Privacy Policy

Last updated: 11 October 2026

This is an English translation provided for information. In case of any difference between versions, the Romanian version prevails.

MAHÉ Moments is a digital invitation service with RSVP. On this page we explain, in plain language, what data we collect, why, how long we keep it and what rights you have.

Who is responsible for your data

The data controller is Ciobanu Daniel-Marius, a private individual who runs the MAHÉ Moments service on the website mahe.ro. For any question about your data, you can write to us at moments@mahe.ro.

What data we collect

From hosts (the people who create an invitation):

• the content of the invitation: names, date, texts, venues, and the names of godparents, parents or other people you choose to mention;
• the photos you upload to the invitation;
• the link to a video message hosted on YouTube or Vimeo, if you choose to add one;
• the email address where you choose to receive notifications about replies (optional);
• the guest list, if you choose to use it: guests' names and, optionally, their phone numbers and the number of seats reserved;
• replies you received from guests in person or by phone, if you choose to note them in the dashboard: the name, whether they are coming and how many people;
• the event budget, if you use it: expenses, suppliers, amounts and payment dates. Only you can see it, not co-hosts or guests;
• the seating plan, if you use it: the tables, the guests seated at each table and guests added manually (name, number of adults and children, menu, allergies);
• the account details for gifts, if you choose to turn this option on: the account holder, the IBAN, the bank and a short message;
• the accommodation information you offer your guests, if you turn this option on: recommended places, their distance from the venue, their contact details and details for guests;
• co-hosts, if you give them access: the name or description you choose (for example “Godparents”), their access level and when they last used their link.

From guests (the people who reply):

• your name and your reply (attending or not);
• the number of adults and children, the menu chosen and your message to the hosts, if the host has turned these fields on;
• allergies or dietary needs, only if you choose to fill them in;
• if you received a personal invitation link: when you opened it and how many times, so the hosts know who has seen the invitation;
• the songs you suggest for the DJ or band and your dedication, if the host has turned this option on;
• your accommodation request, if you need accommodation and the host has turned this option on: the number of people, whether a baby cot is needed, the number and type of rooms, your preferred place, arrival and departure dates, means of transport, approximate arrival time, who you are sharing the room with and your notes;
• the message you choose to send the hosts after replying that you cannot come;
• at gender reveal parties, the team you pick (boy or girl), if you choose to guess.

Gifts by bank transfer: if the host has turned this option on, their account details are shown only to guests who choose to see them. MAHÉ does not handle payments and does not see transfers. We do not record who opened the gift section or what they chose there.

Technical data: like any website, the server automatically records your IP address and information about your browser, for the operation and security of the service.

Why we use the data

• To create and display the invitation and to pass the replies received on to the hosts. The legal basis is the performance of the service you requested.
• For the guest list: names and phone numbers are used only to generate personal links and messages that the host sends personally, from their own WhatsApp. We do not send messages to guests. The legal basis is the host's legitimate interest in managing their event.
• To send the host email notifications for each reply, if they have turned this option on, and a single reminder email about a month before the data is deleted, so they can download their keepsake. The legal basis is their consent, given by entering their email address.
• For songs, accommodation, gifts and messages sent after declining: so the information you fill in reaches the host, and the gift account details reach only the guests who ask for them. The legal basis is the performance of the service requested by the host and your choice to fill in these fields.
• For co-hosts: so the people chosen by the host can help them. We keep the date a link was last used so the host knows whether the access is being used. The legal basis is the host's legitimate interest in organising their event together with the people close to them.
• Information about allergies is health data. We process it only on the basis of your explicit consent, which you give by filling in the field, and solely so that the hosts can choose the right menu.
• For security: preventing abuse and automated messages. The legal basis is our legitimate interest in keeping the service safe.

We do not sell data, we do not use it for advertising and we do not do profiling.

Who has access to the data

• The host of the invitation sees the replies received, including songs, accommodation requests and messages, through their private dashboard.
• Co-hosts given access by the host see the replies, the guest list, the seating plan and the print materials; those with “view and help” access can also change the list and the seating plan. The host can revoke access at any time.
• Guests see the content of the invitation, only if they have received the link.
• Our technical providers, who process data strictly on our behalf: Google (storing data and photos in Google Sheets and Google Drive) and our web hosting provider in Romania, which also sends the notification and reminder emails, from the address moments@mahe.ro. Google may also process data outside the European Union, based on the safeguards provided by European law.
• YouTube or Vimeo, only if the invitation has a video message. The video loads from them only when a guest taps it, and from that moment their privacy policy also applies. The video stays in the host's own account, where they can delete it at any time.
• We do not pass accommodation requests on to places to stay. The host decides how to use them.

How private invitations are

• Every invitation has a unique link that is impossible to guess.
• Invitation pages do not appear in search engines.
• Photos are visible only to the people who receive the invitation link.
• The replies dashboard is protected by a secret key known only to the host.

How long we keep data

We keep the invitation, photos and replies for up to 6 months after the date of the event, so hosts have time to review the replies and download the list. After this period, the data is deleted, including songs, accommodation requests, messages, the seating plan, co-hosts and gift account details. The downloadable keepsake (the PDF and photos) is created directly in the host's browser; the downloaded files stay with the host, on their device. The host can ask for earlier deletion at any time by writing to us at moments@mahe.ro.

Reviews

If you leave us a review from the host dashboard, we keep it separately from the invitation. We publish it on the website only if you ticked the consent to publish and only after we have checked it. You can ask us at any time to change or delete it, at moments@mahe.ro.

Photos of children and other people

If you upload photos of other people, including children, please do so only if you have the right to publish them, for example as a parent or with the consent of the people concerned. The same goes for video messages. If you appear in an invitation and want a photo or video removed, write to us and we will remove it from the invitation.

Cookies and local storage

We do not use tracking, advertising or analytics cookies. We only use the browser's local storage for strictly necessary functions: remembering that you have already sent a reply and the options that follow it, your chosen language, WhatsApp messages personalised by the host, or an invitation you saved, so you can continue it on the same device. This information stays on your device.

Your rights

Under Regulation (EU) 2016/679 (GDPR), you have the right:

• to find out what data we hold about you and to receive a copy;
• to ask for it to be corrected or deleted;
• to ask for processing to be restricted or to object to it;
• to receive your data in a format that is easy to transfer;
• to withdraw your consent at any time, without affecting processing carried out before then.

For any of these rights, write to us at moments@mahe.ro. We reply within 30 days at most. If you are a guest, your request can concern your reply to a specific invitation: please mention your name and the name of the event.

You also have the right to lodge a complaint with the Romanian data protection authority (ANSPDCP), www.dataprotection.ro.

Security

We use encrypted connections (https), secret keys for hosts' access and measures against automated messages. No system is perfect, but we treat your data with care and will let you know if a problem arises that concerns you.

Changes

If we update this policy, we publish the new version here, with the date of the update. For important changes, we notify the hosts who receive email notifications.