Privacy Policy

The legal and contact information of the Stumrebi (stumrebi.ge) data controller appears at the end of this document.

For privacy enquiries, email info@stumrebi.ge.

This Policy is effective from July 30, 2026.

Account data: name, email address, profile image, and technical authentication identifier.

Project data: the couple’s names, event date, venue, schedule, text, photos, video, audio, and design settings.

Guest data: name, telephone number, group, invitation status, RSVP response, and companion information.

Payment and order data: selected package, amount, currency, status, date, and transaction or order identifier. We do not store full card details.

Technical and security data: IP address, device and browser data, request logs, consent records, and records of significant account actions.

The legal basis for processing depends on the purpose and category of data:

Performance of a contract and pre-contractual steps requested by you: account creation, invitation creation and hosting, RSVP, order processing, support, and service delivery.

Legal obligation: accounting and tax records, responding to consumer requests, and lawful requests from competent authorities.

Legitimate interests: protecting the Service, preventing fraud, maintaining technical reliability, and aggregated analytics where those interests are not overridden by your rights.

Consent: for processing that requires consent by law. You may withdraw consent at any time; withdrawal does not affect processing lawfully carried out beforehand.

When you sign in with Google, we receive your name, email address, profile image, and authentication identifier to create and protect your account.

We do not request access to your Gmail, contacts, calendar, or Google Drive.

We do not sell data received from Google, use it for advertising profiles, or use it to train our own AI model.

At your explicit request, a photo or other content may be sent to a third-party AI service, including Google Gemini, Veo, or Lyria, to generate the requested result.

Original files are stored in protected storage. Only content you publish becomes publicly accessible.

We do not sell the data or use it to train our own AI model. Third-party processing is also subject to that provider’s terms and security practices.

We process guest data you add on your instructions to share invitations, collect RSVP responses, and send messages that you initiate.

You are responsible for obtaining and using guest data lawfully. We do not send our own promotional messages to guests.

Supabase — database, authentication, and file storage; Vercel — web hosting; Google — authentication and requested AI features.

Brevo — transactional email; SMSOffice — SMS messages initiated by you; payment service provider — payment authorization and transaction status.

We provide each supplier only the data needed for its service. We do not sell data.

Data may be disclosed to a competent authority only where provided by law.

Some technical providers may process data outside Georgia.

In that case, we use a transfer basis permitted by applicable law and appropriate safeguards, including contractual protections where required.

We retain account and project data while the account is active and for as long as needed to provide the Service.

After a deletion request, data is removed from active systems within a reasonable technical period and may remain in backups for a limited time.

Accounting, tax, transaction, consent, and security records are retained for the period required by law or necessary to establish or defend a legal claim.

The precise period depends on the data category and processing purpose. When the period expires, we delete or anonymize the data.

You have the right to information about processing and a copy of your data; to request correction, updating, deletion, cessation or restriction of processing; and, where applicable, data portability.

You may object to processing based on legitimate interests and withdraw consent.

To exercise a right, email info@stumrebi.ge. We may reasonably verify your identity before fulfilling the request.

You have the right to apply to the Personal Data Protection Service of Georgia or a court.

We use access controls, encrypted connections, authentication, logs, and other organizational and technical safeguards appropriate to the risk.

Absolute security of data transmitted over the internet cannot be guaranteed. If a material incident occurs, we will act as required by law.

We use cookies necessary to operate the Service, including to maintain a session and remember the selected project.

If we add non-essential analytics or marketing cookies in the future, we will provide relevant information in advance and, where required, a consent choice.

We will notify you by email or through the platform of material changes to this Policy. The current version date will always appear on this page.

If the Georgian and English versions differ, the Georgian version prevails unless mandatory law requires otherwise.