Privacy Policy

Who we are

Wedsy provides wedding planning software available via web and mobile app. We are based in the United Kingdom.

We are the data controller for your account, billing, support and product usage data.

For the wedding and guest data a couple stores in the product, the couple decides what to collect and who to invite, and we act as their processorin handling it. We also use some of that content for our own limited purposes - securing the service, generating the AI suggestions you ask for, and deciding which supplier suggestions to show you - and for those specific purposes we act as a controller in our own right. Those uses are described in "How we use data" below.

Data we collect

We collect and process the following categories of data:

• Account data - name, email address, hashed password, profile image, and authentication records (including Google or Apple sign-in tokens where used).
• Purchase and entitlement data - add-on purchase history, credit balances, refund status and payment metadata processed via Stripe or an app store. We do not store full card numbers. If you set up a cash fund, Stripe also collects identity and bank account details from you directly in order to pay you out.
• Wedding planning content - event details, budgets, vendor contacts, checklists, seating plans, mood boards, and any other content couples create inside the product.
• Guest data (entered by couples) - guest names, email addresses, postal addresses, meal choices, dietary requirements, RSVP responses, and answers to custom questions set by the couple.
• Guest-uploaded media - photos and videos uploaded by wedding guests via the guest app or public wedding website, along with optional uploader names and captions.
• Photographs of you - if you use the outfit and styling features, the portrait photos you choose to upload so that outfits can be visualised on you. These are sent to our AI image provider to produce the image you requested. We do not use them to identify or recognise anyone, and we do not use them to train any model.
• Audio recordings - voice guestbook messages recorded by guests via the mobile app (up to 60 seconds per recording).
• Guestbook notes - text messages and song requests submitted by guests on the public wedding website or mobile app.
• Device identifiers - push notification tokens (Expo push tokens) associated with guest or planner devices, along with platform (iOS/Android).
• In-app purchase data - consumable and non-consumable purchase information processed via RevenueCat on mobile.
• Messaging and domain data - domestic SMS delivery and opt-out records, plus encrypted registrant contact details required to register an optional managed domain.
• Technical and security data - your IP address and browser user agent, recorded when you set your cookie preferences so we can evidence that choice, and used in salted, irreversible hashed form to rate-limit abusive traffic and to count visits to a wedding website without identifying visitors.
• Product usage and analytics data- if, and only if, you accept analytics cookies: pages viewed, features used, approximate location derived from a truncated IP address, and device and browser type. See "Cookies and analytics" below.
• Support communications - messages sent to us via email or in-product support.

How we use data

• Provide, operate, and secure the Wedsy service.
• Authenticate users and protect accounts.
• Rate-limit and block abusive traffic.
• Process optional add-on, domain and print payments and manage entitlements.
• Send transactional emails (invitation emails, RSVP confirmations, reminders).
• Deliver push notifications to guests and planners (where opted in).
• Store and serve guest-uploaded photos, videos, and audio recordings.
• Generate AI-assisted suggestions, and AI-generated or edited images, via the Wedsy AI assistant and the mood board, styling and theme features.
• Contact suppliers on your behalf, when you ask us to.
• Respond to support requests.
• Measure how the product is used, so we can improve reliability and performance - only where you have accepted analytics cookies.

We do not sell personal data. We do not use personal data for targeted advertising or share it with advertising networks. We do not use your content, photos or guest data to train AI models, and our AI providers are contractually barred from doing so.

Inside the planning app we may show suggestions for suppliers and partners. We choose these ourselves, based on the page you are viewing and the details you have entered about your wedding - for example, a supplier category you have not booked yet. Some of these links are affiliate links, and some suppliers may pay to be featured; paid placements are labelled as such.

We do not build advertising profiles about you, and we do not share your personal information with a supplier or partner unless you choose to contact them, or ask us to contact them for you. As with any link, visiting a supplier's own site will reveal standard technical information such as your IP address to them. Supplier suggestions do not appear on your wedding website, so your guests do not see them.

Legal bases (GDPR)

• Contract performance - processing your account data, billing, and delivering the service you signed up for.
• Legitimate interests - service security, abuse prevention, fraud prevention, and showing supplier suggestions that help fund the free plan. You can object to the last of these by contacting us.
• Legal obligation - retaining billing records as required by tax and financial regulations.
• Consent - analytics and marketing cookies, push notifications, and any optional marketing communications. You can withdraw consent at any time.

Guest data is processed on behalf of the couple (the data controller for their guests) under a processor relationship, except for the limited purposes described in "Who we are".

Third-party service providers

We share data only with providers necessary to operate Wedsy. Current sub-processors include:

• Amazon Web Services (AWS) - cloud hosting, database hosting and S3 file storage for photos, videos, and audio recordings. AWS Rekognition is used to screen uploaded images for unsafe content where enabled.
• Resend - transactional email delivery (invitations, RSVP confirmations, reminders, supplier enquiries and support mail).
• AWS SES- receiving inbound guest photo emails sent to a wedding's photo address.
• Stripe - payment processing, tax calculation, refunds, and Stripe Connect payouts for registry cash funds.
• RevenueCat - mobile in-app purchase validation.
• Twilio - domestic SMS delivery and STOP/HELP handling.
• Prodigi - optional printed-stationery production and fulfilment, including recipient delivery addresses.
• Amazon Route 53 - optional domain registration, DNS and renewal.
• Anthropic - AI model provider powering the Wedsy AI assistant and other text features. Prompts may include wedding context you have entered.
• OpenAI - AI model provider used to categorise mood board images.
• Replicate - AI image generation and editing, including theme previews, mood board imagery and the outfit visualisation feature. Where you use outfit visualisation, the portrait you upload is sent to Replicate to produce the image.
• Google (Sign-In)- optional OAuth authentication. Google's privacy policy applies to data processed through Google Sign-In.
• Google (Maps and Places)- venue, accommodation and local guide maps, in the planning app and on public wedding websites. Loading a map sends the viewer's IP address to Google.
• Apple (Sign in with Apple)- optional OAuth authentication on iOS. Apple's privacy policy applies.
• Expo (push notifications) - push notification delivery infrastructure for the mobile app.
• Cloudflare (Turnstile)- bot protection on public forms. Turnstile receives the visitor's IP address and a challenge token.
• Unsplash - stock imagery search and attribution.
• PostHog - product analytics, hosted in the EU. Loaded only with your consent.
• Google Analytics - website analytics, with IP anonymisation enabled. Loaded only with your consent.

Sharing at your direction

Some features share information outside Wedsy because that is what they are for:

• Supplier enquiries - when you ask us to approach suppliers, we email them the wedding details needed to quote, such as date, location, guest numbers and your contact details.
• Printed stationery - recipient names and postal addresses are sent to our print partner so items can be produced and posted.
• Your public wedding website - anything you publish there is visible to whoever has the link, or the password if you set one.
• Affiliate links- following a registry or supplier link takes you to that retailer's own site, which may add a referral tag identifying Wedsy as the referrer. It does not identify you.

Apart from the providers and features described above, we do not share personal data with third parties except where required by law.

International data transfers

Wedsy is operated from the United Kingdom. Data may be transferred to and processed in the United States and other countries where our service providers operate (including AWS, Anthropic, OpenAI, Replicate, Stripe, Resend, Twilio and Google). Where we transfer data outside the UK or EEA, we rely on appropriate safeguards such as Standard Contractual Clauses and the UK International Data Transfer Addendum.

Data retention

• Account data - retained for the life of your account. When you delete your account we immediately delete your password, connected sign-in accounts, active sessions and registered devices, and replace your name, email address and profile image with anonymised placeholders, so the account can no longer be signed into or identified. The remaining record is permanently deleted 30 days later. We hold it for those 30 days so that an account deleted by mistake, or by someone who should not have had access, can still be recovered.
• Wedding and guest data- retained as long as the wedding exists. You can delete individual weddings, or your entire account, at any time from Settings > Privacy & Data. Deleting a wedding permanently removes its planning records, its guest list and its uploaded files. Deleting your account deletes the weddings you created along with it at the end of the 30-day period, unless a wedding has another owner - a partner or planner you shared it with - in which case it stays with them and only your access is removed.
• Guest-uploaded media (photos, video, audio) - deleted when the wedding is deleted. Otherwise, uploader names are anonymised 30 days after the wedding and the files themselves are deleted from storage 365 days after the wedding. Couples can remove individual items at any time.
• Billing records - retained for up to 7 years to comply with tax and financial regulations.
• Cookie consent records - kept as a record of the cookie choice you made, so we can evidence it if challenged. Deleted on request.
• Push notification tokens - retained until a device is unregistered or the wedding is deleted.

Children's privacy

Wedsy is not directed at children under 13 (or under 16 in the EEA). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at privacy@wedsy.app and we will delete it promptly.

Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data.
• Restrict or object to certain processing.
• Request a portable copy of your data.
• Withdraw consent where processing is based on consent.

Wedsy account holders can export data and request account deletion from Settings > Privacy & Data. You can also manage push notification preferences in the mobile app settings, and change your cookie choices from the Cookie Policy page.

If you are a wedding guest and want your data corrected or removed, the couple who invited you controls it - contact them first. You can also email us and we will pass the request on and help them action it.

To submit a formal data request, email privacy@wedsy.app. We will respond within 30 days. If you are in the UK or EEA, you also have the right to lodge a complaint with your local data protection authority (in the UK: the ICO at ico.org.uk).

California privacy rights

If you are a California resident, you have the right to know what personal information we collect and how it is used, to correct inaccurate information, to request deletion, to limit the use of sensitive personal information, and to opt out of the sale or sharing of personal information. Wedsy does not sell or share personal information as those terms are defined under the CCPA/CPRA, and we will not discriminate against you for exercising any of these rights.

To exercise your rights, contact us at privacy@wedsy.app.

Cookies and analytics

We use essential cookies for authentication, security and remembering your cookie choice; these are always on. We also use optional analytics cookies (PostHog and Google Analytics) and marketing cookies, which load only if you accept them in the consent banner. You can change your choice at any time from the Cookie Policy page.

Changes to this policy

We may update this policy from time to time. Material changes will be notified by email or in-product notice. The date at the top of this page reflects the latest revision.

Contact

Privacy requests and questions: privacy@wedsy.app