Privacy policy

As of 15 October 2026

This is a translation for convenience. The German version is legally binding.

Gästehelden is a tool that organisers use to invite guests, collect replies and plan events. We only process the data needed for this. There are no ads, no tracking and no analytics tools, and we do not sell any data.

1. Controller

Tim Wessel
Schützenstr. 3
28876 Oyten, Germany
Email: kontakt@gaestehelden.de

2. Two roles: organisers and guests

For organisers, that is everyone who creates an account, we are the controller within the meaning of the GDPR for the data of their account.

For guests it is different: the guest list, the invitations and the replies belong to the organiser's event. The organiser is responsible for this data, and we process it on their behalf (Art. 28 GDPR). If you are a guest and have questions about your data or would like it deleted, please contact the organiser who invited you first. We support them and forward requests sent to us.

3. What data we process

Visiting this website and the app

When you visit, our web server stores technical information in log files: IP address, time, requested address, browser identifier and status code. This serves secure operation and troubleshooting (Art. 6 (1) (f) GDPR). The logs are deleted after 52 days at the latest.

Organiser accounts

Name, email address, password (only as a secure hash, never in plain text) and the name of your organisation. Also the content you create: events, email templates, designs, images, seating plans and team members with their roles. To confirm your email address and to reset your password we send you emails with a one-time link. The legal basis is the performance of the user agreement (Art. 6 (1) (b) GDPR).

Guest data (on behalf of organisers)

• Name, email address, membership of an invitation or group, child or adult
• Reply (accept or decline), companions, message to the hosts
• Dietary requirements and allergies, if the guest provides them voluntarily. Information about allergies can be health data; it is only used for planning the event.
• Seat, ticket, check-in and payment status, if the organiser uses these features
• Email log (which email was sent to which address and when, and whether sending succeeded)

Guests do not need an account. They reach their reply page through a personal link in the invitation that only works for their invitation.

4. Emails

We send invitations, reminders and confirmations from our own mail server in the same data centre, without an external sending service. The sender name is the name of the organiser's organisation. We do not track opens or clicks.

5. Cookies and local storage

After signing in we set a single, technically necessary cookie that keeps you signed in. Your browser also stores interface settings (such as column widths in lists and the language) in local storage. Neither is used for tracking. The public pages for guests and this website set no cookies. We do not load fonts or scripts from third-party servers.

6. Hosting and recipients

Website, app, database and mail server run on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Germany. A data processing agreement is in place with Hetzner. Apart from the AI help in the seating plan (section 7), no data is transferred to countries outside the EU.

7. AI help in the seating plan

In the seating plan, organisers can write down seating wishes in plain language and have an AI turn them into rules with “Turn into rules”. Only when this feature is used do we transmit the wish text entered and the guest list of the seating plan (first and last name, group, child or adult) and the tables (name, shape, seats) to Anthropic PBC, 548 Market Street, San Francisco, CA 94104, USA (model Claude). Email addresses, replies, dietary information and payments are not transmitted.

Anthropic processes the data on our behalf to generate the rules and, according to the contract, does not use it to train its models. The transfer to the USA is based on EU standard contractual clauses. The legal basis for organisers is the performance of the user agreement (Art. 6 (1) (b) GDPR); for guest data we act on behalf of the organiser (Art. 28 GDPR). If the feature is not used, no data is transferred.

8. Retention and deletion

We keep your account data for as long as the account exists. If you delete an event, its guests, replies, emails and seating plans are deleted as well. If you delete your organisation, all its events are deleted too. Statutory retention obligations remain unaffected.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Just write to us at kontakt@gaestehelden.de.

You can also lodge a complaint with a supervisory authority, for example the authority responsible for us: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.

10. Changes

When we introduce new features, we update this policy. The version published here applies.