What we do with your information

What we hold

Two different kinds of information:

• About you, the host. Your email address and a scrambled version of your password. We never see the password itself. Plus whatever you put into your celebration: the host names, your events, any picture you upload for your invitation or your website, and the address of your own website if you add one. If you are a planner, also your studio's name and how many trade credits you have left.
• About your guests. Their name, their phone number if you add one, any tags you sort them into, which events you invited them to, their reply and when it arrived, any dietary note, whether they left it themselves or told you and you wrote it down, and any short message they choose to send you. You add your guests. We never collect them from anywhere else.
• Internet addresses, briefly. When a guest replies to an invitation, or looks up the name on theirs, we note the address it came from, purely to stop a script hammering an invite link or working through a guest list. It isn't linked to anyone's account, it isn't used to work out who or where anybody is, and it's deleted within a day.

What we use it for

Only to run the thing you signed up for: building your guest list, creating each guest's invite page, recording who's coming, and showing you the totals. That's the whole list. We don't use your guest list for advertising, we don't sell it, and we don't share it with anyone for their own purposes.

We may email you about your account, a confirmation link when you sign up, or a reset link when you forget your password.

A note on sending invites

When you tap WhatsApp or iMessage on a guest, the message goes from your own phone, through your own WhatsApp or Messages account. We don't send it, and we never connect to either of them on your behalf. We just open the app for you with the message ready to go.

Adding events to a calendar, and directions

A guest can download the events they're invited to as a calendar file. It's built and sent by us alone. Nothing is shared with Google, Apple or whoever they keep their calendar with unless they choose to open the file there.

If a host has added directions, the guest's invitation shows a link. Where the host pasted a link of their own it goes wherever that points; where they typed an address, it opens a map search for it. Either way nothing loads until the guest taps it, and following it takes them to that other site in the ordinary way.

When a host searches for a venue while setting up an event, what they type is sent to a mapping service to fetch matching places for them to pick from. That happens only as they search, we don't keep the searches, and a host who prefers can simply type the venue in without searching.

A host's website can show a small map under each day. We draw that map ourselves from OpenStreetMap's public data and send it from our own site, so opening the website loads nothing from a map company. To draw it, the venue's address is sent to a mapping service, and nothing about the guest is. Tapping the map opens a map search for the venue, the same as the directions link.

If you link to your own website

You can add the address of your own celebration website, and we'll show a link to it on every guest's invite page. Following that link takes your guest off our site. From that point they're on whoever runs that website's terms, and whatever it does with visitors is between them and it. We don't check what's on the other end, and we don't pass your guests' details along with them.

Your own website, on our site

You can also build a website here, at an address of ours, and publish it for your guests. What goes on it is what you write and what you have already told us: your names, your dates, your venues, whatever you add about getting there and where to stay, and any photographs you add to it, of you, of the people standing with you, or in a section of pictures. Guests never appear on it, and a photograph you take off it is deleted rather than kept.

It is a link, not a listing. The address is long and unguessable, anyone the link is forwarded to can read the page, and we ask search engines not to index it, so a published website should not turn up in search results. Until you publish it, nobody but your team can open it, and taking it down again makes the address stop working.

The link a guest is sent carries their own reference, so the site knows which of your days they were invited to and shows them only those, and so that they can reply on the page. Their reply goes to the same place their invitation would have sent it. A visitor we cannot identify, on a forwarded link, sees only the days every guest is invited to, and can ask for the name on their invitation to find their own reply. That lookup answers the same way whether the name is on your list or not, and it is limited to a few attempts an hour.

You can put a password on your website. If you do, anyone opening it without an invitation is asked for it before they see anything except your names. Your guests are not asked: the link in their invitation already tells the site who they are, and it takes them straight in. Wrong answers are limited to a few attempts an hour, and while a password is on, the lookup described above does not answer at all. We store the word as you typed it, so that you can read it back and tell people what it is, and only you and your team can see it. It is a word for one page, so please do not use a password you use anywhere else. Change it whenever you like: everyone who has already typed the old one is asked again.

On some plans you can have that website at an address of your own, like abiandtobi.com, which we register in your name. That address is meant to be typed and shared, so it is not the secret the long one was. Nothing else about the page changes: a visitor we cannot identify still sees only the days every guest is invited to, never a name, never anyone's reply, and we still ask search engines not to index it. The page also keeps its address here, so every link you have already sent goes on working. If the registration ever lapses, only that address stops; your website and everything on it stay exactly where they are.

Who can see it

• You, and anyone you invite onto your planning team. Anyone on the team can be removed by the others, and can step away themselves; either way their access stops there and then. One person always has to remain, so a celebration is never left with nobody able to reach it. A planner who set a celebration up for you is on the team as your planner: they can do everything you can except remove you.
• Your guests see your planner's studio name, if a planner set your celebration up and gave us one. It appears once, at the foot of each invitation, as "Planned by" and the name. Nothing else about the planner is shown.
• Each guest, who sees their own invite page. Invite links are long and unguessable, but anyone the link is forwarded to can open it, so treat it like the invitation it is. We ask search engines not to index invite pages, so one that ends up somewhere public shouldn't turn up in search results. The page names the guest it was sent to, so somebody who was forwarded it can see that the reply is not theirs, and can ask for the name on their own invitation instead. That lookup covers only your celebration, answers the same way whether the name is on your list or not, and is limited to a few attempts an hour.
• Everyone sharing an invitation. A host can put several people on one invitation, a household, say, so that they reply together. When they do, one link covers all of them: whoever opens it sees the names of the others on that invitation, and can answer and leave dietary notes for them. It never reaches beyond that one invitation, and it never shows anyone the guest list.
• Us, if we genuinely need to look in order to fix a problem or answer a question you've asked.
• The companies that run our servers, the hosting, database and file storage providers the site runs on. They hold the data for us; they don't use it themselves.
• A company that draws pictures for us, and only if you ask us to draw a monogram for your envelope. What reaches them is the initials and any words you type into that one box, and nothing else. Nothing about your guests is ever sent anywhere to be drawn, and you never have to use it: typing your initials sets them in a typeface here, on your own device.
• The company that takes card payments, and only if you pay for a plan. You pay on their checkout, so your card details go to them and never reach us. What we see is that a payment was made, how much it was, and the name and email address you gave at the checkout, which we use only to match the payment to your celebration.

We'd only ever hand anything over to anyone else if the law required it.

Where it lives

In a database hosted in the UK or EU, reached over an encrypted connection. Access is locked down per account: the database itself enforces that you can only ever read or write celebrations you're on the team of.

Pictures are kept separately from the database, as files: the artwork you upload, the invitation image we make for each guest with their own name on it, and any monogram you have us draw for your envelope. Those are stored in Europe, and the only way to reach one is through this site.

The envelope your guests open is the one exception, and it is a deliberate one. It is a short video with no guest's name in it, and every guest plays it every time they open their invitation, so it is served straight from the network that stores it rather than through this site. That means anyone holding its address can watch it. The address is a long random one that cannot be guessed or found by looking, and it is never shown to anyone who has not been sent the invitation it belongs to. If your initials are on the wax seal, they are in that video.

We also take our own copies of the database, so that a mistake at our end can't lose your guest list two weeks before the day. A copy is a single file, kept in Europe alongside everything else, and only the people who run Our Guest List can reach one. We never read one for anything except putting lost information back. We delete every copy 30 days after it was taken, and that deletion happens on its own rather than because somebody remembered.

One consequence worth being straight about, because it affects deletion: something you delete today can still sit inside a copy taken before you deleted it. It goes when that copy does, so delete a guest and the last trace of them is gone within 30 days. Closing an account takes longer, because we deliberately keep everything for 30 days first (below), so a copy taken just before that period ends can hold it for about 60 days in total. We never go back into a copy to use what's in it.

What guests write

A dietary requirement can say something about someone's health or religion, so we treat those notes as sensitive: they're only ever shown to the host team, and we'd suggest guests keep them to what the kitchen actually needs to know.

The same goes for the message a guest can leave when they can't come. It's entirely optional, a decline is recorded whether or not anything is written, and it goes to the host team and nobody else. We don't read it, reply to it, or use it for anything but showing it to them.

Cookies

Two, both strictly necessary, no analytics, no advertising, no third-party trackers anywhere on the site:

• One that keeps you signed in.
• One that remembers which celebration you were last working on, if you help with more than one.

The set-up wizard creates your account on its first step, and from then on everything you enter in it is saved to that account as you type, exactly as it would be on your dashboard. Your browser's storage holds only which celebration the wizard was filling in, so you can pick up where you left off, and it's cleared when you finish.

How long we keep it

For as long as your account exists, because the guest list is the product. If your account sits unused for a couple of years, we'll get in touch before clearing it out.

Closing your account

You can close it yourself, from Account settings in your dashboard's account menu. You don't have to ask us. Because losing a guest list by accident is about the worst thing that could happen to you here, it works in two stages:

• For 30 days, nothing is deleted. Everything stays exactly as it was and keeps working, including the invite links your guests already have. Sign in any time in those 30 days and tap Keep my account and it's as if you never asked.
• After 30 days it's deleted for good, by an automatic job, your email address and password, and every celebration that was yours alone: its events, its guests, their phone numbers, replies, messages and dietary notes. Their invite links stop working, and so does your website here, along with everything you wrote on it. Any picture you uploaded is removed too, though that part can lag a little behind the rest. We can't undo any of it or get it back for you, so do download a copy of your guest list first.

One condition, because a celebration often isn't just yours: you can only close your account once you're the last person on each celebration you're on. While anyone else is still there, we won't let the account close. Somebody else's wedding shouldn't disappear, or change hands, because a planner closed an account. Your dashboard names the celebrations that are stopping it, so you can either ask those people to leave or leave yourself, handing the celebration to them. Then closing your account only ever deletes things that really are yours alone.

Thirty days feels too long? Email us and we'll delete it by hand, sooner.

Your rights

Under UK and EU data protection law you can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Two of those you can do yourself, without asking anyone: getting a copy, and deleting. For anything else, email us and we'll sort it out, normally within a few days, and within a month at the outside.

Download a copy of everything on your dashboard gives you the lot straight away: your celebration, your events, your guest list with every reply, message and dietary note, everyone on your planning team, and any invite picture you uploaded, as spreadsheets you can open anywhere. It covers the celebration you're working on, so if you help with more than one, switch between them and download each. Nothing is kept on a public link: it comes down over your own signed-in session, and only you can start it. It's also offered to you before you close your account, because after that we can't get it back.

If you're a guest rather than a host: the couple or organiser who invited you decides what goes on their guest list, so the quickest route is to ask them. You're very welcome to come to us instead and we'll pass it on.

If you think we've got something wrong, please tell us first, but you also have the right to complain to the UK's Information Commissioner's Office at ico.org.uk.

Changes

If we change anything meaningful here we'll update the date at the bottom of this page, and tell you by email if it actually affects you.

Getting in touch

We're the data controller for everything described here, which means we're the ones answerable for it. Our Guest List is a trading name of We Are Frames Ltd, registered in England and Wales, company number 17465783. Letters reach us at Suite RA01, 195-197 Wood Street, London E17 3NU.

Email [email protected] and a real person will read it.