Privacy notice

Aevaia hand-builds digital invitations, gifts and event pages to order. This notice covers visitors to this site, people who send a brief, and guests who respond on a page built for a client.

When you start a commission you give a name, a way to reach you (email, WhatsApp or Instagram), the occasion, a date, and whatever you write in the brief. That is stored so the work can be quoted and built. Nothing else is asked for.

Standard server logs: the page requested, a timestamp, browser type and IP address. They exist to keep the site up and to stop abuse, and they are not used to build a profile of you.

Where a page collects RSVPs or issues tickets, the guest information belongs to the client who commissioned it, and is held on their behalf. This is other people's personal data, so the specifics matter.

What is collected from a guest. Their name (required); their phone number (required only when they say they are attending); their email address (optional); whether they are coming; any message they choose to leave; a ticket code generated for them; and, if they attend, the time they were checked in at the door. Nothing else is asked for, and no tracking or advertising identifiers are collected on an invitation page.

Separately, the IP address a submission arrives from is used to count requests and stop the same address flooding a guest list. It is held only as a short-lived counter, is never written to the guest list, and is not used to identify anyone.

Where it goes. The guest list is stored in a Postgres database run by Supabase in the EU (Ireland, eu-west-1). The page and its server code run on Vercel. Request-rate counters are held by Upstash. Where a client uses a spreadsheet, accepted RSVPs are also sent to that client's own automation. For current event work, that is a Make.com scenario writing into the client's Google Sheet, which means the client's own Google account holds a copy under their control, not ours. Errors are reported to Sentry in its EU region; guest names and contact details are not included in error reports.

How long it is kept. The guest list is kept until the event takes place and for 90 days afterwards, so that attendance can be reconciled and any dispute settled, and is then deleted from the database. Copies the client holds in their own spreadsheet or email are theirs and outside our control; deletion here does not delete those. A client may ask for the list to be deleted sooner, and a guest may ask for their own entry to be removed at any time using the contact details in section 08.

Who is responsible for it. For guest data, the client who commissioned the page decides what is collected and why, so the client is the controller and Aevaia acts as processor, handling that data only on the client's instructions and for the event it was collected for. Guest data is never used for our own marketing, never sold, and never reused for another client.

TODO-OPERATOR : put the processor relationship above in writing with each event client: a short data-processing agreement naming the sub-processors listed here. This is an operator action, not a drafting gap: the statement above describes the arrangement, and Art. 28 GDPR requires it to exist as a contract as well.

Only the services needed to run the site, each under their own terms: Vercel for hosting, Supabase for the database (EU region), and Resend for email. Your data is never sold, and it is not used for advertising.

No advertising or tracking cookies are set. Signing in, which only the operator does, uses a session cookie from Clerk. Visitor numbers are counted in aggregate without cookies or cross-site identifiers.

Enquiries that do not become commissions are kept for twelve months, so a returning conversation makes sense. Records of paid work are kept as long as tax and accounting rules require. Guest data follows the retention period in section 04.

You can ask what is held about you, have it corrected, or have it deleted, and you can complain to your local data-protection authority. Ask by email and you will get an answer within 30 days. If you are a guest on someone's event page, that page's owner is the person to ask first; pass the request on and it will be actioned.

Everything is served over HTTPS. Access to the database is limited to the operator and to the server itself; guest lists are not readable from the browser. No payment card details are stored; payment is invoiced directly.

This notice may be updated. The date at the top reflects the most recent revision, and any significant change will be described rather than slipped in quietly.