Privacy Policy
Last updated: October 17, 2026
Asterra (“we”, “us”) is a wedding website builder operated by PT Helium Cipta Maya, a company incorporated in Indonesia. Contact: help@asterrawedding.com.
This policy covers two groups of people: couples who create an Asterra account, and guests who visit a couple’s wedding site. Guests do not create accounts, so please read the guest section even if you never signed up for anything.
1. Who is responsible for your data
- Couples’ account data (email, sign-in records, payment records): Asterra is the controller.
- Guest data (RSVP entries, guestbook messages): the couple decides why and how it is collected, so the couple is the controller and Asterra acts as their processor, storing it on their behalf. Asterra is the controller only for the security data described in section 4 (IP addresses used for spam control).
- If you are a guest and want your RSVP or guestbook entry removed, contact the couple first. You can also email help@asterrawedding.com and we will remove the specific entry.
- Support requests you send through our support form: Asterra is the controller.
2. Data we collect from couples
- Account: email address, time of last login, account creation time, and security records (failed-login counter, lock time). A password hash exists only if a password was set; normal sign-in uses one-time email links.
- Site content you enter: names of both partners, optional parents’ lines, event details (names, dates, times, venue names and addresses, dress code), love story, timeline, quotes, gift links, chosen template and link, RSVP deadline, and video IDs for embedded YouTube or Vimeo videos.
- Photos: up to 30 gallery photos and 1 hero photo. Photos are resized in your browser before upload.
- Payments: handled by Lemon Squeezy. We never see your card number. We keep a record of each transaction (order ID, amount, currency, status) and the time you accepted the Terms and which version of them you accepted.
- Emails we send you: sign-in links, and notices about your site (published, back online, photos reduced, offline, or a payment that went through but could not put your site live), and a reminder to reactivate after your hosting ends.
- Support requests: if you use our support form, we collect your support code, the email you sign in with, a reply email address, the type of problem, and the message you write. Please do not include card numbers or passwords.
3. Data we collect from guests
- RSVP: name, attending yes or no, party size, and an optional note of up to 300 characters.
- Guestbook: name and a message of up to 300 characters.
- Personalised links: if a couple sends a link like
/?guest=Name, the name is shown on the page. It is not stored. - We do not use analytics, advertising or tracking scripts on guest sites. Wedding sites are marked noindex, so search engines are asked not to list them.
4. Security and spam data
To stop abuse we use Cloudflare Turnstile before accepting an RSVP or guestbook message, and we rate-limit by IP address. Rate-limit records (IP, site, action, time) are deleted after 24 hours. A guestbook message is stored together with the poster’s IP address, which is never shown to the couple. This IP is deleted 90 days after posting. We use it only to investigate abuse.
5. Why we use data (legal bases)
- To provide the service you asked for (contract).
- To keep the service secure and prevent abuse (legitimate interests).
- To comply with tax and legal obligations (legal obligation).
- Where required, with your consent.
6. Cookies
We use one cookie, asterra_session, to keep couples signed in (strictly necessary; HttpOnly, Secure, 7 days, renewed while active). Guest sites set no cookies of their own. Cloudflare Turnstile may set technical cookies for bot detection. If a couple embeds a YouTube or Vimeo video, those providers may load their own scripts when a guest views the video. Some templates show a preview picture for a video as soon as the page opens, loaded from YouTube’s or vumbnail.com’s servers, which then receive the guest’s IP address.
Our support form is hosted by Google. Google may set its own cookies on that page, and its privacy policy applies there. We link to the form and do not embed it in our pages.
7. Who we share data with
| Provider | Purpose |
|---|---|
| Cloudflare | Hosting, database, photo storage, DNS, Turnstile |
| Resend | Sending emails |
| Lemon Squeezy | Payments (Merchant of Record), taxes, receipts |
| YouTube (nocookie) / Vimeo | Embedded videos, only if a couple adds one |
| vumbnail.com | Preview pictures for Vimeo videos in some templates, only if a couple adds one |
| Google (Forms, Sheets, Gmail) | Support form, storing support requests, email correspondence |
| Brevo | Sending our replies to support emails |
We do not sell personal data. We may disclose data if the law requires it.
8. International transfers
We operate from Indonesia and our providers process data in other countries, including the United States. Where required, transfers rely on safeguards such as standard contractual clauses or the provider’s certified frameworks.
9. How long we keep data
| Data | Retention |
|---|---|
| Account email and records | While the account exists |
| Photos, published site | While published (12 months from purchase) |
| Full-size photos, expired site | 30 days after expiry, then only thumbnails remain |
| Draft photos, inactive owner | Reduced to thumbnails after 30 days without any use of the account |
| Text content, RSVPs, guestbook, remaining thumbnails | Deleted permanently 12 months after the site expires, after we email the account address a final notice at least 7 days beforehand. Reactivating the site before the deletion date keeps everything. |
| Content of a site we suspend or remove under the Terms | Deleted 30 days after removal |
| Transaction records | As long as tax and accounting law requires |
| Rate-limit records | 24 hours |
| Support requests (form answers and email replies) | Deleted 12 months after the request is closed |
Deleted photos may remain in cache for up to 1 hour (full-size) or 7 days (thumbnails).
When a site’s content is deleted, we keep the site address (so nobody else can take over the old link), the account email, and payment records. Drafts and sites that were never paid for are kept while the account exists. Deletions run in batches, so a deletion may happen up to about 30 days after the date in our notice.
10. Your rights
Depending on where you live (including under Indonesia’s Personal Data Protection Law, the GDPR and the UK GDPR) you may have the right to access, correct, delete, restrict or export your data, to object to processing, and to complain to a regulator. Email help@asterrawedding.com. We aim to reply within 30 days. Couples can delete individual RSVPs and guestbook messages themselves and download RSVPs as a spreadsheet. Please send privacy requests (access, correction, deletion) by email to help@asterrawedding.com, not through the support form.
11. Account and site deletion
Self-service account deletion is not yet available. Email us from your account address and we will delete your account and site content, except records we must legally keep.
12. Children
Asterra is for adults. You must be at least 18 to create an account. If a couple includes photos or names of children, they are responsible for having the right to do so.
13. Security
Sign-in uses single-use email links that expire after 15 minutes. Data is encrypted in transit. No system is perfectly secure, and we will notify affected users where the law requires.
14. Changes
If we make material changes, we will update the date above.