CASE STUDY / Rozsauveg.hu
Rozsauveg.hu: a purpose-built booking and customer platform with Next.js
We did not create a new template. We created a digital system designed around how Rózsaüveg works every day.
Starting point
Rózsaüveg offers experience-painting events, bespoke artwork and gift vouchers. Its previous WordPress, WooCommerce and Amelia Booking solution was a working starting point, but booking, payment, invoicing, imagery, customer communication and everyday administration were spread across separate tools.
The next stage was not a cosmetic refresh. It was a purpose-built application where the public website and the internal business process use the same reliable data model.
The new system in brief
The new Rozsauveg.hu is a bespoke bilingual Next.js application. Events, available places, bookings, shop products, vouchers and related customer communication now work in one connected system.
For customers
- events and services in Hungarian and English;
- a clear booking journey with a 24-hour time format;
- card, on-site and gift-voucher payment options;
- a shop for physical products as well as gift vouchers;
- clear confirmations, calendar entries and self-service follow-up.
For the team
- one administration area for events, venues, bookings, products and content;
- capacity management and auditable booking states;
- Stripe payments and Számlázz.hu billing aligned in one workflow;
- R2-based optimised media uploads;
- automated organiser lists and targeted attendee communication.
Why is this a better fit for Rózsaüveg?
This is not a general claim about WordPress. The question was which foundation would create fewer manual hand-offs and more control for Rózsaüveg's own operation.
Fewer interdependent plugins
Booking no longer depends on a separate booking add-on, and buying a product or voucher no longer requires a bespoke connection around a separate commerce plugin. The critical rules — capacity, payment state, voucher redemption, cancellation and notification — can be managed together in the application itself.
That makes diagnosis simpler and reduces the chance that a change between two plugins unexpectedly interrupts a customer journey.
A smaller, more intentionally managed attack surface
In a plugin-extended system, every component adds its own update, permission and compatibility surface. In the new application, public and administrative functions are separated, critical actions receive server-side validation, and access is tied to roles.
We do not claim that any website is unhackable. The aim is to reduce unnecessary exposure, make updates more transparent and align security controls with the real business workflow.
Poster creation became part of the workflow
For every new event, the system can generate a print-ready A4 poster and a Facebook-ready image. The title, date, short description, painting, venue image and booking QR code are assembled from managed event data.
This does not replace creative direction, but routine event communication no longer requires building every asset from scratch in Canva. Content remains editable while a consistent first version is always available.
Since then: the system has grown in daily use
Since the first release, Rózsaüveg's real use has led to further improvements. All of them build on the existing data model rather than adding separate tools.
Images that also protect participants
The experience-painting gallery is now part of the system: the home page shows a painting gallery, and the event gallery displays images in random order while respecting the reduced-motion setting. Photos can be uploaded in bulk, including iPhone (HEIC) images.
Uploading includes a face check: the system offers to blur detected faces, but the final decision is always made by a person, in an approval queue. If someone prefers not to appear in the photos, an image can be removed. This protects participants and is more than a technical convenience.
Monthly calendar and event communication
From the event data, the system produces an illustrated monthly calendar and a Facebook flyer, including contact details, in a print-ready form. Several versions of a poster can be managed.
Participants receive reminder emails (including confirmations for those paying on site), and expiring experience vouchers trigger a separate notice. The organiser receives a participant list the day before an event, and people added manually on site can be included.
Polls and interest surveys
External forms have been replaced by a bilingual poll and interest-survey module of our own. Respondents confirm their vote by email, consents are managed separately, and a results notification is sent when a poll closes. Public forms are also protected against bots.
Everyday finances
For cash payments on site, a receipt can be issued from the system, aligned with Számlázz.hu. Billing feedback is processed automatically and safely when repeated. In the admin, each event shows what it earned and what it cost, so decisions are not based on gut feeling.
Comfortable on a phone
The admin works well on mobile, the public header has been refined for phone use, and date and time selection is now consistent.
Measurement only with consent
Cookie consent is handled by a dedicated banner: until a visitor consents, no measurement code runs at all. After consent, traffic and advertising measurement (including tracking online purchases) works, and our own internal visits are filtered out of the statistics without relying on IP addresses. The system notifies search engines about new content, events carry structured data, and shared links have their own preview image.
Legal and privacy
Legal documents (privacy notice, terms, refunds) are editable in the admin, in both languages. Gift vouchers are also issued bilingually.
Operational safety: working is not enough
- Backup and restore: the system creates an encrypted backup, copies it to external storage, and we have actually tested restoring it in an isolated environment.
- Scheduled operational jobs: reminders, backups and a daily operations report run automatically. The daily report contains aggregate data only, no customer data.
- Monitoring: we continuously watch the system's state (database, email delivery, backup age, scheduled jobs) and an alert is sent if something deviates.
- Verified releases: scheduled, read-only functional tests and a smoke test after every release confirm that the key pages and forms really work. A quality gate also watches performance and availability.
Security and maintenance
The system has been reviewed and fixed over several rounds (public endpoints, payments, admin access). Dependencies are covered by vulnerability monitoring, secrets stay out of the code, the framework and packages are kept up to date, and changes reach the live site only after mandatory automated checks. This is not "unhackable": the aim remains to reduce unnecessary exposure and to keep maintaining the system.
Iterative delivery with verifiable releases
The project progressed in short, meaningful packages: first the critical booking and payment journeys, then administration, media, automated posters, the shop and follow-up communication.
Each substantial change was verified in a development environment and refined from real usage feedback. Only the tested and approved version was promoted to the live website. This matters especially in a system where a small usability choice can directly affect booking and administration.
Iterative work does not mean a system remains experimental. It means the next decision is based on real operational evidence, while changes stay traceable and verifiable.
Technology is useful when it removes operational work
Rózsaüveg did not move to a bespoke application just to add more technology. The purpose was fewer manual connections, clearer processes and a solid foundation for future ideas — such as polls, promotional vouchers and event communications, which have since been built on it.
Considering a similar system?
If your website supports bookings, sales, payments, customer communication or recurring content production, it is worth designing not only the interface but the underlying process.