Cordially Wed

1. Who we are

Cordially Wed is registered in New York, United States. We are the data controller for account, billing, and support data. When a host uploads a guest list, the host is the controller for that guest data and we process it to run the event. People in the UK can use the rights in section 7.

For all privacy enquiries: [email protected]

2. Who this policy covers

This policy applies to two categories of people:

• Hosts — wedding couples, event planners, or any individual or business that creates a Cordially Wed account to manage an event.
• Guests — individuals whose contact information is uploaded by a Host and who interact with the platform via Apple Wallet, WhatsApp, SMS, or RSVP pages.

3. Information we collect

From Hosts

• Account information: name, email address, and, for couples, a verified phone number. Planner accounts may also have a password, stored hashed by Firebase Auth. We do not store passwords in plaintext.
• Billing information: processed and tokenised by Stripe — we do not store payment card data on our servers
• Event details: event name, date, timezone, venue locations, schedule items, and dress code
• Guest data: guest names, phone numbers, email addresses, dietary preferences, RSVP status, hotel and travel details, table assignments, relationship data, and custom tags — uploaded via CSV or entered manually

From Guests

• Phone number, provided by the Host or submitted directly via an RSVP or intake form
• RSVP responses, dietary preferences, hotel and travel details, and attendance status
• APNs device token issued by Apple upon Wallet pass installation, used solely to deliver push notifications
• Google Wallet object ID, where a Guest adds a Google Wallet pass

Automatically collected

• Product analytics and ad measurement, unless you turn those categories off. The providers, purposes, and durations are in Cookies below.
• Standard server logs including IP addresses, browser type, and request timestamps

4. How we use your information

We do not sell or rent personal data. We use advertising providers to measure which ads lead to visits, signups, and purchases. Browser advertising tags run by default unless you turn them off. That choice also controls OpenAI Ads server conversion events, which may include a hashed account email or ID, IP address, browser details, and purchase amount. Our other advertising providers may receive conversion events from our server. We do not send guest contact lists or SMS opt-in data for ad measurement. You can change that choice from the cookie icon at the bottom left.

5. Third-party processors

6. International data transfers

Several processors may store data outside the UK. Where such transfers occur, we ensure appropriate safeguards including the UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses (SCCs).

7. Your rights under UK GDPR

• Access — request a copy of your personal data
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your data
• Restriction — limit how we process your data
• Portability — receive data in a structured format
• Objection — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent

Contact [email protected]. We respond within 30 days. You may also lodge a complaint with the ICO.

8. Data retention

Host account data retained for 12 months post-closure. Guest event data purged within 90 days post-event. Billing records retained 7 years per UK tax law.

9. Security

We implement TLS 1.2+, hashed credential storage via Firebase Auth, role-based access controls, and scoped authentication tokens with expiry.

10. Children's privacy

You must be 18 to create an account. A host may include children on a guest list. We store the details the host enters for them, such as name, RSVP, and dietary notes. Children do not get their own accounts.

11. Governing law

This Privacy Policy is governed by the laws of the State of New York, United States.

12. Changes to this policy

Material changes notified 14 days in advance via email. Continued use constitutes acceptance.

13. Contact

Cordially Wed
Registered in New York, United States
[email protected]

14. SMS Communications

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Guests who receive an SMS from Cordially Wed do so because a wedding planner has uploaded their phone number as part of a wedding invitation process. Guests receive a single transactional SMS containing their personalised RSVP link. Message frequency: 1–3 messages per event. Message and data rates may apply. Reply STOP to opt out at any time. Reply HELP for assistance.

Cordially Wed does not send marketing or promotional SMS messages. All SMS communications are transactional and event-specific.

15. Cookies

A cookie icon at the bottom left opens the choice. Necessary storage stays on. Analytics and advertising are on by default. Decline, or switching a category off and accepting, stops those tags and clears the cookies this browser allows us to delete. You can change the choice at any time from that icon, or with the button below.

Cookies

Necessary storage is required to sign in and keep the site secure. Analytics and advertising run by default unless you turn them off. Durations are how long the provider keeps the identifier. Clearing site data in the browser removes what we can delete.

Lawful basis: necessary storage is used to perform the service and keep it secure. Your cookie choices control analytics and advertising. We do not sell personal data. We do not send guest contact lists or SMS opt-in data to these providers.