Privacy Policy
Last updated: 8 October 2026
This policy explains how TyingTheKnot.app collects, uses, stores, shares and retains personal data. It covers couples who build a wedding app, guests who interact with one, and anyone who visits our website or contacts us. Please read it alongside our [Terms & Conditions](/terms) and [Cookie Policy](/cookies).
01Who we are
TyingTheKnot.app (“TyingTheKnot”, “we”, “us”, “our”) is a mobile-first wedding guest experience platform. Couples create a shareable wedding app and their guests can view the schedule, get directions, RSVP, sign a guestbook, and upload photos and video messages. We are the data controller for the personal data described in this policy.
We operate as TyingTheKnot.app. For any privacy question or request, contact us at hello@tyingtheknot.app. Our website is https://tyingtheknot.app.
Company registration
The full legal entity details (registered company name, company number, registered address and ICO registration number) are being finalised and will be added to this policy before publication. For now, please direct any privacy queries to hello@tyingtheknot.app.
02Scope of this policy
This policy applies when a couple creates an account and builds a wedding app, when a guest visits a wedding app and interacts with it (for example by RSVPing, signing the guestbook, or uploading photos or video messages), and when anyone visits our marketing website or contacts us. It does not apply to third-party websites or services we do not control.
03Personal data we collect
Couples (account holders)
When a couple signs up and builds their wedding app, we collect:
- Account data: name, partner's name, email address, and a password stored in hashed form. If you sign in with Google, we also receive your Google account identifier and basic profile details (name and email) from Google.
- Wedding content: wedding date, venue name and address, schedule items, directions, FAQ, menu, dress code, gift details, accommodation, your love story, wedding party, and any custom pages you write.
- Design data: chosen theme, monogram style and initials.
- Preferences: notification settings, including which emails to receive, the daily digest time and your timezone.
- Profile media: a profile photo and/or cover image where uploaded.
Guests
Guests do not create an account. When a guest interacts with a wedding app, we collect:
- RSVP data: guest name, email address, whether they are attending, the number of guests, dietary requirements, a message, and any custom questions the couple has added.
- Guestbook data: guest name, an optional email address, the message left, and any custom fields.
- Uploaded media: photos and videos, the uploader's name, captions, file metadata (size, type and, for video, duration), and moderation status.
- Technical data: standard server logs (such as IP address, browser/user-agent and timestamps) generated by our hosting and database providers in the normal course of serving the site.
Communications and email data
We use transactional email to send RSVP confirmations, couple alerts, daily digests, storage alerts, archive-ready notifications and similar messages. We keep an email suppression list of addresses that have bounced, been marked as spam, or unsubscribed, so that we do not contact them again.
What we do not do
- We do not run Google Analytics, Google Tag Manager, Meta Pixel, or any other advertising or behavioural analytics.
- We do not sell personal data.
- We do not use personal data to build advertising profiles.
04Who is responsible for what
For couple accounts and wedding content, TyingTheKnot is the data controller. For guest interactions such as RSVPs, guestbook entries and uploads, the couple decides which fields and sections to enable and how the data is used, and we process that data to provide the service. Depending on the circumstances, the couple may be a controller or a joint controller of their guests' data, with TyingTheKnot acting as controller for platform operation and security.
For couples
Please make sure your guests understand how their information is used — for example, that RSVP details and uploaded media are visible to you and, where you choose, to your other guests.
05How and why we use personal data
We rely on the following lawful bases (under the UK GDPR) for processing personal data:
| Purpose | Data used | Lawful basis |
|---|---|---|
| Create and manage accounts; provide the wedding app | Account, wedding, design and preference data | Contract (Art. 6(1)(b)) |
| Collect RSVPs, guestbook entries and uploaded media | Guest data and media | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Send transactional emails (confirmations, alerts, digests, archive-ready) | Name, email and event data | Contract; legitimate interests |
| Moderate uploaded media and guestbook entries | Media and guestbook data | Legitimate interests (safety and quality) |
| Provide AI-assisted content generation | Couple names, wedding date, love story and user prompt | Consent and/or legitimate interests |
| Secure the service and prevent abuse | Technical and log data | Legitimate interests; legal obligation |
| Measure how the site is used and measure our advertising | Cookie identifiers, usage and device data | Consent (Art. 6(1)(a)) |
| Comply with legal, tax and accounting duties | Account and payment data | Legal obligation (Art. 6(1)(c)) |
Where we rely on consent, you may withdraw it at any time. Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms.
06Cookies and similar technologies
We use a small number of strictly necessary cookies for sign-in and session management, plus optional analytics and advertising cookies (Google Analytics and the Meta Pixel) that are set only with your consent. We use these to understand how the site is used and to measure our advertising. Some third-party embeds, such as Google Maps, and our app's offline features also store data on your device. See our Cookie Policy for the full list, including how to accept, refuse or withdraw consent.
07Sharing and service providers
We share personal data with the following service providers and third parties. Our infrastructure providers process data on our behalf under data processing agreements; our analytics and advertising providers (Google Analytics and the Meta Pixel) act under their own terms, as described in our Cookie Policy.
| Provider | Service | Personal data involved | Location |
|---|---|---|---|
| Netlify, Inc. | Website hosting and content delivery | All data transmitted through the site; server logs | United States / global |
| Supabase, Inc. | PostgreSQL database, authentication and auth emails | Account, wedding, RSVP, guestbook, media metadata, notification settings and suppression list | United States (database region to be confirmed) |
| Cloudflare, Inc. (R2) | Object storage for photos, videos and archive files | Uploaded photos and videos; generated archive files | Global (Cloudflare network) / United States |
| Resend, Inc. | Transactional email delivery | Recipient name and email; email content | United States |
| OpenAI, L.L.C. | AI content generation (gpt-4o-mini) | Couple names, wedding date, love story text and the prompt entered | United States |
| Google LLC | “Sign in with Google”; Google Maps embed; Google Fonts; Google Analytics | Google account identifier and profile; IP address for map and font requests; cookie identifiers and usage data for analytics | United States / global |
| Meta Platforms, Inc. | Meta Pixel (advertising measurement and targeting) | Cookie identifiers, page and device information, and IP address when you visit the site | United States / global |
| Stripe, Inc. | Payment processing (one-off Checkout payments) | Payment data: name, email, billing address, payment method and amount. Card numbers are entered on Stripe-hosted pages and never pass through our servers | United States / global |
We may also disclose personal data to professional advisers under confidentiality, to law enforcement or regulators where required by law, or in connection with a sale or reorganisation of our business. We never sell personal data.
Payment processing
Payments for the Complete Wedding App and the Memories Collection are processed by Stripe through its hosted checkout pages. We do not store or process card numbers on our servers. Stripe's privacy terms apply to the data you enter on its checkout pages.
08International transfers
Some of our providers are based in, or process data in, the United States and other countries outside the UK. Where we transfer personal data outside the UK, we rely on appropriate safeguards, including the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, provider data processing agreements, and, where applicable, an adequacy finding such as the UK–US Data Bridge.
09Security
We take reasonable technical and organisational measures to protect personal data, including:
- Row Level Security on all database tables, so users can only access their own data.
- Private media storage — photos and videos are held in a private Cloudflare R2 bucket and served only through short-lived signed URLs; storage paths are never exposed to the browser.
- Encrypted transport (HTTPS/TLS) for data in transit.
- Hashed passwords managed by our authentication provider.
- Server-side authorisation checks on every mutation.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10Retention
We keep personal data only as long as necessary for the purposes described in this policy.
- Archive downloads (ZIPs): automatically deleted 48 hours after they are generated.
- Archive job records: purged 30 days after completion or failure.
- Email suppression list: retained to honour unsubscribe and bounce requests.
- Accounts and wedding content: kept while your account is active, and deleted within 30 days of account closure.
- RSVPs, guestbook entries, photos and videos: deleted with the wedding app and account, or earlier on request.
- Financial records: kept for as long as required by law.
Account closure
To close your account and have your wedding app and its data deleted, email hello@tyingtheknot.app from the email address registered to your account. We will action the request within 30 days.
11Your rights
Under the UK GDPR you have the right to access, rectify, erase, restrict or object to the processing of your personal data, and to data portability where processing is based on consent or contract. You may withdraw consent at any time where processing is based on consent, and you may lodge a complaint with the Information Commissioner's Office at https://ico.org.uk.
To exercise any of these rights, contact us at hello@tyingtheknot.app. We will respond within one month. Couples can download their full media collection from the dashboard at any time. Guests who wish to have an RSVP, guestbook entry or upload removed should contact the couple directly — the couple can remove it from their dashboard, or we can assist via the address above.
12Children
The service is intended for adults aged 18 or over. Couples must be at least 18 to create an account. Guests under 18 should only submit an RSVP, guestbook entry or upload with the consent of a parent or guardian. If we learn that we have collected personal data from a child without appropriate consent, we will delete it.
13AI features
We use OpenAI's gpt-4o-mini model to help couples draft wedding content, such as section text and suggested FAQs. When a couple uses an AI feature, the relevant text (for example names, wedding date, love story and the prompt) is sent to OpenAI to generate a response. We do not use AI for automated decisions that have legal or similarly significant effects. Under OpenAI's API terms, data submitted via the API is not used to train their models by default.
14Changes to this policy
We may update this policy from time to time. We will post the new version on this page and update the “Last updated” date. Where changes are material, we will notify couples by email.
15Contact
For any privacy question or request, contact us at hello@tyingtheknot.app. We will respond as soon as possible and within one month in all cases.