Privacy Policy

Wavu is a service operated by Tomas Orban (Orban Consult), a self-employed natural person based in Belgium (Company No./VAT BE 1032.258.657). This policy describes how we collect and process your personal data in accordance with the GDPR.

1. Data controller

Tomas Orban (Orban Consult) - Company No./VAT BE 1032.258.657 - privacy@orbanconsult.be

2. Data collected

• Organisers: email address (authentication), optional name, billing info processed by Stripe.
• Guests: pseudonym, message content, uploaded photos.
• Technical data: IP address (security, fraud prevention), strictly necessary session cookie.

3. Purposes and legal bases

• Display messages and photos on the event wall - guest consent.
• Moderation by the organiser - legitimate interest.
• Billing and paid feature access - contract performance.
• Service security and abuse prevention - legitimate interest.

4. Processors

• Cloudflare Inc. - hosting, CDN, object storage (R2), and database (D1). DPA at cloudflare.com/cloudflare-customer-dpa.
• Stripe Payments Europe Ltd - payment processing.
• Resend, Inc. - transactional email (magic links).

These providers may process your data outside the EU under standard contractual clauses.

5. Retention

Event messages and photos: automatically deleted 30 days after the event ends. Account data: kept while the account is active, deleted within 30 days of a deletion request. Billing data: 7 years (Belgian accounting law).

6. Your rights (GDPR)

You have the right to access, rectify, erase, port, and object. Organisers can export their data (/api/users/me/export) and delete their account directly from their dashboard. For any other request: privacy@orbanconsult.be.

You also have the right to lodge a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be).

7. Cookies

Wavu uses only a strictly necessary session cookie for authentication. No third-party advertising or tracking cookies.

8. Contact

Tomas Orban (Orban Consult) - email: privacy@orbanconsult.be