Last updated 5 November 2026
Sealdate is operated by SAMIODA, obrt za e-trgovinu i IT usluge (sole proprietor Adrijan Omićević), Rudeška cesta 240, 10000 Zagreb, Croatia. OIB: 75623260553. Contact: hello@sealdate.com. This entity is the data controller for your account data and the data processor for guests’ RSVP data (see below).
Account: your email address (passwordless sign-in). Invitation: the content you enter yourself. Guests: the name, email, message and number of companions a guest provides when confirming attendance — visible only to the invitation’s owner.
Solely to run the service: displaying the invitation, sending confirmations by email (Resend), SMS messages to guests when the organiser turns them on (Infobip), processing payments (Stripe) and anonymous visit statistics (Plausible, no cookies). We do not use guest data for anything else and do not share it with third parties for marketing.
Only with your consent in the cookie bar do we load advertising cookies from Meta (Meta pixel), LinkedIn (Insight Tag) and Google (Google Ads). We use them to measure how many visits and enquiries come from our ads. Without your consent, the Google tag still runs in Google Consent Mode: it sets no cookies and sends Google only anonymous signals, for example that an enquiry was sent after an ad click, so it can estimate how well our ads work. If you arrive from an ad or campaign link, we store the ad click ID and campaign tags with your enquiry. We never load them on guest invitations. You can change your choice with the “Cookies” link in the page footer.
For guests’ RSVP data the invitation owner is the data controller (they decide who to invite and what happens with the responses), and sealdate is the data processor — we process the data only on the owner’s behalf, to run the service. The terms of that processing are set out in the data processing agreement (DPA) that forms part of the Terms of Service.
On the “On the day” page and the kiosk, guests can send photos and voice messages with their name and consent. For these, the invitation owner is the controller and sealdate is the processor, as for RSVP data.
The hosts see the photos and messages. Other guests see them in the album and on the wall, depending on the host’s setting: at once or only after approval. On upload we remove location (GPS) and camera data (EXIF). Files are kept in private storage in the EU.
We delete them 30 days after the event, or 12 months after the event if the host bought the “Memories” add-on. The host gets a download reminder 7 days before deletion. Guests can delete their own photos and messages at any time, or write to privacy@sealdate.com.
Guests’ personal data (name, email, companions’ names, message) is automatically anonymised 12 months after the invitation is archived — only aggregate figures remain (the number of attendees). The invitation owner can delete an individual response earlier. Payment data is kept for as long as tax regulations require.
You can export and delete data at any time (guest export in the dashboard; account deletion on request). Contact: hello@sealdate.com.
If you are a guest who confirmed attendance and you want access to your data or its deletion, write to privacy@sealdate.com — we will forward the request to the invitation owner or carry it out ourselves within the statutory deadline.
We send short business messages about Sealdate from adrijan@sealdate.hr to companies in Croatia and Slovenia, and only to legal entities. The controller is SAMIODA (details above).
Source of the data. We do not get this data from you but from public sources: the business listing on Google Maps (Google Places) and your company’s public website. Every message names the page where we found the address.
What data. Company name, domain, city, country, phone and business email address from the website, a person’s name when it is published next to that address, legal form, logo and colours, and facts from your website (for example the kinds of events you run) with a link to the source. From these we build a fit score (0-10), the first sentence of the message and a demo invitation. We keep the messages we send and your replies. When you open the demo page built for you, we record the time of the visit, the page and whether the page was visible and viewed, without cookies and without your IP address.
Purpose and legal basis. The purpose is to offer the service to a company that could use it. The legal basis is legitimate interest (GDPR Art. 6(1)(f)), together with the rules on messages to legal entities (Art. 50(4) of the Croatian Electronic Communications Act, Art. 226 of the Slovenian ZEKom-2). We send at most three messages in one thread. The score has no legal effect on you.
Recipients. Google Workspace (Gmail, sending and receiving messages), Google Places (finding companies), OpenAI (the GPT model reads the public text of your website and suggests the score and the sentence), Supabase (database, EU region) and Vercel (hosting). Google and OpenAI may process data outside the EU under standard contractual clauses or the EU-US Data Privacy Framework.
Right to object. You can object at any time and without giving a reason: reply ODJAVA (unsubscribe), click the unsubscribe link in the message or write to privacy@sealdate.com. After that we do not write to you again. We then keep the address or domain only on a suppression list, so that we never write to it again. You also have the right of access, rectification, erasure and restriction, and the right to complain to the Croatian data protection authority (azop.hr) or the authority in your country.
Retention. We keep data about a company that did not reply for at most 24 months after the last message. If you become a customer, the account rules above apply.
Database and storage: Supabase (EU region). Hosting: Vercel. Email: Resend. SMS: Infobip (processed in the EU). Payments: Stripe.