Privacy Policy

Who we are

Wedsy provides wedding planning software available via web and mobile app. It is operated by Dorset Pottery Limited, trading as Wedsy, a company registered in England and Wales (no. 13237991), ICO registration number ZB373385. We are based in the United Kingdom.

We are the data controller for your account, billing, support and product usage data.

For the wedding and guest data a couple stores in the product, the couple decides what to collect and who to invite, and we act as their processorin handling it. We also use some of that content for our own limited purposes - securing the service, generating the AI suggestions you ask for, and deciding which supplier suggestions to show you - and for those specific purposes we act as a controller in our own right. Those uses are described in "How we use data" below.

Data we collect

We collect and process the following categories of data:

• Account data - name, email address, hashed password, profile image, and authentication records (including Google or Apple sign-in tokens where used).
• Purchase and entitlement data - add-on purchase history, credit balances, refund status and payment metadata processed via Stripe or an app store. We do not store full card numbers. If you set up a cash fund, Stripe also collects identity and bank account details from you directly in order to pay you out.
• Wedding planning content - event details, budgets, vendor contacts, checklists, seating plans, mood boards, and any other content couples create inside the product.
• Guest data (entered by couples) - guest names, email addresses, postal addresses, meal choices, dietary requirements, RSVP responses, and answers to custom questions set by the couple.
• Guest-uploaded media- photos and videos uploaded by wedding guests via the guest app, the public wedding website or a wedding's photo email address, along with optional uploader names and captions, and the results of the automated safety check described in "Automated screening of guest photos".
• Photographs of you - if you use the outfit and styling features, the portrait photos you choose to upload so that outfits can be visualised on you. These are sent to our AI image provider to produce the image you requested. We do not use them to identify or recognise anyone, and we do not use them to train any model.
• Audio recordings - voice guestbook messages recorded by guests via the mobile app (up to 60 seconds per recording).
• Safety reports - reports of illegal content, content harmful to children and intimate images shared without consent, and complaints and appeals, sent through a report button or our Online Safety page, including any email address you give so we can reply, and a copy of the reported content so we can explain our decision if it is later challenged. If you report an intimate image of yourself, we also keep the statements you confirmed and use the image to look for copies of it on the same wedding.
• Guestbook notes - text messages and song requests submitted by guests on the public wedding website or mobile app.
• Device identifiers - push notification tokens (Expo push tokens) associated with guest or planner devices, along with platform (iOS/Android).
• In-app purchase data - consumable and non-consumable purchase information processed via RevenueCat on mobile.
• Messaging and domain data - domestic SMS delivery and opt-out records, plus encrypted registrant contact details required to register an optional managed domain.
• Technical and security data - your IP address and browser user agent, recorded when you set your cookie preferences so we can evidence that choice, and used in salted, irreversible hashed form to rate-limit abusive traffic and to count visits to a wedding website without identifying visitors.
• Product usage and analytics data- if, and only if, you accept analytics cookies: pages viewed, features used, approximate location derived from a truncated IP address, and device and browser type. See "Cookies and analytics" below.
• Session recordings - if, and only if, you accept analytics cookies: a recording of how you move around and interact with Wedsy (clicks, scrolling, page changes and errors), which lets us find and fix things that confuse people. Text on the pages you view is replaced with asterisks, everything you type into a field is masked, and uploaded photos, video and audio are not recorded, so guest names, contact details and other content on screen are not captured. The only pages shown readably are the public home, pricing, sign-in, register and demo pages.
• Support communications - messages sent to us via email or in-product support.

How we use data

• Provide, operate, and secure the Wedsy service.
• Authenticate users and protect accounts.
• Rate-limit and block abusive traffic.
• Process optional add-on, domain and print payments and manage entitlements.
• Send transactional emails (invitation emails, RSVP confirmations, reminders).
• Deliver push notifications to guests and planners (where opted in).
• Store and serve guest-uploaded photos, videos, and audio recordings.
• Automatically screen guest-uploaded photos for unsafe content before they are shown, and hold flagged photos for the couple to review.
• Generate AI-assisted suggestions, and AI-generated or edited images, via the Wedsy AI assistant and the mood board, styling and theme features.
• Contact suppliers on your behalf, when you ask us to.
• Respond to support requests.
• Measure how the product is used, and review masked session recordings, so we can improve reliability and performance - only where you have accepted analytics cookies.

We do not sell personal data. We do not use personal data for targeted advertising or share it with advertising networks. We do not use your content, photos or guest data to train AI models, and our AI providers are contractually barred from doing so.

Inside the planning app we may show suggestions for suppliers and partners. We choose these ourselves, based on the page you are viewing and the details you have entered about your wedding - for example, a supplier category you have not booked yet. Some of these links are affiliate links, and some suppliers may pay to be featured; paid placements are labelled as such.

We do not build advertising profiles about you, and we do not share your personal information with a supplier or partner unless you choose to contact them, or ask us to contact them for you. As with any link, visiting a supplier's own site will reveal standard technical information such as your IP address to them. Supplier suggestions do not appear on your wedding website, so your guests do not see them.

Legal bases (GDPR)

• Contract performance - processing your account data, billing, and delivering the service you signed up for.
• Legitimate interests - service security, abuse prevention (including screening guest photos for unsafe content), fraud prevention, and showing supplier suggestions that help fund the free plan. You can object to the last of these by contacting us.
• Legal obligation - retaining billing records as required by tax and financial regulations.
• Consent - analytics and marketing cookies, push notifications, and any optional marketing communications. You can withdraw consent at any time.

Guest data is processed on behalf of the couple (the data controller for their guests) under a processor relationship, except for the limited purposes described in "Who we are".

Sensitive information.Dietary requirements, allergies, accessibility needs and similar notes that couples enter about guests can reveal a person's health or religious beliefs. We process these only to provide the service to the couple, who decides whether to collect them and is responsible for having a lawful basis and, where needed, the guest's explicit consent. We do not use them for any other purpose, and we do not use them for advertising or to train AI models.

Third-party service providers

We share data only with providers necessary to operate Wedsy. Current sub-processors include:

• Amazon Web Services (AWS) - cloud hosting, database hosting and S3 file storage for photos, videos, and audio recordings. Amazon Rekognition is used to screen guest-uploaded photos for unsafe content (see "Automated screening of guest photos").
• Resend - transactional email delivery (invitations, RSVP confirmations, reminders, supplier enquiries and support mail).
• AWS SES- receiving inbound guest photo emails sent to a wedding's photo address.
• Stripe - payment processing, tax calculation, refunds, and Stripe Connect payouts for registry cash funds.
• RevenueCat - mobile in-app purchase validation.
• Twilio - domestic SMS delivery and STOP/HELP handling.
• Prodigi - optional printed-stationery production and fulfilment, including recipient delivery addresses.
• Amazon Route 53 - optional domain registration, DNS and renewal.
• Anthropic - AI model provider powering the Wedsy AI assistant and other text features, including categorising mood board images. We use its models directly and through Amazon Bedrock (AWS), where prompts are processed in EU regions. Prompts may include wedding context you have entered.
• Replicate - AI image generation and editing, including theme previews, mood board imagery and the outfit visualisation feature. Where you use outfit visualisation, the portrait you upload is sent to Replicate to produce the image.
• Google (Sign-In)- optional OAuth authentication. Google's privacy policy applies to data processed through Google Sign-In.
• Google (Maps and Places)- venue, accommodation and local guide maps, in the planning app and on public wedding websites. Loading a map sends the viewer's IP address to Google.
• Apple (Sign in with Apple)- optional OAuth authentication on iOS. Apple's privacy policy applies.
• Expo (push notifications) - push notification delivery infrastructure for the mobile app.
• Cloudflare (Turnstile)- bot protection on public forms. Turnstile receives the visitor's IP address and a challenge token.
• Unsplash - stock imagery search and attribution.
• PostHog - product analytics and masked session recordings, hosted in the EU. Loaded only with your consent.
• Google Analytics - website analytics. Loaded only with your consent.

Sharing at your direction

Some features share information outside Wedsy because that is what they are for:

• Supplier enquiries - when you ask us to approach suppliers, we email them the wedding details needed to quote, such as date, location, guest numbers and your contact details.
• Printed stationery - recipient names and postal addresses are sent to our print partner so items can be produced and posted.
• Your public wedding website - anything you publish there is visible to whoever has the link, or the password if you set one.
• Affiliate links- following a registry or supplier link takes you to that retailer's own site, which may add a referral tag identifying Wedsy as the referrer. It does not identify you.
• Connected assistants (ChatGPT, Claude)- Wedsy can connect to an AI assistant you already use, such as ChatGPT or Claude, over the open MCP standard. If you choose to connect one from Settings > Connected assistants, you pick a single wedding to share, and the assistant can read summary planning data for it - checklist status, budget totals, RSVP counts and which supplier categories are booked - and, if you grant permission, add or complete checklist tasks. Guest names, contact details, photos, guestbook content and payment data are never shared with a connected assistant. You can disconnect at any time from Settings > Connected assistants, or from the assistant's own settings; access stops immediately.

Apart from the providers and features described above, we do not share personal data with third parties except where required by law.

International data transfers

Wedsy is operated from the United Kingdom. Data may be transferred to and processed in the United States and other countries where our service providers operate (including AWS, Anthropic, Replicate, Stripe, Resend, Twilio and Google). Where we transfer data outside the UK or EEA, we rely on appropriate safeguards such as Standard Contractual Clauses and the UK International Data Transfer Addendum.

Data retention

• Account data - retained for the life of your account. When you delete your account we immediately delete your password, connected sign-in accounts, active sessions and registered devices, and replace your name, email address and profile image with anonymised placeholders, so the account can no longer be signed into or identified. The remaining record is permanently deleted 30 days later. We hold it for those 30 days so that an account deleted by mistake, or by someone who should not have had access, can still be recovered.
• Wedding and guest data- retained as long as the wedding exists. You can delete individual weddings, or your entire account, at any time from Settings > Privacy & Data. Deleting a wedding permanently removes its planning records, its guest list and its uploaded files. Deleting your account deletes the weddings you created along with it at the end of the 30-day period, unless a wedding has another owner - a partner or planner you shared it with - in which case it stays with them and only your access is removed.
• Session recordings - deleted automatically by our analytics provider after a limited period.
• Guest-uploaded media (photos, video, audio) - deleted when the wedding is deleted. Otherwise, uploader names are anonymised 30 days after the wedding and the files themselves are deleted from storage 365 days after the wedding. Couples can remove individual items at any time.
• Safety reports- kept in full for 12 months after we close them, so we can handle appeals and questions from the regulator. We then delete the reporter's email address, their description and our copy of the content, and delete the rest of the record 3 years after closing it. You can ask us to stop emailing you about a report at any time, using the link in our emails, and we'll delete your address from it.
• Support requests - kept while we help you, then deleted two years after the last message or change on the request. Requests sent from our Support page without signing in are also deleted when you delete an account with the same email address.
• Backups - we keep database backups for disaster recovery. Regular backups are removed on a rolling schedule, so data you delete can remain in a backup for up to 13 months after you delete it. We do not use backups to bring deleted data back into the service, and if we ever restore one we delete again anything that had been deleted since.
• Billing records - retained for up to 7 years to comply with tax and financial regulations.
• Cookie consent records - kept as a record of the cookie choice you made, so we can evidence it if challenged. Deleted on request.
• Push notification tokens - retained until a device is unregistered or the wedding is deleted.

Children's privacy

Wedsy accounts are for adults planning a wedding, and are not for children under 13 (or under 16 in the EEA). We do not knowingly create accounts for them.

Children do appear in Wedsy in two ways. Couples may add children to their guest list (names, and sometimes dietary or seating details), and children who attend a wedding may use the guest pages, for example to view the wedding website or share a photo. Couples decide what to record about their guests, including children, and we process it for them (see "Who we are"). Guest pages don't need an account, don't show other people's contact details, and have no messaging between guests.

Because children may use guest pages, content that is harmful to children is not allowed on Wedsy, and anyone can report it (see our Online Safety page). If you believe a child's information has been added to Wedsy in error, or you want it removed, contact the couple or email us at privacy@wedsy.app and we will act on it promptly.

Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data.
• Restrict or object to certain processing.
• Request a portable copy of your data.
• Withdraw consent where processing is based on consent.

Wedsy account holders can export data and request account deletion from Settings > Privacy & Data. You can also manage push notification preferences in the mobile app settings, and change your cookie choices from the Cookie Policy page.

If you are a wedding guest and want your data corrected or removed, the couple who invited you controls it - contact them first. You can also email us and we will pass the request on and help them action it.

To submit a formal data request, email privacy@wedsy.app. We will respond within 30 days. If you are in the UK or EEA, you also have the right to lodge a complaint with your local data protection authority (in the UK: the ICO at ico.org.uk).

Complaints about how we use your data. Email privacy@wedsy.app with "Complaint" in the subject. We will acknowledge it within 30 days, look into it, and tell you what we found and what we will do. You can go to the ICO at any time, including if you are unhappy with our reply.

If a security incident puts your personal data at risk, we will tell the people affected without undue delay, and the ICO where the law requires it.

California privacy rights

If you are a California resident, you have the right to know what personal information we collect and how it is used, to correct inaccurate information, to request deletion, to limit the use of sensitive personal information, and to opt out of the sale or sharing of personal information. Wedsy does not sell or share personal information as those terms are defined under the CCPA/CPRA, and we will not discriminate against you for exercising any of these rights.

To exercise your rights, contact us at privacy@wedsy.app.

Cookies and analytics

We use essential cookies for authentication, security and remembering your cookie choice; these are always on. We also use optional analytics cookies (PostHog, which also records masked sessions, and Google Analytics) and marketing cookies, which load only if you accept them in the consent banner. You can change your choice at any time from the Cookie Policy page.

Changes to this policy

We may update this policy from time to time. Material changes will be notified by email or in-product notice. The date at the top of this page reflects the latest revision.

Contact

Privacy requests and questions: privacy@wedsy.app