What we collect
In short: Account details from couples, and RSVP answers from guests. Guests never need an account.
From couples (account holders): your name, email address, and a securely hashed password. If you sign in with Google, we store OAuth tokens to maintain your session. We also store the invitation content, event details, photos, media you upload, and any support conversations you create.
From guests: guests never create a Ceremo account. Guest names, RSVP responses, and dietary notes are stored under the couple’s invitation and linked to the RSVP token used to respond. When a guest is checked in on event day, we record the arrival timestamp. If a guest uploads photos, we store the optional uploader name and captions they provide.
From everyone: we log IP addresses for rate limiting and security audits. A random browser identifier is stored in your browser’s local storage to track photo likes — this is not tied to any account. Page views and performance data are collected by analytics services in production (see Other services we use, below).
How we use it
In short: Only to run Ceremo for you. Never for advertising.
We use your data only to run Ceremo. Specifically, we use it to:
- display your invitation page and process RSVP responses,
- handle account access, email verification, and password resets,
- power features like guest exports, timelines, seating charts, event day check-in, photo sharing, seat finder, video embeds, and your dashboard.
We do not use your data for advertising or sell it to third parties.
How long we keep it
In short: As long as your account is active. Payment and security records are kept longer, as the law requires.
Your data is kept while your account and invitation are active. You can export your guest list anytime from the dashboard. If you delete your account, we remove your personal data and invitation content from active systems. Payment records are retained for legal and audit purposes.
Audit logs recording security-relevant actions (login, password change, account deletion) are retained separately for fraud prevention.
Your rights under Philippine law
In short: The Data Privacy Act of 2012 (RA 10173) gives you rights over your data, and we uphold every one.
Ceremo operates under the Republic of the Philippines and complies with the Data Privacy Act of 2012 (Republic Act No. 10173). As a data subject, you have the following rights:
- Right to be informed — to know how your personal data is being collected, processed, and stored (this policy serves that purpose).
- Right to access — to request a copy of the personal data we hold about you.
- Right to correction — to have inaccurate or incomplete data corrected.
- Right to erasure or blocking — to request deletion or blocking of your data when it is no longer necessary for the purpose it was collected, or if processing is unlawful.
- Right to object — to object to data processing based on consent or legitimate interest, including direct marketing.
- Right to data portability — to receive your data in a commonly used electronic format. You can export your guest list and event data from the dashboard at any time.
- Right to file a complaint — if you believe your data privacy rights have been violated, you may file a complaint with the National Privacy Commission (NPC) at privacy.gov.ph.
To exercise any of these rights, contact us through our support page or email us at hello@useceremo.com. We will respond within 30 days.
Data breach notification: in the event of a personal data breach that is likely to affect your rights, we will notify the NPC and affected data subjects within 72 hours of becoming aware of the breach, as required by RA 10173 and NPC Circular 16-03.
Your controls
In short: Change most things yourself from your dashboard. For anything else, write to us.
From your dashboard, you can update your name, change your email, reset your password, and manage all invitation content. To request full data deletion or ask a privacy question, contact us through our support page.
Keeping it safe
In short: Several layers of protection keep your data from being seen, lost or misused.
We protect your data through multiple layers of security:
- Passwords are securely hashed and never stored in plain text.
- Session tokens use HTTP-only, secure cookies.
- RSVP magic links use cryptographically random tokens with SHA-256 hashed storage.
- All data is transmitted over HTTPS.
- API endpoints are protected with authentication, role-based access control, and rate limiting.
- Input validation is enforced at all system boundaries to prevent injection attacks.
No system is perfectly secure. If you discover a security vulnerability, please report it through our support page and we will investigate promptly.
Other services we use
In short: Some features load content from other companies, who follow their own privacy policies.
When you or your guests use Ceremo, the following third-party services may process data:
- Google Analytics, Vercel Analytics & Speed Insights — page view analytics and performance monitoring in production.
- Resend — email delivery for verification, notifications, and invitations.
- Stripe — payment processing. Payment details are handled on their pages.
- Google Maps — venue location display on invitation pages.
- Google Sheets — guest list import and export, only when you connect it.
Video embeds: if the couple adds a video to their invitation page, guests’ browsers load content directly from YouTube, Vimeo, or Facebook. These providers may set their own cookies and collect viewing data under their own privacy policies. Ceremo does not control what these providers collect.