Privacy policy

weddings is a wedding website service operated from Newcastle upon Tyne, United Kingdom. For the personal data you enter about your guests, you are the data controller and we are your processor: it is your guest list, and we hold it to run your site for you. For your own account details we are the controller.

From you: the email address you sign up with, and everything you choose to put on your site, your names, your story, your events, photographs, gift details and the guest list you build.

From your guests: whatever they submit through your site. Typically their name, whether they are coming to each event, headcount, meal choice, dietary notes and a message. If you switch on the arrivals board they may add a flight and landing time. If they send a gift or a spray, we record the amount, currency and any message.

Automatically: standard server logs, which include IP addresses, kept by our hosting providers for security and troubleshooting. We run no analytics of our own and no advertising pixels.

To run your wedding site and the things you have switched on: showing your pages, counting replies, issuing passes, checking guests in, tallying gifts. We hold your guest data on your instruction, as the person who invited them. For your own account, our lawful basis is performing the contract between us, and for keeping the service secure, our legitimate interest in preventing abuse.

We do not sell, rent or share guest data with anyone for their own purposes. We do not add your guests to any mailing list. We do not email them unless you ask us to and only about your wedding. We do not use your content to advertise to anyone, and nothing on your published site is tracked by a third party.

A small number of processors, each doing one job: Supabase for the database, file storage and sign-in; Vercel for hosting and serving the pages; and a payment provider when you buy a paid plan, which handles the card details directly so we never see them. Data is held in the United Kingdom and the European Economic Area. Where a provider processes data outside that area, it is covered by the UK International Data Transfer Addendum or Standard Contractual Clauses.

Your site and everything on it stays until you delete it. Deleting a site from your dashboard removes that site's guests, replies, photographs, passes and gift records immediately and permanently, in the same operation; it is not archived and there is no thirty-day window in which it quietly still exists. Deleting your account removes your sites with it. Server logs held by our providers age out on their own schedules, typically within thirty days.

Traffic is served over HTTPS and the database is encrypted at rest by our host. Access to a site's data is enforced in the database itself, not only in the application: a signed-in couple can reach the rows belonging to their own sites and nothing else, and the key your browser holds can read nothing on its own. Unpublished sites are reachable only through a preview link carrying a long random token.

No system is perfect. If a breach ever affects your data, we will tell you and, where the law requires it, the Information Commissioner's Office, within 72 hours of becoming aware.

Under UK GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, object to how we use it, or ask for it in a portable form. A guest who has replied to your site has the same rights over their own reply; because it is your guest list, we will normally pass such a request to you, and we will act on it ourselves if you cannot.

Email hello@weddings.example and we will answer within one month. If you think we have got it wrong you can complain to the Information Commissioner's Office at ico.org.uk.

We set two, both functional: one remembering a half-finished draft before you have an account, and one keeping you signed in. Neither tracks you anywhere else. There is more detail on the cookie policy.

If this policy changes in a way that matters, we will say so on this page and, where the change affects how we handle data you have already given us, email you before it takes effect.