Who we are
OhTooWon Limited, trading as Bopplo.com ("Bopplo", "we", "us"), an Irish company (CRO 817254, VAT IE4746250WH), with its registered office at 119 The Oaks, Maryborough Ridge, Douglas, Cork T12 TF38, Ireland.
This notice explains what personal data Bopplo, and the hosts who use it, hold about you, why, and what you can do about it — whether you have a Bopplo account, or you are a guest who has never signed up for anything.
Who is responsible for your data
For your own account — your name, your login, and the occasions you run — OhTooWon Limited is the controller: we decide what it is used for and we answer for it.
For guest data a host enters or uploads — a guest list, contact details, RSVP answers — the host is the controller and Bopplo is the processor, acting only on the host's instructions. If you're a guest, this means you can raise a question with either the host who invited you or with us at privacy@bopplo.com.
What we hold, and why
Hosts, planners and helpers (people with a Bopplo account)
Your name and email address, held by our sign-in provider Clerk; the occasion details you type in (host names, title, date, location, a message to guests, a reply-to email address); and a record of which occasions you are a host, planner or helper on.
Why: To run your Bopplo account and the occasion(s) you plan. · Lawful basis: performance of a contract with you (b)
Guests — the people a host invites
The name, email address, phone number and, where a host records one, a postal address for each invitation and person on a guest list, entered or uploaded by the host who is inviting you.
Why: So the host can send an invitation and the reminders they choose to send. · Lawful basis: the host's legitimate interest in inviting their own guests (f) — see "Guests who never signed up" below
Guests who reply
Your RSVP answer for each person on your invitation, when you recorded it and any note you type on the reply form, submitted by you through your invitation link.
Why: So the host knows who is coming. · Lawful basis: the host's legitimate interest in running their occasion (f); you provide the answer yourself by using the reply form
Guests who are coming, when the hosts ask about food
Each person's dietary requirements — for example an allergy, a medical diet, or vegetarian, halal or kosher — an optional note, and their meal choice. Some of this is health information, and some can reveal a religious belief.
Why: So the hosts and their caterer can plan the food. · Lawful basis: your explicit consent (Art. 9(2)(a)), given by ticking the box on the reply form before your requirements are saved
Suppliers a host works with — a venue, a florist, a photographer
The supplier's name, a contact name, email address, phone number and website, and any notes, entered by the host.
Why: So the host can keep track of who they have booked and how to reach them. · Lawful basis: the host's legitimate interest in organising their occasion (f)
Anyone who signs up for save-the-date news
Your email address and, optionally, your name.
Why: To tell you news about one specific occasion, and nothing else. · Lawful basis: your consent (a), given when you submit the form
Guests who create their own Bopplo account
Your name and email address (via Clerk), and a record linking your account to the invitations addressed to a verified email or phone number of yours — never to an invitation that is not yours.
Why: So you can see your own invitations across every occasion you attend. · Lawful basis: performance of a contract with you (b)
Hosts who pay for Bopplo
A payment reference from Stripe (a session and payment ID) — never your card number, which Stripe holds and we never see.
Why: To unlock sending, and to keep a record for accounting and tax. · Lawful basis: performance of a contract with you (b); a legal obligation for tax records (c)
Guests, and anyone invited to help plan
A record of each email we send on a host's behalf — the address it went to, whether it was delivered, bounced or marked as spam — and a permanent list of addresses that have bounced or asked not to be emailed again.
Why: To send invitations and reminders reliably, and to honour a stop request for good. · Lawful basis: the host's legitimate interest in sending, and your own request where you asked us to stop (f)
Suppliers you add. If you keep a list of suppliers for your occasion (for example your venue, photographer or florist), we store the details you enter: business name, contact name, email address, phone number, website and notes. Only you and the people you've invited to help plan can see them. We use them only to show them back to you, and we delete them with your occasion. Please only add contact details that the supplier has given you to use.
Guests who never signed up
If you received an invitation link and have never created a Bopplo account, this section is for you. Your name, email address, phone number and — where a host records one — postal address came from the host who is inviting you, not from you. We did not collect it directly and you did not agree to anything with us.
The host is the controller of that data: they decide who is on their guest list and what it is used for, and Bopplo processes it on their instructions, the way a printer processes the names on a card without deciding who gets one. If you reply to your invitation, the answer you type is submitted by you, directly to us, on the host's behalf.
For any question about why you received an invitation, ask the host — they are named on your invitation. For anything else, write to privacy@bopplo.com and we will help, or pass your request to the right host.
Dietary requirements
If the hosts ask, your invitation lets each person who is coming tell them about dietary requirements — any of the 14 allergens that Irish and EU menus must declare (such as milk, nuts, eggs or cereals containing gluten), a diet such as vegetarian, vegan, halal or kosher, or anything else in a short note — and choose a meal. Allergens are health information and some diets can reveal a religious belief, so we treat all of it as special-category data.
Why we hold it: so the hosts and their caterer can plan the food, and for nothing else. Who sees it: the occasion's hosts and planners only — not helpers, and not other guests. The hosts can download it to pass to their caterer.
Your consent: before your requirements are saved, you tick a box agreeing that the hosts and their caterer will see them. Without the tick your reply is still saved, but your dietary requirements are not. A host may also enter requirements they already know about, and you can change them on your invitation.
Deletion: every dietary answer is deleted automatically 30 days after the date of the occasion. To have yours removed sooner, ask the hosts or contact us.
Who else sees your data
We use a small number of specialist companies to run Bopplo. None of them may use your data for their own purposes.
Supabase
Our database and file storage — every table above, and any invitation artwork a host uploads.
Where: European Union (Ireland)
Clerk
Sign-in and account security for hosts, planners, helpers and guests who create an account.
Where: United States, with appropriate safeguards for data transferred from the EU
Vercel
Hosts the Bopplo website and runs the scheduled job that sends reminder emails.
Where: Global network operated from the United States, with appropriate safeguards for data transferred from the EU
Resend
Sends invitation, reminder and co-host emails on our behalf.
Where: European Union (Ireland)
Stripe
Processes the one-time occasion fee and any paid messaging bracket. Stripe holds your card details; we never see or store them, only a payment reference.
Where: Global payment processor, with EU operations and appropriate safeguards for data transferred from the EU
Sentry
Error monitoring, so we notice when something breaks. It never receives an invitation link's token, a card number or a full guest list.
Where: European Union (Germany)
Data leaving the EU
Some of the services above are based outside the European Economic Area, mainly in the United States. Where that happens, the safeguard is either the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses, depending on the provider. You can ask us which applies to a particular provider at privacy@bopplo.com.
How long we keep it
We keep your data for as long as your account or occasion exists. The one automatic deletion is dietary requirements, which are deleted 30 days after the occasion — see "Dietary requirements" above. Nothing else is deleted on a timer.
When a host deletes an occasion, everything about it is erased in one step: the guest list, every guest's name and contact details, every RSVP answer, every uploaded invitation image, every task, every supplier, every delivery and reminder record, and every invitation link. This cannot be undone, and there is no copy kept anywhere else in our systems.
Two things are kept even after that. First, if an email address has bounced, been marked as spam, or asked to stop receiving emails about an occasion, we keep that fact — the address alone, not the guest list it came from — so we do not email it again by mistake. Second, Stripe keeps its own payment records under its own retention rules, for accounting and tax purposes, whatever we do with the occasion.
You can ask a host to delete your details from their guest list at any time, or write to us at privacy@bopplo.com and we will help.
Your rights
If a host holds your data (most guest data), ask them first — they can usually act on it directly: a host can download everything their guest list holds about you (names, contact details, postal address and replies) as a spreadsheet, and correct or delete any of it. Either way, you can also write to us at privacy@bopplo.com and we will help, whichever of us is the controller for that particular piece of data.
Access — ask what data we (or a host, about you) hold.
Rectification — ask for something wrong to be corrected.
Erasure — ask for your data to be deleted — a host can delete an occasion themselves at any time, or we can help with a single guest's details.
Portability — ask for a copy of your own data in a usable format.
Objection — object to a particular use of your data, including a reminder email — every reminder to a guest carries a one-tap way to stop it.
Complaining to a regulator
If you are unhappy with how we, or a host, have handled your data, you can complain to the Data Protection Commission — the Irish regulator for data protection — dataprotection.ie.
Changes to this notice
We may update this notice as Bopplo changes. The date at the top of this page is when it was last updated. If we make a significant change to how we use your data, we will tell hosts directly.
Questions about anything on this page: privacy@bopplo.com.