Privacy Policy

Last updated: 24 August 2026

Who We Are

Wedding List Manager is a wedding planning platform operated from the United Kingdom. We provide tools to help couples plan their weddings, manage guest lists, and discover vendors.

For privacy-related queries, you can contact us at privacy@weddinglistmanager.co.uk.

Information We Collect

Account information: When you register, we collect your name, email address, and password. Your password is stored securely using one-way hashing and is never stored in plain text.

Wedding details: If you are planning a wedding, we collect information such as partner names, wedding date, venue, and location. This information is used to provide the service and help you plan your event.

Guest information: We store guest data that you provide, including names, email addresses, RSVP status, dietary requirements, allergies, and meal choices. You are responsible for ensuring you have permission to share your guests' personal data with us.

Photos: Images uploaded by couples and guests to wedding albums are stored on our servers. You retain ownership of any photos you upload. Uploads are checked by our safeguarding team before they appear to others — see Photo moderation and safeguarding below for exactly what our staff can and cannot see.

Vendor information: If you have a vendor account, we collect your business name, contact details, service descriptions, and gallery images to display your listing on the platform.

Payment information: Payments are processed by Stripe. We do not store your card numbers or bank details. Stripe's own privacy policy applies to payment data they process on our behalf.

Technical data: We automatically collect certain technical information when you use the platform, including IP addresses, browser type, and session cookies. This data is used to maintain security and improve the service.

How We Use Your Information

We use your information to:

• Provide and operate the Wedding List Manager service
• Process payments for vendor token purchases
• Communicate with you about your account and service updates
• Improve the platform and develop new features
• Prevent fraud and maintain security

Our legal bases for processing your data under UK GDPR are:

• Performance of contract: Processing necessary to provide the service you have signed up for
• Legitimate interest: Improving the platform, preventing fraud, and maintaining security
• Consent: Marketing communications, which you can opt out of at any time

Vendor Offers (Optional)

If you explicitly opt in, wedding vendors on our platform can send you offers and updates relevant to your wedding — for example, matched to your wedding location or date. These messages are always sent by Wedding List Manager on the vendor's behalf: vendors never receive your name, email address, or any other personal data. Vendors only see the approximate size of the audience their campaign will reach.

This is entirely optional and off by default. You can opt in during onboarding or from your notification preferences, and you can opt out at any time from the same page or via the unsubscribe link in any offer email. Opting out removes you from all vendor campaign audiences immediately. Our lawful basis for this processing is your consent.

How We Measure Our Emails

The automated planning emails we send you contain a small, invisible image and links that pass through our own site before continuing to their destination. This tells us whether an email was opened and which link inside it was followed, so we can tell which advice is genuinely useful and stop sending the rest. We record the fact of the open or click, when it happened, and which link it was — nothing about what you do afterwards, and never your location or device profile.

Separately, we keep a record of the emails we have sent you — the date, the address it went to, and the subject line, never the message itself. It is what lets our support team answer “did you ever send me that?” honestly, and it is deleted after two years.

This measurement is only used to improve our own emails: it is never shared with vendors, and it never feeds vendor targeting. Turning off automated planning emails on your notification preferences page stops both the emails and the measurement. Our lawful basis is legitimate interest in understanding whether our own service communications are helpful.

How We Measure Our Blog

When you read an article on our blog we record that it was read, when, and roughly how you got there — whether you arrived from a search engine, a social network, another website, or by typing the address in. Where a link brought you to us we keep only the name of the site it came from, never the full address of the page, because a search or a private page can say more about you than the site itself does. We also record which links inside the article people follow.

We record an approximate location — usually the country and, where our network provider can tell us, the nearest town. This is worked out and given to us by our network provider from the connection itself; we do not look up, receive or store your IP address to produce it, and it is approximate enough that it often points at a city some distance from where you actually are.

We do not store your IP address or your browser's identifying details against an article you have read. To avoid counting the same person twice we use a scrambled code derived from your connection, which cannot be turned back into you and which we do not use to follow you around the internet.

If you are signed in when you read an article, that read is recorded against your account. It helps us see which advice the couples actually using the platform find worth reading. This is never shared with vendors and never feeds vendor targeting: a vendor bidding to appear on an article is told how many people read it and roughly where they were, never who they were. Blog measurement is deleted after two years, and our lawful basis is our legitimate interest in knowing which of our own articles are worth writing.

Photo Moderation and Safeguarding

Wedding albums often contain children, family, and private moments, so photos uploaded to them are reviewed by our safeguarding team before they become visible to other people. We want to be straightforward about what that means in practice.

What our staff can see. Reviewers see a small thumbnail of a photo, never the full-resolution original, and only while there is an open reason to look at it: the photo is waiting to be reviewed, or somebody has reported it. Once a photo has been approved and nobody has reported it, our staff lose access to it automatically. There is no way for our staff to browse through a wedding's finished albums.

Every look is recorded. Each time a member of staff views, approves, or removes a photo, we record who did it, when, and — for removals — why. Those records cannot be edited or deleted by anyone, including us, and are kept for three years so that we can answer questions about how a photo was handled.

Reporting a photo. Anyone who can see a photo can report it, including guests using an invitation link who do not have an account. Reports are confidential: we do not tell the couple or the person who uploaded the photo who reported it. If you appear in a photo you did not agree to have shared, reporting it is the fastest way to reach us, and you can also email privacy@weddinglistmanager.co.uk.

What we never do with your photos. We do not use them for marketing, we do not share them with vendors, we do not use them to train artificial intelligence, and we do not download or keep copies outside the album they were uploaded to.

Our lawful basis for this processing is legitimate interests — keeping people using the platform, and children in particular, safe from illegal or harmful material, and meeting our obligations under UK law. We have weighed this against your privacy, which is why access is limited to thumbnails, limited to photos with an open reason for review, and logged.

Third-Party Services

We use the following third-party services:

• Stripe — for payment processing. Stripe processes payment data under their own privacy policy.
• Cloudflare — for security and performance. Cloudflare may process certain technical data as part of delivering our service.
• Google Analytics — for usage measurement, and only if you accept analytics cookies. Google acts as our processor and may process the data outside the UK under the UK extension to the EU–US Data Privacy Framework and standard contractual clauses.

We do not sell your personal data to third parties. Vendors pay us to send messages to couples who match what they are looking for, but we send those messages — vendors never receive your name, email address, or browsing data. A vendor only learns who you are if you contact them, reply to them, or book them. See our cookie policy for more detail.

Cookies

We use essential cookies for authentication and CSRF protection. These cookies are necessary for the platform to function and cannot be disabled. Our cookie policy lists every cookie we set and why.

We also use optional analytics cookies, which stay switched off unless you accept them. If you accept, Google Analytics measures how people move through the site — which pages are used, in what order, and where people drop out of a flow — including pages inside your account once you are signed in. We do not send Google your name, email address, or any wedding, guest, or vendor detail, and we never use analytics for advertising or to target you with vendor offers. Our lawful basis is your consent, which you can withdraw at any time from the “Cookie settings” link in the footer of any page.

Where you are signed in and have accepted analytics, we also send a code that stands for your account, so visits from your phone and your laptop are counted as one person rather than two. It is a one-way hash unique to this site, not your name, email address, or the ID we hold internally, and Google cannot identify you from it. Our cookie policy explains this in full.

We do not use advertising cookies and we do not build advertising profiles from your browsing.

Data Retention

Your account data is retained for as long as your account remains active. If you delete your account, your personal data will be removed within 30 days.

Guest data is retained for as long as the wedding it belongs to exists on the platform. When a wedding is deleted by its owner, associated guest data is also removed.

Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can ask us to correct any inaccurate personal data.
• Right to erasure: You can ask us to delete your personal data.
• Right to restrict processing: You can ask us to limit how we use your data.
• Right to data portability: You can request your data in a structured, commonly used format.
• Right to object: You can object to processing of your personal data in certain circumstances.

To exercise any of these rights, contact us at privacy@weddinglistmanager.co.uk.

Children's Privacy

Our service is not directed at anyone under the age of 13. We do not knowingly collect personal data from children. If you believe we have collected data from a child under 13, please contact us and we will take steps to remove it.

Data Security

We take the security of your data seriously. Measures we use include:

• All connections to the platform are encrypted via HTTPS
• Passwords are stored using industry-standard one-way hashing
• Access controls are in place to limit data access to authorised personnel

No system is completely secure, and we cannot guarantee absolute security. However, we are committed to protecting your data using appropriate technical and organisational measures.

Changes to This Policy

We may update this privacy policy from time to time. Changes take effect when posted on this page. We encourage you to review this policy periodically to stay informed about how we protect your data.

Contact Us

For any privacy-related queries, please contact us at privacy@weddinglistmanager.co.uk.