Privacy Policy

Yalla Mabrook provides a website and mobile apps. The information collected depends on the features you use:

• Account details, such as your name, email, account identifier and authentication information

• Wedding and event details, invitation text, guest and invitee names, optional contact numbers, and RSVP information, including any messages or dietary details supplied through invitations

• Photos and other content uploaded through the website. The mobile app displays existing account photos and sends their image references to our service to prepare invitation previews; it does not offer a photo-file upload or camera feature

• If you choose a contact in the mobile contact picker, the app reads that selected contact’s name and first phone number to fill the guest form. Saving the guest sends those details to our service; the app does not upload your whole address book

• Optional gift-registry text, including bank or Whish account references you enter. We store these details with your wedding and may show them to the guests you choose. This is separate from paying for an account upgrade; the mobile Gifts feature does not transfer money

• Support and deletion requests, and the account details needed to respond to them

• Operating and security information, such as IP address, browser or device information, account and resource identifiers, request timing, errors, and approximate location derived from IP for authentication security

• The website and mobile apps offer Google and Apple sign-in alongside email/password sign-in. The selected provider supplies authentication information such as your sign-in identifier, email and name when available. Website signup and sensitive forms can also use reCAPTCHA bot protection

The website uses cookies and browser storage for sign-in and preferences. Optional analytics storage can be managed through Cookie Settings in the website footer.

The website uses PostHog for error diagnostics. Basic error reporting can run without analytics cookies. With analytics consent, website reports can be linked to your account and session recording can be enabled for debugging. Revoking that consent disables this additional storage and recording; it does not turn off necessary operating or security logs.

The mobile app stores session tokens using the device’s secure storage and caches some wedding and guest information locally. Signing out clears its saved query cache. The mobile app does not include a native PostHog analytics SDK.

Native invitation draft previews do not add the website’s PostHog error-reporting script. They can load fonts and display libraries from external providers, which receive the network information needed to serve those resources. If the app opens a website page in a browser, the website’s practices apply.

We do not use customer data for advertising profiles, sell it, or combine it with third-party data for advertising.

We use providers to operate and support Yalla Mabrook:

• AWS provides authentication, security monitoring, databases, photo storage, content delivery and some transactional email services. Cognito authentication security processes source IP and related security context

• Zoho provides support mailboxes and transactional messages, including alerts to our team about deletion requests

• PostHog processes website and public-invitation error diagnostics. Website analytics-consent settings control the additional account identification and session-recording features described above

• Google and Apple provide optional sign-in for the website and mobile apps, using the identity information you choose to share, such as your sign-in identifier, email and name when available. The mobile apps open the selected provider in the system browser; they do not collect your provider password. Google also provides website reCAPTCHA services

• Invitation previews can load Google Fonts, and use cdnjs/Cloudflare and jsDelivr to deliver display libraries. Resource requests can include IP address, browser information and referring-site information

• Whish Pay processes website Premium account upgrades. Payment card details entered directly with that provider are handled under its payment terms; we do not store those card details. Optional bank or Whish references entered in a wedding registry are different: our service does store that registry text

We use information to:

• Authenticate accounts, maintain sessions and provide wedding, guest, invitation and RSVP features

• Store and deliver the content you choose to include in your invitations

• Process website account upgrades and send transactional messages

• Respond to support and deletion requests

• Diagnose errors, maintain service performance and prevent fraud, abuse and security threats

• Understand service use through account-linked statistics compiled on our servers, such as account types and wedding and guest counts; this analysis is separate from advertising, tracking across companies and native-app analytics SDKs

• Meet applicable legal obligations

Our primary service infrastructure is in Frankfurt, Germany. Content delivery and service providers can process information in other locations.

We use HTTPS for information sent between the mobile app and our API and authentication services. We use access controls and provider storage protections to help protect stored information. These measures do not make information end-to-end encrypted or guarantee that every stored copy uses one particular encryption algorithm.

Operating logs can include request and error context; some service logs can also contain submitted account or invitation details. We restrict access to this information for operating, support and security purposes.

No method of transmission or storage is completely secure. We cannot guarantee absolute security.

We do not sell, trade or rent customer information, or share it for advertising or marketing.

We provide information to the services needed to operate and support Yalla Mabrook, as described above. We also share the invitation information you choose with your invited guests. When you use a share or WhatsApp action, the selected link, message and any chosen recipient information go to that service at your direction.

Information may be disclosed where required by law or to address abuse and security threats. We do not otherwise export customer data to unrelated businesses.

Under GDPR and data protection laws, you have the following rights:

• Right to Access: Request a copy of all your data by contacting us at privacy@yallamabrook.com

• Right to Rectification: Edit your information anytime in Settings

• Right to Erasure ('Right to be Forgotten'): Ask us to delete your account and all associated data

• Right to Data Portability: Receive your data in a machine-readable format on request

• Right to Restriction: Opt-out of email notifications and analytics cookies

• Right to Object: Contact us to object to specific processing activities

• Right to Withdraw Consent: Revoke consent for optional features (Google Sign-In, analytics cookies)

To exercise these rights, visit your account Settings or contact us at privacy@yallamabrook.com

To request account deletion from the mobile app, open Settings and choose Request account deletion. You do not need to open an email app. If you cannot use the app or have already uninstalled it, email privacy@yallamabrook.com and identify the account you want deleted. Email is an alternative request route, not a requirement for the in-app request.

We retain account and wedding information while it is needed to provide the service. You can request account deletion at any time.

Our team will process your request manually, delete your account and associated customer content within 30 days of receiving the request, and email you when it is complete. Sending a request does not immediately delete the account; it remains available until the team processes it.

Manual fulfillment includes account, wedding, guest and media information, associated personal information in support and deletion-request records, and related staff email copies. We do not keep a separate business record of this customer information after fulfillment.

Automatic backups and operating or security logs follow their own retention schedules and can remain after the active account is deleted. Our automated database backup setting is seven days; automatically retained older file versions have separate storage schedules. This is not a promise that every backup or stored version is erased at the moment of account deletion.

Security providers also have separate retention. For example, AWS Cognito normally retains authentication-event history for two years. Deleting an active account does not mean that every provider security record or diagnostic log is erased immediately. These retained copies are not used for advertising or to keep an active customer account.

Contact privacy@yallamabrook.com for questions about a deletion request, the information covered, or these backup and security exceptions.

Your data is primarily stored in the European Union, but may be transferred internationally:

• Primary Region: EU (Frankfurt, Germany)

• CDN Distribution: Edge locations worldwide for fast loading

• Cloud Infrastructure: Standard Contractual Clauses (SCCs)

• Google Services: Subject to Google's privacy policies and data processing terms

• Safeguards: We ensure adequate protection through contractual obligations and technical measures

If you are located in the EU/EEA, your data is protected under GDPR when transferred to third countries.

Our service is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@yallamabrook.com and we will delete such information.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by:

• Posting the updated policy on this page with a new 'Last updated' date

• Sending an email notification to your registered email address (for significant changes)

• Displaying a notice on our website or dashboard

Your continued use of our service after changes become effective constitutes acceptance of the updated Privacy Policy.