Pinnacle Weddings
Legal

Data Processing Addendum

Terms governing Pinnacle's processing of personal data on behalf of couples using guest and planning features.

Last updated: June 29, 2026

1. Parties and Scope

This Data Processing Addendum ("DPA") forms part of the Terms of Service between you ("Customer," "Controller") and Pinnacle Weddings ("Processor").

It applies when Customer uses the Service to process personal data of wedding guests, vendors, or other individuals ("Personal Data") where Customer is the data controller and Pinnacle processes Personal Data on Customer's behalf.

2. Processing Instructions

Pinnacle will process Personal Data only on documented instructions from Customer, including through Customer's use of Service features (guest lists, RSVP, exports, emails, etc.), unless required by law.

Customer instructs Pinnacle to process Personal Data to provide the Service as described in the Terms and Privacy Policy.

3. Details of Processing

Subject matter

Wedding planning and guest management via the Service.

Duration

For the term of Customer's account plus retention periods in the Privacy Policy.

Categories of data subjects

  • Wedding guests
  • Vendors and service providers
  • Customer and authorized users

Categories of Personal Data

  • Contact and identity data
  • RSVP and event preferences
  • Health-related dietary/allergy information (if provided)
  • Vendor contract and business contact data

Processing operations

  • Storage
  • Organization
  • Retrieval
  • Display
  • Export
  • Transactional email delivery

4. Confidentiality and Security

Pinnacle ensures personnel authorized to process Personal Data are bound by confidentiality obligations.

Pinnacle implements appropriate technical and organizational measures as described in the Privacy Policy, including access controls and encryption in transit.

5. Sub-processors

Customer authorizes Pinnacle to engage sub-processors to provide the Service. Current sub-processors include:

Pinnacle will notify Customer of material changes to sub-processors via email or in-app notice. Customer may object on reasonable grounds relating to data protection.

  • Supabase — database, authentication, file storage
  • Stripe — payment processing (account holder billing data)
  • Vercel — application hosting
  • Resend — transactional email (when enabled)

6. Data Subject Requests

Pinnacle will assist Customer in responding to data subject requests (access, deletion, etc.) where technically feasible, taking into account the nature of processing.

Customer is responsible for responding to guest requests and may use Service tools to export, correct, or delete guest records.

7. Security Incidents

Pinnacle will notify Customer without undue delay after becoming aware of a Personal Data breach affecting Customer's data, and will provide information reasonably required for Customer to meet regulatory obligations.

8. Return and Deletion

Upon termination of the Service, Customer may export data before account closure. Pinnacle will delete Customer Personal Data within 90 days of termination, subject to legal retention requirements.

9. Audits

Upon reasonable request, Pinnacle will provide information necessary to demonstrate compliance with this DPA. Customer may not audit Pinnacle more than once per year except where required by law or following a material breach.

10. International Transfers

Where Personal Data is transferred outside the EEA/UK, Pinnacle will ensure appropriate safeguards such as Standard Contractual Clauses where required.

11. Contact

Data protection inquiries: hello@pinnacleweddings.com