Transparent about everything we do with your data

Who we are

OurVows is operated by Michael Bruty, a sole trader based in the United Kingdom. For the purposes of UK data protection law, Michael Bruty is the data controller for the personal data processed through this service.

If you have any questions about this policy or how we handle your data, you can contact us at privacy@ourvows.site.

What we collect and why

Account information — When you sign up, we store your name, email address, and authentication method (email/password, Google, or Apple). Passwords are hashed using industry-standard algorithms and are never stored in plain text. We process this data to provide and secure your account (lawful basis: contract).

Wedding content — Text, images, settings, and guest-facing website content you create are stored on our infrastructure to deliver the service. Images are stored using Cloudflare R2 (lawful basis: contract).

Guest information — When couples add guests to their wedding, guest names, email addresses, and phone numbers may be stored. This data is used solely to enable wedding invitations, RSVP-related features, seating plans, and guest-facing website experiences.

Under Article 26 of the UK GDPR, OurVows and the couple act as joint controllers for guest data. The couple decides who to invite and what personal data to provide; OurVows decides the technical means of storing, securing, and processing that data to deliver the Service. We will never contact guests for marketing purposes or share guest data with third parties beyond what is necessary to deliver the Service (lawful basis: legitimate interest of the couple to manage their wedding; contract between OurVows and the couple).

Legitimate interest detail: we rely on the couple's legitimate interest in organising their wedding to process guest names and contact details for invitations and RSVPs. We have assessed that this processing is necessary, proportionate, and does not override the guests' rights — guests expect their details to be used for wedding communications, the data is limited to what is needed, and guests can request deletion at any time.

Payment information — Payments are handled entirely by Stripe. We do not receive or store your full card details. Stripe may share limited information with us (such as the last four digits of your card, billing country, and transaction status) to display on your account (lawful basis: contract).

Page view analytics — With your consent, we load Cloudflare Web Analytics, a cookieless analytics service, to understand which pages are visited. This service does not track individual users across sites and does not use cookies. It is only loaded after you grant consent via the analytics banner (lawful basis: consent).

Usage events — We record server-side events when you perform key actions (such as creating a wedding or publishing your site). These events include a pseudonymised user identifier, a wedding identifier, and a timestamp. They do not include browsing history, IP addresses, or device fingerprints. We use this data to understand feature usage and improve the service (lawful basis: legitimate interest — understanding how features are used to improve the product; this processing is minimal, uses pseudonymised identifiers, and does not affect your rights).

QR code and invite open tracking — When a couple generates printed invitations or venue QR codes, we create secure access tokens that allow guests to reach the RSVP page or photo book without needing to enter a site password. When a guest scans a QR code or follows an invite link, we record whether the link was opened. For per-household invite links (available on premium plans), we store the time of first open and a total open count linked to the household. For shared QR codes, we generate a pseudonymised device fingerprint (a SHA-256 hash of generic browser properties such as screen size, timezone, and language) to count approximate unique scans. We do not use cookies or store raw device data for this purpose. The fingerprint cannot identify you personally and is automatically deleted when the couple deletes the associated token or their wedding (lawful basis: legitimate interest of the couple to understand invite engagement; the fingerprint is a one-way hash that cannot identify you personally and is deleted with the token).

Security rate limiting — To protect against brute-force attacks and service abuse, we temporarily process IP addresses in hashed (pseudonymised) form to enforce request rate limits. This data is stored in our database and is typically deleted within minutes as rate limiting windows expire. A periodic cleanup ensures all expired records are removed. We do not log, store, or associate raw IP addresses with your account for this purpose (lawful basis: legitimate interest — protecting the service and its users from abuse; rate limiting is a standard security measure that uses only hashed data and retains it for minutes, not indefinitely).

Cookies and local storage

OurVows uses a session cookie for authentication and a site access cookie that remembers when a guest has been granted access to a password-protected wedding site (for example, via a QR code or invite link). We do not use tracking cookies, advertising cookies, or third-party marketing cookies.

We use your browser's local storage to remember your analytics consent preference and to temporarily store photo book selections while you compose a contribution (so your progress is not lost if you navigate away). This data stays on your device and is not sent to our servers automatically. It contains no personal data beyond your consent preference.

For full details about cookies and how to manage your preferences, see our Cookie Policy.

Cloudflare Web Analytics is cookieless — it does not set or read any cookies.

Third-party service providers

We share data only with the service providers required to operate OurVows:

• Cloudflare (USA) — hosting, database, image storage, analytics, content delivery, and bot protection (Cloudflare Turnstile on sign-in and public forms)
• Stripe (USA) — payment processing
• Resend (USA) — transactional email delivery (e.g. RSVP notifications)
• Anthropic (USA) — AI-powered features. When you use our AI features (such as theme generation, message templates, or the seating assistant), relevant wedding data is sent to Anthropic's Claude API. This may include couple names, wedding date, venue details, theme preferences, and — when using the seating assistant — guest names, household groupings, dietary requirements, and seating preferences. Anthropic processes this data solely to generate a response and does not use it to train models.
• OpenAI (USA) — AI-powered features. Some parts of our AI workflow use OpenAI models, including GPT models associated with ChatGPT, via the OpenAI API. This includes features such as design suggestions, theme and style generation, copy generation, RSVP wording, photobook content, and free-tier chat experiences. When you use these features, relevant wedding data may be sent to OpenAI. This may include prompts, couple names, wedding date, venue details, theme preferences, draft copy, block content, and other wedding details needed to generate the requested result. By default, OpenAI does not use API customer content to train its models.
• Google LLC (USA) — authentication (Google sign-in) and Google Photos integration for photo book export. OAuth consent is required before any Google Photos data is accessed. We do not store your Google Photos content; images are fetched on demand at your request (lawful basis: consent / contract).
• Sentry (Functional Software, Inc.) (USA) — error monitoring. We collect error reports including anonymised request metadata to diagnose issues. No personal data is included in error reports (lawful basis: legitimate interest — maintaining service reliability).
• Spotify AB (Sweden) — song request search. When you or your guests use the song request feature, only the search query is sent to Spotify. No personal data is shared (lawful basis: contract).

These providers process data on our behalf under data processing agreements. As they are based in the United States, your data may be transferred outside the UK and EEA. These transfers are protected by appropriate safeguards, including standard contractual clauses and, where applicable, adequacy decisions. Each provider's own privacy policy governs their handling of your data.

We do not sell, rent, or share your personal data with advertisers or data brokers.

Sub-processor data processing agreements

• Cloudflare DPA
• Stripe DPA
• Resend DPA
• Google Data Processing Terms
• Anthropic DPA
• OpenAI DPA
• Sentry DPA

Data retention

• Account data — retained until you delete your account.
• Wedding content and images — retained until the couple deletes their wedding or account.
• Guest data — retained while the wedding exists and deleted when the couple deletes their wedding or account.
• Usage events — retained for 90 days in Cloudflare Analytics Engine, then automatically deleted.
• Page view analytics — retained by Cloudflare Web Analytics for up to 6 months.
• QR code and invite tracking data — retained while the associated token exists and deleted when the couple revokes the token or deletes their wedding.
• Session data — expires on sign-out or after a period of inactivity.
• Rate limiting data — hashed IP addresses and request counters are typically retained for up to 5 minutes (the longest rate limiting window), then automatically deleted by periodic cleanup.
• Payment records — retained as required by UK tax and accounting obligations.

Data security

We take reasonable measures to protect your data, including encrypted connections (HTTPS) for all traffic, hashed passwords, and access controls on our infrastructure. While no system is completely secure, we are committed to protecting your information and will notify affected users promptly in the event of a data breach.

Your rights

If you are in the United Kingdom or the EU/EEA, data protection law gives you the following rights over your personal data:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate personal data
• Erasure — ask us to delete your personal data
• Restriction — ask us to restrict processing in certain circumstances
• Portability — receive your data in a portable format
• Objection — object to processing based on legitimate interest
• Withdraw consent — withdraw analytics consent at any time via the Cookie Preferences link in the footer of any page

If you have an OurVows account, you can exercise many of these rights directly from your Privacy & Data settings page, where you can export your data, request deletion, and manage your consent preferences.

You can also exercise any of these rights by emailing privacy@ourvows.site. We will respond within one month.

If you are not satisfied with how we handle your request, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Information for wedding guests

If you are a guest whose details have been added to OurVows by a couple, here is what you should know:

• Your name, email address, and/or phone number were provided to us by the couple planning the wedding.
• We use this information only to deliver wedding invitations, RSVP-related communications, and QR code access links on the couple's behalf.
• We will never send you marketing emails or share your details with third parties for their own purposes.
• You can ask us to delete your information at any time by emailing privacy@ourvows.site. We will also inform the couple that your data has been removed.

Children's data

OurVows accounts are intended for adults aged 18 and over. We do not knowingly collect personal data directly from children, and children do not create accounts or interact with the service independently.

However, wedding guests may include children. Couples may include children's names in their guest list for the purpose of managing RSVPs, seating arrangements, and meal selections. This data is:

• Limited to what the couple provides (typically a first name and meal preference)
• Stored alongside the parent or guardian's household record
• Subject to the same protections and retention periods as other guest data
• Deleted when the couple removes the guest or deletes their wedding

If you are a parent or guardian and believe your child's data has been added to OurVows without your knowledge, please contact us at privacy@ourvows.site and we will promptly delete it. We will also inform the couple that the data has been removed.

Are you required to provide this data?

Creating an OurVows account requires your name, email address, and a password (or social sign-in). This information is necessary to fulfil our contract with you — without it, we cannot provide the Service.

Guest features (RSVP, photo book contributions, time capsule messages) require a name so that responses can be attributed to the correct guest. This is necessary for the couple to manage their wedding.

All other data you provide (wedding details, venue information, theme preferences, photos) is optional. The Service remains available without optional data, though some features may be limited.

Automated decision-making

We do not make decisions about you solely by automated means that produce legal or similarly significant effects.

OurVows includes AI-powered features such as theme generation, seating suggestions, and message drafts. These features provide suggestions only — the couple can accept, edit, or reject every AI suggestion before it takes effect. No automated decision is applied without human review.

Changes to this policy

We may update this policy from time to time. Changes will be reflected by the "Last updated" date at the top of this page. For significant changes, we will make reasonable efforts to notify you (for example, via email or a notice in the app). We review this policy at least once a year.

Version history