Privacy Policy

Who we are

The controller responsible for your personal data is:

We are a small business and have not appointed a Data Protection Officer. Send any question or request about your data to the email address above.

At a glance

• You can browse the whole site without telling us who you are. There are no accounts, and an enquiry asks only for your name, your email and your message.
• We use Google Analytics and PostHog to see how the site is used. They store something on your device only if you allow analytics in the cookie banner, and your visit is recorded as a session replay only if you also allow session recordings.
• If you don’t allow analytics, we still count visits without cookies and without storing anything on your device. The details are below.
• You can change either choice at any time with Cookie settings at the bottom of every page.
• We never sell your data or use it for advertising.

Visiting the website

Whenever you open a page, your browser sends our hosting provider, Vercel, the technical information needed to deliver it: your IP address, the page requested, the time, and your browser’s user agent (which browser and operating system you use). This is used to deliver the site and keep it secure, which is our legitimate interest (Art. 6(1)(f) GDPR). Vercel keeps these request logs only for a short time.

Analytics

We want to know which pages and photographs people look at and where the site lets them down, so that we can improve it. For this we use Google Analytics, provided by Google Ireland Limited, and PostHog, provided by PostHog Inc. and hosted in its EU data centre in Frankfurt, Germany. What they collect depends on your answer to the cookie banner.

Before you answer

Nothing is stored on your device and PostHog records nothing. The Google tag is already loaded, but with analytics storage switched off (Google Consent Mode): it sets no cookies and sends Google only the cookieless measurements described under “If you don’t allow analytics”.

If you allow analytics

With your consent (Art. 6(1)(a) GDPR):

• Google Analytics sets cookies to recognise your browser on later visits, and records the pages you view, the site that referred you, what you do here (for example opening a story or a photo), your device, browser and screen size, and your approximate location. Google Analytics does not store IP addresses; it uses yours only to work out your approximate location.
• PostHog stores a random identifier on your device to recognise you on later visits. It records the pages you view, your clicks, scrolling and other interactions, how quickly pages load, any errors you run into, your device and browser, and your IP address, from which it estimates your city and country.
• Only if you also allow session recordings, PostHog records your session: a replay of what appeared on your screen and how you moved through the site (scrolling, clicks and mouse movements), together with technical messages from your browser and the timing of network requests. Anything you type into a form field is masked and never recorded. We watch replays to find and fix problems, and PostHog’s automated tools, including AI models, review a sample of them to flag broken pages and summarise how the site is used.
• Now and then we test two versions of a page against each other (an A/B test). PostHog picks the version you see at random and remembers it on your device, so you keep seeing the same one.

If you don’t allow analytics

Nothing is stored on your device except a note of your choice, so that we don’t ask again. We still measure visits without cookies, on the basis of our legitimate interest in understanding, in aggregate, how the site is used and whether it works (Art. 6(1)(f) GDPR):

• PostHog records the pages you view, your clicks and other interactions, how quickly pages load and any errors you run into, but no session replay. To count unique visitors, PostHog’s servers combine your IP address and browser user agent with a random value that changes every day into a one-way hash, then discard the IP address. This tells visits apart for a single day only: it cannot recognise you on another day or tell us who you are. You may also be shown one version of an A/B test this way.
• Google Analytics sets no cookies. The Google tag sends Google cookieless measurements of your visit (such as the page you open, the time, and your browser and device type) without any identifier that recognises you. Google uses them, in aggregate, to estimate the visits it cannot measure directly.

We consider this proportionate because nothing is stored on your device, nothing identifies you, and the data is used only for statistics. You can object to it at any time (see “Your rights”), and you can also block it yourself with a content blocker in your browser.

How long analytics data is kept

Google Analytics keeps event data for up to 14 months. PostHog keeps analytics events for one year and session replays for 30 days. After that they are deleted automatically.

Getting in touch

If you email or call us, or message us on Instagram or Facebook, we process your name, your contact details, your message and whatever you tell us about your wedding or event, so that we can reply and, if you wish, prepare a proposal. The legal basis is taking the steps you ask for before entering into a contract (Art. 6(1)(b) GDPR) or, for general questions, our legitimate interest in answering them (Art. 6(1)(f)). If your enquiry does not lead to a booking, we delete the correspondence within two years of our last contact.

If you book us, we use these details to plan and deliver your flowers and to invoice you (Art. 6(1)(b) and (c) GDPR), and we keep invoices and accounting records for as long as Greek tax law requires.

An enquiry sent through this website reaches us as an email, delivered by our email provider, Resend, with your address set so that we can reply. To keep automated spam out, Cloudflare Turnstile first checks that the enquiry comes from a person; Cloudflare processes your IP address and technical details of your browser to do so. To turn away floods of messages and to deliver a message sent twice only once, we keep a scrambled code (a keyed hash) of your email address, your IP address and your message for seven days. It cannot be turned back into them, and it is deleted after the seven days. The legal basis is our legitimate interest in keeping the enquiry form free of abuse (Art. 6(1)(f) GDPR).

Paying us

Our payment page (manfler.com/pay) is a short form, run on our own server, that passes you to Wise, our payment provider, so that you can pay in your own currency. Wise processes your payment details and may need to verify your identity under anti-money-laundering rules. For that it acts as a controller in its own right, under its own privacy notice, which you can find on wise.com.

We receive confirmation of the payment, including the payer’s name, the amount, the currency and the reference, but not your card details. We use it to record your payment and meet our accounting obligations (Art. 6(1)(b) and (c) GDPR), and keep it for as long as Greek tax law requires.

Photographs in our portfolio

Our portfolio shows photographs of the weddings and events we have decorated. Some show the couple, their guests or other people, and a story may be titled with the couple’s names. We publish them to show our work, which is our legitimate interest (Art. 6(1)(f) GDPR). If you appear in a photo or are named on our site and would like that removed, email us at info@manfler.com and we will take it down.

To write descriptions of our photos for people who use screen readers, to draft the text of our stories and to tag each wedding with its style, flowers and setting, we send the photos (with what the story records about the wedding: its title, date, venue, planner and description) to an AI service, OpenRouter, which passes them to the model provider (Anthropic or Google). They use them only to return the text. The photos and the rest of the site’s content are stored with Railway in the Netherlands.

Cookies and local storage

Cookies and local storage let a website keep small pieces of information in your browser. These are needed for the site to work or to remember your choices, so they are set without asking:

• cookie_consent (local storage, manfler): Remembers whether you allowed analytics. Kept until you reset it in Cookie settings or clear your browser data.
• cookie_consent_recordings (local storage, manfler): Remembers whether you allowed session recordings. Kept until you reset it in Cookie settings or clear your browser data.
• soundPreference (local storage, manfler): Remembers whether you turned the click sound off. Kept until you clear your browser data.
• payload-token (cookie, manfler): Keeps our staff signed in while they edit the site. Never set for visitors. Kept 2 hours.

These are set only if you allow analytics:

• _ga (cookie, Google Analytics): Tells one visitor’s browser apart from another’s. Kept 2 years.
• _ga_DZXT100Y8H (cookie, Google Analytics): Keeps track of your current visit. Kept 2 years.
• ph_…_posthog (local storage, PostHog): Your random PostHog identifier, your current session and the A/B test versions you are shown. Kept until you clear your browser data.
• ph_…_window_id and other ph_… entries (session storage, PostHog): Tell your open tabs apart and hold details of the current visit. Kept until you close the tab.
• posthog_user_id (local storage, manfler): A random identifier that tells PostHog you have visited before. Kept until you clear your browser data.

To withdraw your consent, open Cookie settings at the bottom of any page and switch Analytics or Session recordings off, or choose Reject all. Switching analytics off also deletes the analytics entries listed above from your browser; clearing the site data for manfler.com in your browser removes anything left over.

Who receives your data

We share personal data only with the service providers that run the site and our business for us, each bound by data processing terms to use it only on our instructions:

• Vercel Inc. (USA): hosts the website.
• Railway Corporation (data centres in the Netherlands): stores the site’s photographs and content.
• Google Ireland Limited, with Google LLC (USA): Google Analytics.
• PostHog Inc. (data stored in Frankfurt, Germany): analytics and session replays.
• OpenRouter Inc., Anthropic PBC and Google LLC (USA): writing photo descriptions and tagging the portfolio.
• Resend Inc. (USA): delivers enquiries sent through the website to our inbox.
• Cloudflare Inc. (USA): Turnstile, which checks that an enquiry comes from a person.

Wise processes payments as an independent controller. We also disclose data to public authorities, such as the tax authorities, when the law requires it. We never sell personal data or use it for advertising.

Transfers outside the EU

Some of these providers are based in the United States. Where your data is transferred there, it is protected by the EU–US Data Privacy Framework, for providers certified under it, or by the European Commission’s Standard Contractual Clauses.

Social media

This site only links to our Instagram and Facebook pages; nothing from Meta loads here. When you visit those pages, Meta Platforms Ireland Limited processes your data under its own privacy policy. For the statistics Meta gives us about visits to our pages (Page Insights), Meta and we are joint controllers, and Meta has taken on primary responsibility for that processing and for answering requests about it.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy of it;
• have inaccurate data corrected;
• have your data erased;
• restrict how we use it;
• receive the data you gave us in a portable format;
• object at any time to processing based on our legitimate interests, including cookieless analytics and photos in which you appear;
• withdraw your consent at any time, through Cookie settings at the bottom of any page, without affecting what was done before you withdrew it.

To use any of these rights, email us at info@manfler.com. It is free, and we will answer within one month. We may ask you to confirm your identity. Analytics data is not linked to your name, so we can only find yours if you give us the identifier stored in your browser.

You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work. In Greece this is the Hellenic Data Protection Authority, Kifisias 1–3, 115 23 Athens (www.dpa.gr).

Other things you should know

• Giving us your data is voluntary. You can use the site without accepting analytics; we need your contact details only to reply to you, and booking and payment details only to provide our services.
• We don’t make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects.
• Our site is not aimed at children under 15, and we don’t knowingly collect their data.
• We will update this policy whenever the way we handle data changes. The date at the top shows when it last changed.