Privacy notice

Aevaia hand-builds digital invitations, gifts and event pages to order. This notice covers visitors to this site, people who send a brief, and guests who respond on a page built for a client.

When you start a commission you give a name, a way to reach you — email, WhatsApp or Instagram — the occasion, a date, and whatever you write in the brief. That is stored so the work can be quoted and built. Nothing else is asked for.

Standard server logs: the page requested, a timestamp, browser type and IP address. They exist to keep the site up and to stop abuse, and they are not used to build a profile of you.

Where a page collects RSVPs or issues tickets, the guest information belongs to the client who commissioned it, and is held on their behalf. This is other people's personal data, so the specifics matter:

TODO-OPERATOR — list every field collected from a guest — name, phone, email, RSVP status, ticket code, check-in time — and mark which are required.

TODO-OPERATOR — name each system that receives guest data and the region it is hosted in, including any automation or spreadsheet destination.

TODO-OPERATOR — state the retention period after the event date, and what happens to the guest list at the end of it.

TODO-OPERATOR — state whether Aevaia acts as controller or processor for guest data, who the counterparty is, and whether a written agreement governs it.

Only the services needed to run the site, each under their own terms: Vercel for hosting, Supabase for the database (EU region), and Resend for email. Your data is never sold, and it is not used for advertising.

No advertising or tracking cookies are set. Signing in — which only the operator does — uses a session cookie from Clerk. Visitor numbers are counted in aggregate without cookies or cross-site identifiers.

Enquiries that do not become commissions are kept for twelve months, so a returning conversation makes sense. Records of paid work are kept as long as tax and accounting rules require. Guest data follows the retention period in section 04.

You can ask what is held about you, have it corrected, or have it deleted, and you can complain to your local data-protection authority. Ask by email and you will get an answer within 30 days. If you are a guest on someone's event page, that page's owner is the person to ask first — pass the request on and it will be actioned.

Everything is served over HTTPS. Access to the database is limited to the operator and to the server itself; guest lists are not readable from the browser. No payment card details are stored — payment is invoiced directly.

This notice may be updated. The date at the top reflects the most recent revision, and any significant change will be described rather than slipped in quietly.