original Files" apply accordingly. The legal basis is the performance of the usage agreement you have concluded with us (Art. 6(1)(b) GDPR); we also store the time of acceptance so that we can prove it (Art. 6(1)(f) GDPR).

The owner of the album sees your request with the name and email address of your account, your status and your storage allowance, and, for files awaiting their approval, that you uploaded them. Guests do not see who uploaded a file; however, they receive the metadata contained in an original file (for example the camera model) when they download it. If the owner of the album rejects a file, we remove it from the album at once and delete it from storage shortly after.

For personal data of the people shown in your contributions, the legal basis, as for all album files, is our legitimate interest (Art. 6(1)(f) GDPR) as described above under "Controller and Legal Bases"; these people can object as described there. You must hold the necessary rights to every file you contribute, in particular the copyright and the consent of the people shown under the right to one's own image (Sections 22 and 23 KUG) unless an exception applies (see our Terms under "Photo Albums").

You can delete your own contributions at any time until the album expires; the owner of the album can delete any file in their album. Your contributions and the details of your request are deleted together with the album (see "Storage, Delivery, and Retention"). If you delete your account, the files you uploaded remain in the album. We then anonymize the details of your request so that the files are no longer linked to your account; this does not change the content or metadata of the files themselves. The legal basis for continuing to store the files is the legitimate interest of the owner of the album and their guests in keeping the photos and videos made available to them until the album expires, and our legitimate interest in providing the album as agreed (Art. 6(1)(f) GDPR). If you do not want your files to remain in the album, delete them before deleting your account; after that, you can contact us via our report form or the email address given in the "Controller" section.

No Face Recognition

We do not use face recognition or any other automated analysis of album content, with one exception: Cloudflare, which delivers the files through its CDN, compares images cached in its network against known child sexual abuse material by hash matching, blocks the address of a match and notifies us. Only a digital fingerprint of the file is compared with a list of known fingerprints. Where required by law, matches may be reported to competent authorities or organizations. The legal basis is our legitimate interest in preventing the distribution of such material through our service (Art. 6(1)(f) GDPR).

Protection of the Access Code

To prevent access codes from being guessed by trial and error, we limit wrong entries. When someone enters a wrong code, we store a counter together with a pseudonym of the IP address (for IPv6, of its /64 prefix). The pseudonym is a hash formed with a secret key; we do not store the IP address itself. Each key is deleted automatically 24 hours after it was created and replaced by a new one. After that, a stored entry can no longer be linked to an IP address. We do not delete the entries themselves, but they then no longer contain any data that can be linked to a person. The legal basis is our legitimate interest in protecting albums from abuse (Art. 6(1)(f) GDPR).

Unless a more specific storage period has been stated within this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. If you assert a legitimate request for deletion or revoke consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing it.

Specifically:

• Account and invitation data: Your user account, your invitations, and uploaded images are deleted as soon as you delete your account or the respective invitation. The image files you uploaded are deleted from our object storage (Cloudflare R2); as images are delivered via a CDN (cdn.withthislink.com) with a cache lifetime capped at 24 hours, copies already cached at CDN edges may remain accessible for up to 24 hours. The RSVP responses submitted for an invitation are deleted when the invitation or the account is deleted; at the latest, they are deleted automatically twelve months after the event date. If you have consented to product analytics or have since withdrawn that consent, your PostHog analytics profile and all associated events are also deleted on a best-effort basis when you delete your account. If the automatic deletion fails, this is logged internally and the deletion is carried out manually. Files you contributed to another user's photo album remain in that album when you delete your account (see "Event Photo Albums").
• Payment and order data: For tax and commercial-law reasons we are required to retain invoices and accounting records for eight years (Section 147 AO, Section 257 HGB). This data is therefore stored even after an account deletion, until the statutory retention period expires (Art. 6(1)(c) GDPR).
• Contact enquiries: Messages you send via the contact form (name, email address, message) are deleted automatically at the latest after twelve months, or when your account is deleted, unless statutory retention obligations apply (Art. 6(1)(f) GDPR).
• Content reports: If you report an invitation or a photo album via our report form, we store the reason you chose, your description, the invitation link and, if you choose to give them, your name and email address, in order to review the report and follow up where needed (Art. 6(1)(c) GDPR in conjunction with Art. 16 of Regulation (EU) 2022/2065, and Art. 6(1)(f) GDPR). Reports are deleted automatically after twelve months at the latest. To prevent abuse of the form, we keep a hash of your IP address, keyed with a secret that changes daily, for up to six hours (Art. 6(1)(f) GDPR); we do not store the IP address itself.
• Disclosure to law enforcement: Where information known to us gives rise to a suspicion of a criminal offense involving a threat to the life or safety of a person, we are obliged to inform the law enforcement or judicial authorities of the Member State concerned (Art. 6(1)(c) GDPR in conjunction with Article 18 of Regulation (EU) 2022/2065). Where another criminal offense is suspected, we may file a criminal complaint; the legal basis is our legitimate interest in the prosecution of criminal offenses committed through our service (Art. 6(1)(f) GDPR, Recital 50 GDPR). We transmit the content concerned and the account data needed to investigate it (name, email address, upload times). Recipients are the competent law enforcement authorities.
• Premium support chat: Paying customers have access to a direct support chat inside the editor. We process the content of your messages and our replies, any images you upload, and read timestamps (when a message was read). The purpose is handling your support request as part of our contractual relationship (legal basis: Art. 6(1)(b) GDPR). The conversation is stored for the life of the associated invitation and is deleted with it, and with your account. Recipients are solely the processors listed below (hosting, database, image storage); no other disclosure takes place. So that we can respond promptly, we receive a notification via a messenger service when a new message arrives. That notification contains only a notice that a new message exists plus an internal reference id, never message content, names, email addresses, or any other personal data. The messenger service therefore does not process any personal data of our customers.
• Consent records: We store records of consent given or withdrawn (e.g. for analytics) for as long as necessary to meet our accountability obligation under Art. 7(1) GDPR and to establish or defend legal claims (legal basis: Art. 6(1)(c) GDPR).

We only process personal data if one of the following legal bases applies:

• Art. 6(1)(a) GDPR: You have given your consent to the processing.
• Art. 6(1)(b) GDPR: The processing is necessary for the performance of a contract.
• Art. 6(1)(c) GDPR: The processing is necessary for compliance with a legal obligation.
• Art. 6(1)(f) GDPR: The processing is necessary for the purposes of our legitimate interests.

To provide our service we use the following providers (processors or independent controllers). Where personal data is transferred to countries outside the EU/EEA (in particular the USA), this is done on the basis of appropriate safeguards, namely the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR and – where the recipient is correspondingly certified – on the basis of an adequacy decision (EU-US Data Privacy Framework) pursuant to Art. 45(1) GDPR.

Hosting and Server Log Files

Our website is hosted with an infrastructure provider. When the website is accessed, information transmitted by your browser is automatically processed in so-called server log files. This includes in particular the IP address, the date and time of access, the requested file, the previously visited page (referrer URL), the browser used, and the operating system. This data is technically required to deliver the website and to ensure its stability and security. We also evaluate it statistically to understand how many visitors reach our website and through which channels (e.g. search engines or social networks) they arrive. No user profiles are created, and no information is stored on or read from your device for this purpose. The log files are deleted after 14 days. The legal basis is our legitimate interest in the secure and stable operation of the website and in a data-minimal evaluation of its use pursuant to Art. 6(1)(f) GDPR.

Provider: ProHosting24
Server location: Germany

Authentication (Clerk)

We use Clerk for user authentication. During registration and login, your data (e.g. email address, name) is transmitted to and processed by Clerk. The provider is Clerk, Inc., 660 King Street, Unit 345, San Francisco, CA 94107, USA. Its representative in the EU pursuant to Art. 27 GDPR is VeraSafe Ireland Ltd., Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork T23 AT2P, Ireland. The legal basis is the performance of the user agreement pursuant to Art. 6(1)(b) GDPR.

As Clerk is based in the USA, personal data may be transferred to the USA. Clerk is certified under the EU-US Data Privacy Framework; the transfer therefore takes place on the basis of an adequacy decision pursuant to Art. 45(1) GDPR. In addition, we base the transfer on the EU Standard Contractual Clauses (Module 2) pursuant to Art. 46(2)(c) GDPR.

Privacy Policy: https://clerk.com/legal/privacy

Database and Backend (Convex)

The content you enter (including account and invitation data, names, your guests' RSVP responses) and references to uploaded images are stored and processed in our backend and database platform Convex. The provider is Convex, Inc., 444 DeHaro Street, Suite 218, San Francisco, CA 94107, USA. The provider offers an EU contact point for data subjects via GDPR Local (convex.gdprlocal.com/eu). The data is hosted on Amazon Web Services (AWS) infrastructure within the European Union (Ireland region). The legal basis is the performance of the user agreement pursuant to Art. 6(1)(b) GDPR.

We have concluded a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR with the provider, based on the Convex Data Processing Addendum (available at convex.dev/legal/dpa). While the data is stored within the EU, the provider is a US-incorporated company and individual sub-processors (e.g. for support and operational monitoring) are located in the USA, so access to or a transfer of data to the USA cannot be ruled out. Any such access or transfer is safeguarded by the EU Standard Contractual Clauses (Module 2) pursuant to Art. 46(2)(c) GDPR, which form part of the DPA.

To provide the service, Convex engages further sub-processors (including Amazon Web Services for infrastructure). The provider maintains a current list of sub-processors at convex.dev/legal/subprocessors.

Privacy Policy: https://www.convex.dev/legal/privacy

Payment Processing (Polar)

For payment processing we use Polar, which acts as Merchant of Record (reseller). When you make a payment, your payment data is transmitted directly to and processed by Polar; complete credit card data is not stored on our servers. During checkout, in particular your name and email address are transmitted to Polar. The provider is Polar Software, Inc., 3500 South DuPont Highway, Dover, DE 19901, USA. The legal basis is the performance of the contract pursuant to Art. 6(1)(b) GDPR and compliance with tax and commercial retention obligations pursuant to Art. 6(1)(c) GDPR.

As Polar is based in the USA, personal data may be transferred to the USA. This transfer is safeguarded by the EU Standard Contractual Clauses (Module 2) pursuant to Art. 46(2)(c) GDPR. As Merchant of Record (seller of record), Polar additionally acts as an independent controller toward the buyer with respect to payment and tax records.

Privacy Policy: https://polar.sh/legal/privacy

Image Storage and Delivery (CDN)

Images you upload to your invitation (e.g. cover and gallery images) are stored in the Cloudflare R2 object storage operated by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Before storage, the images are re-encoded to the WebP format server-side using the sharp library. This removes metadata including EXIF/GPS location information. The legal basis is the performance of the user agreement pursuant to Art. 6(1)(b) GDPR.

Images are delivered via a content delivery network (CDN) under the domain cdn.withthislink.com, operated by Cloudflare, Inc. (EU contact: Cloudflare Germany GmbH, Rosenheimer Straße 143C, 81671 Munich, Germany). Cloudflare accelerates and secures the delivery of content; in doing so, your IP address is processed. The legal basis is our legitimate interest in secure and performant delivery pursuant to Art. 6(1)(f) GDPR. Cloudflare also applies the hash matching against known child sexual abuse material described above under "No Face Recognition" to the invitation images delivered through the CDN; the legal basis here too is our legitimate interest in preventing the distribution of such material through our service (Art. 6(1)(f) GDPR).

As Cloudflare is based in the USA, personal data may be transferred to the USA. Cloudflare is certified under the EU-US Data Privacy Framework; the transfer therefore takes place on the basis of an adequacy decision pursuant to Art. 45(1) GDPR. In addition, we base the transfer on the EU Standard Contractual Clauses (Module 2) pursuant to Art. 46(2)(c) GDPR.

Cloudflare also provides bot protection (Turnstile) during authentication (Clerk) to defend against abusive sign-in attempts. In doing so, technical characteristics of your device and browser as well as your IP address are processed. The legal basis is our legitimate interest in protecting our services against automated attacks pursuant to Art. 6(1)(f) GDPR.

Privacy Policy: https://www.cloudflare.com/privacypolicy/

Reach Measurement (View Counting)

When a public invitation is accessed, we count the views to measure reach. For this purpose your IP address is pseudonymised using HMAC-SHA256 with a rotating salt (renewed every 24 hours) and stored together with a counter in our Redis store. The hash is used solely to detect repeat views within 24 hours and avoid counting them twice. No profiling takes place and no personal profiles are created. The legal basis is our legitimate interest in reach measurement pursuant to Art. 6(1)(f) GDPR.

Maps (OpenStreetMap and Stadia Maps)

To display event locations and for address search we use OpenStreetMap. When map tiles are loaded (the "standard" map style) and when an address is searched, your IP address is transmitted to the OpenStreetMap Foundation. This feature is only loaded when an invitation contains a location section. The legal basis is our legitimate interest in displaying event locations and a functioning address search pursuant to Art. 6(1)(f) GDPR. The OpenStreetMap Foundation is based in the United Kingdom; the transfer takes place on the basis of the European Commission's adequacy decision pursuant to Art. 45(1) GDPR.

Privacy Policy: https://wiki.osmfoundation.org/wiki/Privacy_Policy

Where the creator of an invitation has selected an alternative map style for its location section ("light", "dark", or "watercolor"), the map tiles are loaded from Stadia Maps instead of OpenStreetMap. When these tiles are loaded, your IP address is transmitted to Stadia Maps. We use Stadia Maps' EU endpoint exclusively, so the tiles are served solely from servers within the EU (Frankfurt, Germany, and Paris, France). The provider is Stadia Maps, Inc., 1690 Watertower Place, Ste 100 #216, East Lansing, MI 48823, USA. The legal basis is our legitimate interest in displaying event locations pursuant to Art. 6(1)(f) GDPR.

Although the map tiles are served exclusively from servers within the EU, because the provider is a US company, access to or a transfer of data to the USA cannot be excluded. Any such access or transfer is safeguarded by the EU Standard Contractual Clauses (Module 2) pursuant to Art. 46(2)(c) GDPR.

Privacy Policy: https://stadiamaps.com/privacy/privacy-policy/

Product Analytics (PostHog)

Where you have given your consent, we use PostHog for pseudonymous product analytics in order to understand how the application is used, to debug issues, and to improve the app. The provider is PostHog, Inc., 2261 Market St., #4008, San Francisco, CA 94114, USA. Processing takes place via the PostHog EU Cloud; the data is hosted on servers within the EU (Frankfurt, Germany).

In doing so, a pseudonymous identifier (distinct id) is assigned to your device and stored in your browser's local storage (localStorage) as well as partially in a cookie, both named ph_[token]_posthog (retention approx. 1 year). This is not anonymous but pseudonymous data, which may constitute personal data under the GDPR. Your consent decision itself is stored in your browser's local storage (localStorage) under the key __ph_opt_in_out_<token>. We also store, in your browser's local storage under the keys wtl_consent_meta and wtl_consent_id, the time and version of your decision and a device-level identifier; these serve solely to record and demonstrate your decision per device, are necessary for that purpose (Section 25(2) TDDDG), and remain until you clear them. If you are logged in, we additionally store your consent decision on our servers (the decision, the version of this privacy notice it relates to, the time it was made, and a device identifier so each device's choice is recorded separately) in order to demonstrate your consent pursuant to Art. 7(1) GDPR.

If you are logged in and have consented, analytics events are associated with your user account: in this case your account identifier (account id) is used as the distinct id. This creates a user-level profile in PostHog that we use for per-user usage analysis (e.g. to understand feature usage across sessions and devices). No further contact data (such as your email address or name) is transmitted as analytics data; only the account identifier is used for the association, and the text content of pages is masked. If you are not logged in, the identifier remains a pseudonymous cookie id.

The legal basis for the processing is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG for the access to and storage of information on your device.

As the provider is a US-incorporated company, a transfer of personal data to the USA may occur. We have concluded a Data Processing Agreement (DPA) with PostHog pursuant to Art. 28 GDPR. PostHog is certified under the EU-US Data Privacy Framework; the transfer therefore takes place on the basis of an adequacy decision pursuant to Art. 45(1) GDPR. In addition, we base the transfer on the EU Standard Contractual Clauses (Module 2) pursuant to Art. 46(2)(c) GDPR.

You can withdraw your consent at any time with effect for the future by opening the "Cookie settings" link in the site footer.

Privacy Policy: https://posthog.com/privacy

Error and Security Monitoring (Sentry)

For the technical monitoring of our service we use Sentry to detect software errors and crashes and to detect security incidents or personal data breaches at an early stage so that we can handle them in line with our obligations under Art. 32 and Art. 33 and 34 GDPR. The provider is Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. Processing takes place via Sentry's EU region; the data is hosted on servers within the EU (Frankfurt, Germany). The legal basis is our legitimate interest in the security, stability and integrity of our service pursuant to Art. 6(1)(f) GDPR.

Only technical error and diagnostic data is processed (e.g. error messages, stack traces, the browser, operating system and device used, and the requested route path). We have configured Sentry server-side so that no personal identifiers are transmitted: by means of server-side filters and by disabling the automatic collection of personal data, we remove in particular names, email addresses, IP addresses, request bodies, cookies, request headers, URL query parameters and RSVP data before transmission. No session recording (Session Replay) takes place.

As the provider is a US-incorporated company, access to or a transfer of data to the USA may occur despite the data being held in the EU. We have concluded a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR with the provider. Functional Software, Inc. is certified under the EU-US Data Privacy Framework; the transfer therefore takes place on the basis of an adequacy decision pursuant to Art. 45(1) GDPR. In addition, we base the transfer on the EU Standard Contractual Clauses (Module 2) pursuant to Art. 46(2)(c) GDPR.

Privacy Policy: https://sentry.io/privacy/

Our website uses cookies. Cookies are small text files stored on your device. Cookies do not cause any damage and do not contain viruses.

We use the following types of cookies:

• Technically necessary cookies: These cookies are essential for the operation of the website (e.g., session cookies for authentication). When logged in, we also use technically necessary local storage (localStorage) for UI preferences (e.g. sidebar and inspector state) and temporary session-storage markers for checkout flow management; this data stays in your browser and is not transmitted.

We use the widely-used SSL (Secure Socket Layer) encryption method in conjunction with the highest level of encryption supported by your browser when you visit our website.

We also employ appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, loss, destruction, or unauthorized access by third parties.