Privacy
Draft. This document describes what the product actually does, but a lawyer has not reviewed it yet. It must be read by one before commercial launch.
Who is responsible for whose data, on what basis we process it, and how long we keep it.
Who the controller is
The couple is the controller of their guests' data — they decide who is invited and what is asked. We are the processor, acting on their instructions. For account data, billing and product telemetry, we are the controller.
What we collect
From guests: name, whatever contact the couple or the guest provides, their reply, dietary preferences, and the photos and messages they upload themselves. From the couple: an email address, a hashed password, and the details of the wedding.
Lawful basis
Guest data — the couple's legitimate interest in organising their wedding, disclosed to the guest the first time they open the link. Photos and guest-book entries — consent, given by the act of uploading, withdrawn by deleting. Account and billing — contract. Product analytics — consent, opt-in, no third-party trackers.
An allergy is health data
A preference (“vegetarian”) is a preference. An allergy or intolerance is health data under Article 9 and is treated differently: a separate, always-optional field with its own consent, visible only to the couple and to whoever they deliberately share the caterer list with. Never to other guests, and never in the seating plan.
Children
A child never holds an account. Their data is entered by an adult in their household, is limited to a name, an age band and a diet, and is used for nothing beyond this wedding.
A guest’s rights
Access, rectification, erasure, portability and objection. All of them are features rather than a request to support: a guest edits their own reply and deletes their own photos and entries, and the couple exports a guest’s full record. Erasure is a real delete — rows, files and derivatives go, and backups age out within the documented window.
How long we keep it
Logs 30 days. The privileged-action log 24 months. Wedding content per plan. Account data until deletion, plus the minimum invoices legally require.
Contact
For anything about guest data the couple is the first port of call — they are the controller. For anything about the account or the service, write to us; the address goes here before launch.