Privacy Policy

RokaOS is a wedding-planning and vendor-marketplace service operated from British Columbia, Canada. We use personal information to provide the service, protect accounts, support users, recommend structured vendor records, and process subscriptions when enabled. We do not sell guest lists or personal information, and vendors cannot browse private wedding workspaces.

Couples decide which collaborators, guests, and vendors receive information. AI-generated changes require confirmation. Non-essential product analytics require a separate browser choice. You may request access, correction, export, or deletion through Privacy settings or by contacting privacy@rokaos.com.

This policy applies to the RokaOS website, responsive application, public wedding and RSVP pages, vendor portal, support services, and related communications. It does not govern a vendor's own website, contract, payment process, or privacy practices.

RokaOS is accountable for personal information under its control, including information processed by service providers. The founder is the designated privacy owner during launch. Privacy questions, complaints, and written access or correction requests may be sent to privacy@rokaos.com. We may verify identity and authority before acting on a request.

• Account information: name, email, authentication status, roles, preferences, policy acceptance, and security events.
• Wedding information: partner names, dates, locations, events, tasks, budgets, priorities, bookings, notes, documents, quotes, payments recorded for planning, and activity.
• Guest information: household names, contact details, invitations, attendance, dietary or accessibility notes, travel information, and public RSVP responses supplied by the couple or guest.
• Marketplace information: vendor profiles, verification evidence, service areas, cultural experience, price guidance, availability, inquiries, quotes, reviews, moderation, subscriptions, and support history.
• AI and document information: prompts, responses, proposals, approved actions, explicitly confirmed assistant preferences, response ratings, sanitized feedback comments and improvement consent, uploaded files, extraction results, and safety/audit metadata. Raw prompts are not sent to product analytics.
• Canva and Poster Studio information: Canva account and team identifiers, approved OAuth scopes, encrypted access and refresh tokens, design identifiers and metadata, event wording selected for a poster, export status, validation results, and private PDF proofs. RokaOS does not copy Canva's template marketplace into RokaOS.
• Technical information: IP-derived security signals, browser/device information, authentication cookies, request and error metadata, rate-limit subjects, and—only after consent—limited pathname-based product analytics.

When you choose to connect Canva, RokaOS uses Canva's OAuth process and requests only the scopes needed to create a custom-size design, list designs owned by the connected account, read design metadata, and export the design you select. RokaOS contacts Canva only after an authorized user starts one of these actions. Canva processes information under its own terms and privacy policy and may process it outside Canada, including in the United States or other jurisdictions.

Choosing Return to RokaOS exports the latest poster as a private PDF. RokaOS validates the page count, file integrity, size, and selected dimensions before storing it in private object storage. Approved proofs are available only through authenticated, no-store downloads and device-native file sharing; RokaOS does not create a public or permanent poster link.

Disconnecting Canva removes the stored connection tokens and pending connection or return states, but does not delete a design from Canva. Private poster projects and proofs are included in the wedding owner export and deletion workflow. Unapproved superseded files are cleaned up operationally; approved proofs remain with the wedding until the owner deletes the wedding or makes a valid deletion request, subject to legal holds and limited records that law requires us to retain.

We receive information from account holders, invited partners and collaborators, guests responding to invitations, vendors, authorized planners or administrators, connected payment/authentication providers, and the user's device. A couple may provide information about family members or guests. The couple must have authority to provide it, limit it to what is reasonably necessary, and honour requests to correct or remove it.

• create accounts, weddings, events, tasks, budgets, and invitations;
• apply role and event-scoped permissions and prevent data leakage;
• provide RSVPs, documents, exports, notifications, and support;
• match event needs with structured, location-relevant vendor records;
• provide AI assistance and execute only user-approved proposals;
• moderate vendors, reviews, inquiries, fraud, and abuse;
• process subscriptions, refunds, tax records, and entitlements when enabled;
• secure, troubleshoot, measure, and improve RokaOS; and
• comply with lawful requests and protect users and the service.

We seek meaningful consent where required. Processing that is necessary to deliver a requested account or feature is a condition of that service. Optional analytics and marketing communications are separate choices and may be refused without losing the core service.

RokaOS may send the minimum wedding context needed to the configured commercial AI provider to answer a request. Wedding identifiers and permissions remain server-authoritative. AI output may be wrong, so it is labelled as assistance rather than authoritative advice. Proposed changes are previewed and require approval; rejection causes no write.

RokaOS does not authorize a free consumer AI tier for real customer data. Production use requires a provider configuration that does not use customer prompts to train general models by default, appropriate contractual safeguards, tested deletion/retention settings, and a successful privacy and tenancy verification.

RokaOS may remember a limited non-sensitive preference only when the user explicitly asks it to do so and approves the proposed memory. Wedding records remain authoritative. Assistant memory excludes contact details, guest data, documents, secrets, payment data, and inferred sensitive traits; event-scoped collaborators cannot access wedding-wide memory. A user may undo or archive a saved preference.

Response ratings help measure quality. Optional comments are scrubbed for common contact and credential patterns before storage. RokaOS does not automatically train on private conversations or automatically deploy changes from feedback. Improvement candidates use aggregate evidence, synthetic evaluations, human approval, and rollback controls.

We may share limited information with:

• authorized wedding members, event-scoped collaborators, and guests;
• a vendor when a user shortlists, contacts, requests a quote from, or otherwise intentionally shares information with that vendor;
• infrastructure, database, authentication, hosting, storage, email, malware-scanning, AI, monitoring, analytics, and payment processors bound to provide services and protect information;
• professional advisers under confidentiality, or an acquirer during a properly protected business transaction; and
• authorities or other parties where reasonably necessary to comply with law, respond to an emergency, investigate abuse, or protect rights and safety.

RokaOS does not sell personal information or guest lists. Subscription payment never purchases vendor verification or organic ranking. Sponsored placements, if introduced, will be separately labelled.

Some service providers may process information in Canada, the United States, or other jurisdictions. Information there may be accessible to courts, law enforcement, or national-security authorities under local law. RokaOS remains accountable for transferred information and uses contractual, technical, access-control, and minimization measures to seek a comparable level of protection. A current provider and data-flow inventory is maintained for production operations.

Essential cookies support authentication, security, invitation/referral continuity, and interface preferences. They are necessary for requested features. Product analytics are optional and initialize only after the visitor chooses to allow them. Analytics use internal identifiers and pathnames; RokaOS excludes URL query values, raw AI prompts, guest contact information, document contents, and secrets.

See the Cookie and Analytics Notice to change the browser's analytics choice.

We retain information only as long as reasonably necessary for the stated purposes, account administration, security, dispute resolution, and legal obligations. Active wedding records remain until the owner deletes the wedding. A deletion request starts a 30-day grace period; cancellation is available during that period, after which in-scope relational records and private objects are permanently purged.

Export files are private and removed during the related purge or earlier operational cleanup. Limited billing, tax, fraud-prevention, consent, unsubscribe-suppression, moderation, security, and completed-request records may be retained when reasonably necessary or legally required. Backups expire under the provider retention cycle and are not restored to reactivate deleted accounts. The detailed schedule is published in the RokaOS Data Retention Standard and reviewed at least annually. Current maximum operational periods are: export files 7 days; terminal invitations 30 days; closed support, marketplace leads/quotes, wedding activity, and moderation evidence 24 months; identifiable product analytics 12 months; error-monitoring events 90 days; and payment/tax records 7 years. Inactive accounts are reviewed after 24 months and receive advance notice before closure.

Safeguards include authentication, row-level and event-scoped access, least-privilege administration, MFA for administrators, private object storage, signed URLs, upload validation and malware scanning, encryption in transit, rate limits, audit trails, dependency and secret scanning, monitoring, backups, and tested incident procedures. No service can promise absolute security.

Suspected incidents are contained, investigated, documented, and risk assessed. Where applicable law requires it, RokaOS will notify affected individuals and regulators as soon as feasible and retain the required breach records.

You may, subject to lawful exceptions:

• access information about you and how it has been used or disclosed;
• request correction of inaccurate or incomplete information;
• download a structured account/wedding export;
• withdraw optional analytics or marketing consent;
• remove collaborators, control notifications, or delete a wedding;
• request account deletion and object cleanup; and
• challenge compliance or submit a privacy complaint.

Written requests may be sent to privacy@rokaos.com. We may request proportionate identity or authority evidence and will explain any lawful refusal or limitation. You may also contact the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada, as applicable.

RokaOS accounts are intended for adults. The service is not directed to children. Adults may enter limited information about children attending a wedding when reasonably necessary for invitations, seating, meals, accessibility, or safety. Do not upload unnecessary sensitive information about a child. A parent or guardian may contact us about correction or deletion.

Material changes receive a new version and renewed acceptance or notice where appropriate. The current version remains available on this page. Contact privacy@rokaos.com with privacy questions, access/correction requests, deletion requests, or complaints. The privacy owner is the founder operating RokaOS from British Columbia, Canada. A complete service address will be displayed before open paid registration is enabled.