Privacy Policy

We collect the following information when you use our services:

• Account Information: Name, email address, password (stored in encrypted form), and profile picture (if logging in via Google).
• Wedding Website Content: Partner and parent names, event dates and venues, event details, uploaded photos, and music links.
• Guest RSVP Data: Guest name, phone number (optional), attendance status, headcount, wishes, and answers to custom questions set by the couple.
• AI Chat Logs: Messages sent to our AI assistant. If you are not logged in, conversations are linked only to a random ID stored in your browser, not to any account.
• Pre-Signup Drafts: If you try the website builder without an account, your draft is kept in your own browser until you register.
• Payment Information: Payer name, email, phone number, and transaction reference from ToyyibPay. We never see or store your card or banking details.

Your data is used to:

• Service Delivery: Create and display your wedding website, and manage guest RSVPs.
• Guestbook: If a couple shows the guestbook, guests' names and wishes are shown to invitation visitors as soon as they are sent, and the RSVP form says so. The couple can hide any wish at any time. Phone numbers, attendance status and other answers are never shown.
• Payment Processing: Securely process transactions through ToyyibPay.
• Communication: Send account verification, email change, password reset, and payment confirmation emails.
• Premium Service: If you buy Premium, the WhatsApp number, wedding details and files you share are used only by our designer to build your invitation and to contact you about it. Uploaded files are kept privately and are never shown to guests unless they become part of your invitation.
• AI Assistance: Provide relevant responses through our AI assistant and improve its quality.
• Analytics: Understand platform usage through aggregate statistics to improve the service.

We use trusted third-party services:

• Supabase: Database hosting and file storage (including uploaded photos).
• Vercel: Application hosting and website delivery.
• Google OAuth: Social login - we receive your email, name, and profile picture.
• ToyyibPay: Payment gateway - processes your name, email, phone, and transaction.
• Resend: Email service - sends transactional emails to your address.
• Google Gemini AI: AI assistant - processes your chat messages.
• Google Analytics: Website analytics - collects aggregate usage data.

Most of these providers operate outside Malaysia, so your data may be stored and processed abroad. We choose providers that maintain recognised data protection standards.

We use cookies and browser storage for:

• Session Cookies: Maintain your login status while browsing.
• Analytics Cookies: Google Analytics to understand site usage.
• Language Preference Cookies: Remember your language choice (Malay or English) for one year.
• Blog Referral Cookies: Remember which blog article brought you to the site (expires after 30 days).
• Browser Storage (localStorage): AI chat session ID, chat feedback, and your website draft before you register.

You can control cookies through your browser settings, but this may affect certain functionality.

How long your data is kept:

• Website & Related Data: Your wedding website, guest RSVPs (including guest phone numbers) and photos, and the details and files you hand over for Premium, are kept until you delete your account.
• Account Deletion: You can delete your account at any time via Settings in the dashboard. This immediately deletes your account, website, RSVPs, photos, Premium details, chat history, and payment records.
• Conversations Without an Account: Anonymous AI chat logs are not linked to an account. To have them deleted, contact us at hello@kahwinstudio.com.

We take your data security seriously:

• Database Encryption: All data is stored on Supabase with encryption in transit and at rest.
• Password Encryption: Passwords are encrypted using bcrypt before storage.
• Private Photo Storage: Photos live in private storage and are served through time-limited links that expire automatically.
• Rate Limiting: Protection against brute force login attempts and API abuse.
• Security Headers: XSS protection, clickjacking prevention, and HSTS configured.
• Email Verification: Required before account access to prevent fake accounts.

Under Malaysia's PDPA, you have the right to:

• Access: Request a copy of your personal data that we hold.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Delete your account and personal data yourself via Settings in the dashboard, or ask us to do so.
• Withdrawal of Consent: Withdraw consent for data processing at any time.

To exercise these rights, please contact us at hello@kahwinstudio.com.

A wedding website holds other people's data, not just your own. When guests submit an RSVP, you as the couple decide what is collected and how it is used.

• You Set the Questions: RSVP fields and custom questions are your choice. We only store what is submitted through them, so ask for what you actually need.
• Limited Use: Use guest details for your wedding only, not for other purposes or to share with third parties.
• Guestbook: If you show the guestbook, guests' wishes are shown to everyone who visits your invitation as soon as they are sent. Hide any wish that isn't right for them; hidden wishes stay in your dashboard and printed wishes book only.
• Family & Children: Wedding guest lists usually include children. For them, a name and headcount is enough.
• CSV Export: You can download your RSVPs as a CSV file. Once downloaded, that copy is in your care.
• Accounts Are for Adults: Kahwin Studio accounts are for those aged 18 and above. Guests do not need an account to RSVP.
• Deletion Requests: Guests can ask you to delete their RSVP from the dashboard, or contact us at hello@kahwinstudio.com.

We may update this privacy policy from time to time. Any changes will be posted on this page with a new "Last updated" date. We encourage you to review this page periodically for any changes.

For significant changes, we will display a prominent notice on the platform before they take effect.

If you have any questions about this privacy policy or our data practices, please contact us at:

Email: hello@kahwinstudio.com