Privacy Policy

Nupta provides wedding planning, vendor discovery, guest experience, budget, invitation, and vendor workspace tools. Nupta Rwanda is the service operator and data controller for personal data collected through the website, mobile app, vendor workspace, support channels, and related services.

Contact: support@nupta.rw. Business location: Kigali, Rwanda.

Account and identity data such as name, email address, phone number, role, language, login identifiers, and account settings.

Wedding planning data such as couple names, ceremony details, budgets, tasks, guest lists, invitations, team members, notes, preferences, saved vendors, and guest experience content you choose to create or upload.

Vendor data such as business name, contact details, service category, pricing, availability, portfolio media, verification materials, leads, reviews, quotes, payment records, and storefront settings.

Device, location, permission, and usage data such as IP address, app version, device identifiers, approximate location, feature events, crash logs, notification tokens, analytics preferences, and support messages.

Payment data may be processed by payment providers. Nupta stores transaction references, entitlement status, payment method category, and reconciliation details needed for support, fraud prevention, accounting, and legal compliance.

We process personal data to create accounts, provide planning workspaces, match couples with vendors, publish vendor profiles, process purchases, send invitations or notifications you request, provide customer support, prevent misuse, improve product quality, and comply with legal duties.

If you choose to allow optional analytics, Nupta collects privacy-safe product usage signals through Mixpanel and Microsoft Clarity to understand feature adoption, improve usability, and diagnose performance. This choice is available before and after account creation and can be changed at any time through Privacy settings or by contacting us.

Nupta handles personal data in line with Rwanda Law No. 058/2021 of 13/10/2021 relating to the protection of personal data and privacy, including purpose limitation, consent where required, data subject rights, processor contracts, records of processing, security controls, and safeguards for transfers or storage outside Rwanda.

Where users are located outside Rwanda, additional local laws may apply, including GDPR-style rights for European users and consumer privacy rights in other jurisdictions.

We do not sell personal data or use it for cross-company advertising tracking. Our service providers include Supabase (database and object storage), Render (backend hosting), Vercel (web hosting), Expo/EAS (mobile builds, updates and push routing), Sentry (crash and performance monitoring), Mixpanel product analytics, Resend (transactional email), Pindo (SMS), enabled payment providers such as AfriPay, and Apple or Google for sign-in and distribution.

Providers may process data only for the described service under applicable contracts, confidentiality and security duties. Current provider roles, locations and transfer safeguards are maintained in Nupta's processor register.

Account and wedding data remains while the account or shared workspace is active and is deleted from live systems when the user deletes it, subject to other members' rights and legal holds. Deleted database records can remain in encrypted backups for no more than 30 days. Deleted storage objects are removed from live storage immediately.

Support cases are kept for 36 months; Sentry events for 90 days; security logs ordinarily for 12 months; optional Mixpanel data for no more than 14 months; and payment, invoice and tax records for up to 10 years where Rwanda law requires. Data is deleted or irreversibly anonymised after the applicable period.

Nupta uses reasonable technical and organisational safeguards, including access controls, encryption in transit, secure credential handling, least-privilege permissions, audit logging for sensitive operations, vendor access controls, backups, and incident response procedures.

No online service can guarantee absolute security. Users should keep login details secure and report suspected unauthorized access promptly.

Nupta is intended for adults planning or providing wedding services. If children appear in guest lists, media, or event details, users must have appropriate authority or consent to provide that information.

We do not knowingly create accounts for children under 16 without legally valid parental or guardian consent where required.

Nupta uses service providers that may store or access data outside Rwanda. Before production use, those arrangements must be covered by Nupta's valid Rwanda controller registration and outside-Rwanda storage authorisation, an applicable transfer basis, processor terms, and security safeguards. Contact support@nupta.rw for current destination information.

You may request access, correction, restriction, portability, consent withdrawal, or objection by contacting support@nupta.rw. Permanent account deletion is available directly in Privacy settings. We may verify identity before disclosing data.

Optional Mixpanel and Microsoft Clarity product analytics is disabled until you allow it through the analytics choice shown on the website or in the relevant product settings. You can change or withdraw that choice at any time in Privacy settings. Opting out stops future optional product analytics; it does not disable essential security, operational, payment, or crash-reporting logs. Sentry crash reporting is separate, uses no default PII, and supports security and reliability. You may also control location, notifications and other device permissions in system settings.