1. Zero-Ad & Data Protection Commitment
At Weds.to, we believe a wedding celebration is an intimate, sacred milestone—not an advertising funnel. Traditional wedding platforms often subsidize their tools by monetizing guest lists, selling behavioral leads to third-party vendor directories, or installing invasive tracking pixels.
We do not sell, rent, license, or monetize any couple or guest information. We do not run third-party advertising networks (such as Google Display or Meta Pixel) anywhere on wedding websites, guest-facing RSVP forms, or couple dashboards.
Our business model is straightforward and transparent: couples purchase a bespoke hosted wedding website for a single flat fee. You are our customer—not our product.
2. Scope of Data Collected
We adhere to strict data minimization principles under Article 5(1)(c) of the General Data Protection Regulation (GDPR). We only collect and process information strictly necessary to provide high-performance wedding websites, RSVP management, and collaborator editing.
A. Wedding Couples & Account Owners
- Account Credentials: Email address, hashed authentication credentials managed via Supabase Auth, and optional display name.
- Wedding Content: Couple names, wedding date, ceremony and reception venue addresses, timeline schedules, couple narrative stories, FAQs, and custom registry URLs.
- Media Assets: High-resolution photos, cover imagery, and gallery items uploaded directly to encrypted Supabase Cloud Storage.
B. Wedding Guests
- RSVP Submissions: Guest full names, attendance status (Attending / Regretfully Declines), plus-one companion names, and meal/dietary selections.
- Guestbook Wishes: Warm congratulations, text messages, and optional celebration toasts submitted by guests on public wedding websites.
C. Checkout Email
If you type your email address at checkout, we save it, even if you do not finish your order, so we can help you complete it and send your receipt and sign-in link. We do not add it to marketing lists without your permission. Email hello@weds.to to have it deleted.
D. Payment & Billing Data
All financial transactions are conducted through our Merchant of Record, Lemon Squeezy (Lemon Squeezy, LLC). Weds.to never receives, views, or stores your credit card number, CVV, or banking details. We receive only non-sensitive order tokens, transaction timestamps, and entitlement confirmation.
3. Supabase RLS & Security Architecture
Weds.to is architected on Supabase, an enterprise-grade relational database platform running on top of PostgreSQL. Rather than relying solely on application-layer guards, our database implements native Row Level Security (RLS) policies.
Every database query is evaluated at the PostgreSQL engine level. A couple can only access guest entries, dietary preferences, and workspace settings that belong strictly to their authorized wedding_id. Guests submit RSVPs via strictly scoped server mutations that permit row insertion without exposing existing guest records.
All data in transit is protected using modern TLS 1.3 encryption. Data at rest, including photographic memories in Supabase Storage, is encrypted using standard AES-256 block ciphers.
4. Infrastructure & Sub-processors
To deliver global performance and 99.9% uptime, Weds.to engages vetted, industry-leading sub-processors who comply with rigorous international security standards (SOC 2 Type II, ISO 27001, and EU Standard Contractual Clauses):
| Sub-processor | Function & Service | Location |
|---|---|---|
| Supabase, Inc. | Primary PostgreSQL database, authentication, and encrypted media storage | United States / EU Regions |
| Lemon Squeezy, LLC | Merchant of Record, payment processing, tax/VAT collection, and invoice delivery | United States |
| Vercel, Inc. | Edge application deployment, global CDN asset delivery, and SSL management | Global Edge Network |
| Hostinger | Transactional email delivery (receipts, sign-in links, gift vouchers, RSVP alerts) | European Union |
| Google Analytics (Google LLC) | Visitor statistics on Weds.to marketing pages only, after consent in the EU/UK. Never on couple websites, RSVP forms or dashboards. | United States |
| DeepSeek | AI Concierge writing suggestions. Only the text you type into the concierge and the website content needed to answer are sent. Please do not enter sensitive personal information. | People's Republic of China |
5. International Data Rights (GDPR & CCPA)
Regardless of your country of residence, Weds.to extends complete data sovereignty protections aligned with the European Union General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA):
Under GDPR Article 28 and international privacy statutes:
- The Couple is the Data Controller: With respect to guest attendee information, dietary requirements, and guestbook entries, the wedding couple acts as the legal Data Controller determining what information is requested from their guests. The couple represents and warrants that they possess lawful consent from all invited guests.
- Weds.to is the Data Processor: Weds.to acts strictly as a Data Processor, storing and executing software commands on behalf of the couple.
- Right of Access & Portability: Couples can view all submitted RSVPs in their dashboard and export a complete, unencrypted CSV file at any moment with a single click.
- Right to Erasure ("Right to be Forgotten"): You may delete your wedding website from the dashboard at any time, or request complete account eradication by emailing
hello@weds.to. Upon verification, all database records and storage buckets are permanently expunged within 30 days. - Right to Rectification: You may edit your wedding story, schedule, venue directions, or guest records instantly via the website editor.
- Guest Removal: Any wedding guest who wishes to have their name, RSVP status, or guestbook comment removed can contact the wedding host directly or email our privacy desk.
6. Analytics & Technical Logs
On our own marketing pages (such as the home page, designs and pricing) we use Google Analytics to understand which pages help couples. Visitors in the EU, EEA, UK and Switzerland are asked first, and analytics only loads if they accept. You can change your choice on our Cookie Policy page.
Couple wedding websites, guest RSVP forms, the couple dashboard and the editor never load analytics. We do not use session recording, heatmaps or keystroke tools anywhere on Weds.to.
Like every website, our hosting providers (Vercel and Supabase) keep standard technical logs such as IP address, browser type and error codes, used only to run the service, keep it secure and stop abuse.
7. Data Retention & Lifecycle
Your $49 wedding website purchase includes lifetime access while the Weds.to platform operates. Following your wedding celebration:
- Post-Event Archival: After the wedding event date and 24 months of account inactivity, Weds.to may migrate the live website into an archived, read-only digital keepsake format.
- No Sudden Deletion: We do not suddenly purge your wedding photos or memories. You retain dashboard access to download your guest list and image originals.
- Account Deletion: If you explicitly delete your workspace or request account closure, personal data is permanently wiped from active databases within 30 calendar days.
8. Privacy Contact
For privacy questions, data access or deletion requests, contact us:
Email: support@weds.to
General Concierge: hello@weds.to
We aim to reply within 2 business days and to complete requests within 30 days.
Have a privacy question or data request?
Our Data Protection team handles CSV exports, deletion requests, and compliance questions within 24 hours.