Privacy Policy
Last updated: October 2026
SMOOU ("we", "us", "our") operates the SMOOU web application available at smoou.app (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data in accordance with the EU General Data Protection Regulation (GDPR — Regulation 2016/679) and Italian Legislative Decree 196/2003 as amended.
1. Data Controller
The data controller is Gianluca Suarato, residing in Italy. For any privacy-related request, you can contact us at the email address listed in Section 12.
2. Legal Basis for Processing
We process personal data on the following legal bases under Art. 6 GDPR:
• Consent (Art. 6(1)(a)) — for analytics cookies (Google Analytics). You can withdraw it at any time from Cookie settings at the bottom of the page or on this page.
• Contract performance (Art. 6(1)(b)) — to provide the Service to hosts (account, invitations, replies) and to deliver a guest's reply to the host they are replying to.
• Legitimate interest (Art. 6(1)(f)) — for security and abuse prevention (including sign-in protection) and for cookieless, aggregated performance statistics.
3. Data We Collect
Authentication data: When you sign in with Google OAuth, we receive your name, email address, and profile picture from Google. If you sign in with TikTok (where available), we receive your TikTok display name, profile picture and a TikTok user ID; TikTok does not share your email address or your videos. If you sign in with email/password, we store a hashed password — we never store passwords in plain text. For security purposes, we also store your IP address and browser user-agent string with each session (legal basis: legitimate interest, Art. 6(1)(f)).
Invitation and reply data: the invitations you create (title, date, time, location, description, icon, colours, font, reply settings) and the replies your guests send. A reply contains the guest's name — for children's parties, the child's first name and the name of the parent replying — whether they are coming, the number of adults and children, and, only if the guest chooses to add them, an email address, phone number and a note. Google Analytics collects device and browser information only with your consent.
Moderation data: If your account is suspended for violating our Terms, we store the suspension status, reason, and expiry date.
Temporary data: Email verification and password reset tokens are stored temporarily and automatically expire.
We do NOT collect: payment or financial information (the Service is entirely free), precise geolocation, sensitive/special category data, or data from social media profiles beyond what Google or TikTok sign-in provides.
Guest data: guests reply without an account. We process their reply only to deliver it to the host, who can see and edit it in their dashboard. Guests see a link to this policy before sending. A guest can ask us, at the address in Section 12, to correct or delete their reply.
4. How We Use Your Data
We use your data exclusively to:
• Provide the Service — create and manage invitations, collect replies and show them to the host, and send the emails needed to use your account (via Resend).
• Keep the Service secure — prevent abuse and protect sign-in.
• Improve the Service — aggregated statistics (Google Analytics only with your consent; Vercel Web Analytics and Speed Insights without cookies).
• Communicate — answer your support or privacy requests.
We do not sell, rent, or share personal data for advertising or marketing.
5. Third-Party Processors
We use the following third-party services to operate SMOOU. Each acts as a data processor under Art. 28 GDPR:
• Vercel Inc. (USA) — hosting and serverless infrastructure, plus Vercel Web Analytics and Speed Insights, which measure visits and page performance without cookies. Covered by Vercel's Data Processing Addendum and EU Standard Contractual Clauses.
• Turso (ChiselStrike Inc., USA) — database hosting. Data is stored in a database located in Dublin, Ireland (EU).
• Better Auth (better-auth.com) — sign-in infrastructure: security checks against bots and abuse (using IP address and browser characteristics) and a log of sign-in activity.
• Google LLC (USA) — Google sign-in, and Google Analytics for usage statistics (only with consent). Covered by the EU-US Data Privacy Framework.
• TikTok Technology Limited (Ireland, EU) — TikTok sign-in, only if you choose it. For your TikTok account itself TikTok is an independent controller under its own privacy policy.
• Resend Inc. (USA) — transactional email delivery. Processes only the email address and message content, covered by its DPA.
6. International Data Transfers
Your primary data is stored in Ireland (EU) via Turso. Some processors (Vercel, Google, Resend, Better Auth) may process data outside the EU, including in the United States. These transfers are protected by:
• The EU-US Data Privacy Framework (where applicable).
• EU Standard Contractual Clauses (SCCs) under Art. 46(2)(c) GDPR.
You can request a copy of the relevant safeguards by contacting us.
7. Data Retention
• Account data: kept while your account is active. When you delete your account (from your profile), your personal data, invitations and their replies are permanently deleted within 30 days.
• Invitations created without an account: deleted automatically, with their replies, 7 days after the event (or after 24 hours if no invitation was created).
• Guest replies: 6 months after the event, names, contact details and notes are permanently removed. Only the number of adults and children is kept, so past invitations still show their totals.
• "Remember my reply" cookie: kept in the guest's browser for up to 12 months. It holds only a reference to the reply, not its content.
• Analytics data: Google Analytics data is kept for 14 months, then deleted automatically.
• Server logs: automatically purged by Vercel after 30 days.
8. Cookies
Strictly necessary cookies are always active, because the Service cannot work without them: your sign-in session, your language, your cookie choice and, for guests, a cookie that remembers which reply this browser sent so you can see and change it. They need no consent (Art. 122 of the Italian Privacy Code). Statistics cookies (Google Analytics) are optional: Google Analytics is not loaded at all until you accept them, and Reject and Accept are offered side by side. Closing the banner counts as a refusal. Your choice is stored for 6 months, after which we ask again. You can change it at any time from Cookie settings at the bottom of every page or with the link below the table. We use no advertising or profiling cookies.
Cookies we use
| Name | Purpose | Type | Duration |
|---|---|---|---|
| smoou_consent | Stores your cookie choice | Strictly necessary | 6 months |
| NEXT_LOCALE | Remembers your language | Strictly necessary | Session |
| better-auth.* | Keeps you signed in and protects sign-in | Strictly necessary | 7 days |
| better-auth.last_used_login_method | Remembers how you last signed in (e.g. Google), to show it first | Strictly necessary | 30 days |
| rsvp_<invite id> | Remembers which reply this browser sent (guests) | Strictly necessary | 12 months |
| _ga | Google Analytics: tells visits apart | Statistics (consent) | 13 months |
| _ga_<id> | Google Analytics: keeps the session count | Statistics (consent) | 13 months |
9. Your Rights Under GDPR
Under Articles 15–22 of the GDPR, you have the right to:
• Access — obtain a copy of your personal data (Art. 15).
• Rectification — correct inaccurate data (Art. 16).
• Erasure — request deletion of your data ("right to be forgotten", Art. 17). Hosts can do this directly from their profile page; guests can write to us.
• Restriction — restrict processing in certain circumstances (Art. 18).
• Data portability — receive your data in a structured, machine-readable format (Art. 20). Write to us and we will send it within one month.
• Object — object to processing based on legitimate interest (Art. 21).
• Withdraw consent — at any time, without affecting the lawfulness of prior processing (Art. 7(3)).
Right to Lodge a Complaint
If you believe your rights have been violated, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Roma, Italy — www.garanteprivacy.it.
10. Children's Data
The Service is for adults and is not directed at children under 16; children cannot create accounts. For children's parties, the parent or guardian replying may enter their child's first name, which the host sees so they know who is coming. We collect no other data about children, use it only to deliver the reply to the host, and remove it 6 months after the event. A parent or guardian can ask us to delete it at any time, and we will do so promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you by updating the "Last updated" date at the top of this page. Material changes will be communicated via a notice on the Service.