Privacy policy

The data controller is Home Sweet Event, whose details are listed in the Legal notice.

To exercise your rights or ask any question about your data, you may write to contact@homesweetevent.com.

Your data is processed for the following purposes:

• Performance of the event-services contract (organising the wedding, providing useful information, monitoring payment instalments) — legal basis: performance of the contract.
• Management of the user account on the client area (creation, magic-link authentication, preferences) — legal basis: performance of the contract.
• Sending of service notifications (new document, message reply, instalment reminder) — legal basis: legitimate interest in keeping the client informed.
• Usage measurement and incident remediation (application logs, anonymised error monitoring) — legal basis: legitimate interest in service security and improvement.
• Compliance with legal and accounting obligations — legal basis: legal obligation.

Depending on your profile, the following categories may be processed:

• Identity: surname, first name, salutation, phone number, postal address.
• Account: email address, preferred language, internal identifier, activation date.
• Contract: Salesforce opportunity ID, booked property, event date, payment amounts and instalments.
• Uploaded content: chat messages, event details, guest lists, vendor photographs, vendor suggestions.
• Technical data: truncated IP address, device type, session identifiers, application logs.

To deliver the service, Home Sweet Event relies on the following subprocessors:

• Supabase, Inc. (Singapore, hosting in the United States or the European Union depending on the project region) — database and file storage.
• Vercel Inc. (United States) — web application hosting.
• Resend, Inc. (United States) — transactional email delivery.
• Functional Software, Inc. dba Sentry (United States or European Union depending on the configured region) — error and performance monitoring.
• Salesforce.com, Inc. (United States, with data hosted in the European Union) — sales management and contract synchronisation.

Transfers to subprocessors located outside the European Union are governed by the European Commission standard contractual clauses and, where appropriate, by additional technical measures (encryption in transit and at rest).

• Couple-account data: kept for the duration of the contract and up to one year after the event date, after which the account is archived.
• Archived data: kept for evidentiary purposes for the applicable legal duration (up to 5 years after the event date).
• Technical logs: 90 days.
• Vendor directory: kept as long as the vendor remains active, deleted upon request or upon deactivation.

Under the General Data Protection Regulation (GDPR) and the French Data Protection Act, you have the following rights:

• Right of access to your data.
• Right to rectify inaccurate data.
• Right to erasure (the « right to be forgotten ») under the conditions provided by law.
• Right to data portability.
• Right to object to processing on legitimate grounds.
• Right to restriction of processing.
• Right to lodge a complaint with the French data protection authority (CNIL, www.cnil.fr).

To exercise these rights, write to contact@homesweetevent.com. A response will be provided within one month of receipt of the request.

The service uses only cookies strictly necessary to its operation (authentication session, language preference). No audience-measurement, advertising or social-network cookie is set.

Browser-side error monitoring (Sentry) is configured not to collect session identifiers or user content, and uses a technical session identifier limited to error de-duplication.

Data is encrypted in transit (TLS 1.2 or higher) and at rest (disk encryption on Supabase-managed databases). Access to data is restricted to authorised Home Sweet Event personnel and tracked through an audit log. Sensitive administrative actions (impersonation of a couple account by a HSE team member for support purposes) are recorded.