Privacy policy
Your data, and what we do with it
A wedding site holds intimate things: your story, your photos, the names of the people you love. Here is exactly what we keep, where, for how long, and who else can see it.
Last updated: 17 October 2026.
Courtesy translation. Only the French version of this document is legally binding. Read the French version →
Who is responsible
Synap’Link, 13, rue de la Pépinière, 5000 Namur, Belgium, VAT BE 1034.436.506, represented by Ashot Avakian, is the controller of your data. For any question or to exercise your rights: info@synaplink.be.
An important exception: your guests. The replies collected on your site — names, attendance, allergies or diet, guestbook messages, uploaded photos — are collected by you, for you. You are their controller; we are only their technical custodian, and we use them for nothing other than showing them to you.
A guest who wants their reply erased can write to us: we pass the request on to you and carry it out.
What we collect
Nothing but what you give us, and what is needed to serve the pages.
- Your account — email address, password (hashed, unreadable to us), first name, last name, phone number if you provide it.
- Your project — first names, date, place, your story, the schedule, the practical information and the photos you upload.
- Your guests’ replies — name, email if they give it, attendance, number of guests, allergies or dietary requirements if they choose to mention them, guestbook message. An allergy may reveal health information: it is only ever asked for on an optional basis, is shown only to the couple for their caterer, and disappears with the site.
- What your guests leave on your site — the name and text of a guestbook message, the photos they add. Photos are reduced in their browser before upload, which strips their shooting metadata, location included.
- A call request — first name, last name, email, phone, occasion, intended date, preferred time, message.
- Your orders — the details of what was ordered and the amount. Your card number never passes through our servers: it is entered with our payment provider.
- Technical traces — IP address and timestamp, kept long enough to limit repeated attempts on forms and account creation. Without this, a robot could fill the database in a night.
Why, and on what basis
- Performing the contract — creating your account, saving your project, publishing your site, sending you your links, collecting replies, processing your order.
- Our legitimate interest — securing the service, preventing abuse, answering a call request or a message you send us.
- A legal obligation — keeping accounting and invoicing records.
We do no direct marketing, no profiling and no automated decision-making. Your data is neither sold, nor rented, nor exchanged.
For how long
- A draft started without an account — a few weeks, then it is erased. Nobody can read it in the meantime, except whoever holds its link.
- Your site and the replies received — the hosting period stated at the time of the order, which can be extended; at its end, everything is deleted.
- Your account — for as long as you keep it. You can ask for it to be deleted at any time.
- A call request not followed up — twenty-four months.
- Accounting records — the period required by Belgian law, from seven to ten years depending on the document. That one, we cannot shorten.
Who else has access
We do, in order to answer you. And the technical providers without which the service would not exist — each for a specific function and, with the sole exception of our payment provider explained below, none on its own account:
- Vercel Inc. — Hosting of the site and its pages. United States, covered by the Data Privacy Framework and standard contractual clauses.
- Supabase Inc. — Database, accounts and gallery photos. Zurich, Switzerland, covered by an adequacy decision of the European Commission.
- n8n — Formatting and sending of e-mails. instance run by Synap’Link.
- Infomaniak — Business mailbox our messages are sent from. Switzerland, covered by an adequacy decision of the European Commission.
- Stripe Payments Europe, Limited — Online payment of orders — and, for fraud prevention and its legal obligations, a data controller in its own right. Dublin, Ireland.
Some of this data is therefore hosted outside the European Union. Transfers to Switzerland rely on an adequacy decision of the European Commission; those to the United States, on the Data Privacy Framework and standard contractual clauses.
Payment is the exception. When you pay for your order, Stripe collects the money on our behalf, but it also acts as a controller in its own right: the law requires it to prevent fraud, verify certain transactions and keep a record of payments. That payment data is then governed by its own privacy policy, available on stripe.com, and may be transferred to its parent company, Stripe, Inc., in the United States, under the Data Privacy Framework and standard contractual clauses. We never see your card number: it is entered with Stripe, not with us.
What is public, and what is not
This is the point most often misunderstood, so let us put it simply.
- Your site is accessible to anyone who has its link, and it is not indexed by search engines: nobody finds it by searching for your names. The link is meant to be shared — it is not password-protected.
- Gallery photos are served to whoever knows their address, which contains two randomly drawn identifiers and cannot be guessed. They are not listed anywhere else and do not appear in any search engine.
- The guestbook and the photos left by your guests are visible to everyone who has the site’s link: that is their purpose, and the form tells the guest before they send. You can hide a message or remove a photo at any time; a removed photo is erased from our servers.
- Your guests’ replies are visible only to you, from your space or the private link received by email. That link works as a key: forward it only to people you want to give access to.
- A draft can only be read by the browser that started it — or by whoever you send its resume link to.
Your rights
You can ask for access to your data, its rectification, its erasure, the restriction of its processing, object to processing based on our legitimate interest, and receive your data in a reusable format.
One address for all of this: info@synaplink.be. We reply within a month. If the request concerns replies collected by a couple, we pass it on to them — it is their decision.
You may also lodge a complaint with the Belgian Data Protection Authority — Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be.
How it is kept safe
Exchanges go through an encrypted connection. The database tables refuse all access by default: no browser can read anything from them; only our server accesses them, with a key that never leaves the server. Passwords are stored in a form we cannot read back — if you lose yours, we cannot remind you of it, only let you create a new one.
If this policy changes
The version in force is the one shown here, dated at the top of the page. A change that really concerns you is announced to you by email. The terms of sale are in our terms and conditions.