Privacy Policy
Last updated: 11 October 2026
1. Who we are
OurGuestbook (ourguestbook.co.uk) is a trading name of POLICYANDPLAY LTD, a company registered in England and Wales (company no. 17253846). Registered office: 7 Cosford Drive, Shortstown, Bedford MK42 0DQ, United Kingdom. ICO registration: ZC165321. Email: [email protected].
We are the data controller for the data of people who buy from us, sign in, join our mailing list or visit our site. For your wedding or event guests, the position is different. See section 5.
2. What we collect and why
| Data | Why we use it | Lawful basis | How long we keep it |
|---|---|---|---|
| Your email address, and the invitation details you enter (names, date, venue, story, wording, photos you upload) | To build, host and show your invitation, and to email you your sign-in link and receipt. | Contract | While your page is live, then up to 90 days after hosting ends (sooner if you ask). |
| Payment details: order amount, date, Stripe reference. Stripe collects your card details. We never see or store them. | To take payment, issue receipts and keep accounts. | Contract; legal obligation (tax records) | 6 years. |
| Sign-in data: email, sign-in session | To let you manage your invitation and guests. | Contract | While your invitation exists, then up to 30 days. |
| Wording you type into Grace, our writing assistant | To suggest wording for your invitation. | Contract (you asked for the feature) | Not stored by us beyond the draft you save. See section 4 for the AI providers. |
| Mailing list: email address and where you signed up | To send occasional inspiration and offers. | Consent | Until you unsubscribe. |
| Messages you send us | To reply to you and keep a record of the support we gave. | Legitimate interests (running the service) or contract | 2 years after the conversation ends. |
| Redeem details: Etsy code, invitation link, email | To activate the plan you bought on Etsy. | Contract | As for your invitation. |
| Technical logs: IP address, browser, pages requested | To keep the site secure and working, and to spot abuse. | Legitimate interests (security) | Up to 30 days. |
| Optional measurement (only if you accept cookies): Pinterest tag data, a random builder-session ID, A/B test variant, planner referral code | To measure our Pinterest ads and our sign-up funnel, test button wording and credit wedding planners. | Consent | See the Cookie Policy. |
Where we rely on legitimate interests we have weighed them against your rights. You can object at any time (see section 8).
3. Marketing emails
We email you about offers and ideas only if you joined the mailing list (consent) or, if you are a customer, about similar products (the soft opt-in). Every email has an unsubscribe link. Emails about your order, sign-in and invitation are service messages, not marketing, and you will still get them.
4. Who we share data with
We never sell personal data. We use these providers to run the service:
| Provider | What for | Where |
|---|---|---|
| Netlify | Website hosting and delivery | US (global network) |
| Supabase | Database, file storage (photos) and sign-in | Ireland (EU, eu-west-1) |
| Stripe | Card payments and fraud prevention. Stripe is an independent controller for its own compliance and fraud checks. | US / EU |
| Resend | Sending our emails (sign-in links, receipts) and, when a host asks us to, invitations to their guests | US |
| Anthropic and Google (Gemini) | AI behind Grace, the wording assistant. Only what you type into the assistant, plus the event type, is sent. We do not send your email address or payment details. Please do not type other people's sensitive details into the assistant. | US |
| Advertising measurement, only if you accept cookies | US | |
| Pixabay and OpenStreetMap | Background video and venue maps shown on pages. They see your IP address when these load. | EU / UK / US |
We may also share data where the law requires it, or with professional advisers (for example accountants and lawyers) under confidentiality.
5. Guests, and who is responsible for their data
When a couple or host builds an invitation, they decide what to ask their guests for and why. For guest names and emails they import, RSVPs (including dietary, transport and accommodation answers), guestbook messages and photos, the host is the data controller and POLICYANDPLAY LTD is their processor. We store and display that data only to run the host's page, on their instructions and under our Terms, and we do not use it for our own purposes.
If you are a guest and want to see, correct or remove what you submitted (for example a photo, a message or your RSVP), please ask the host first. If you would rather ask us, email [email protected] with the invitation link and what you want removed. We will pass the request to the host or, where it is a clear case such as removing your own photo or message, action it ourselves. Hosts are responsible for telling their guests what they do with the data and for not asking for more than they need. Do not ask guests for special-category data (such as health details) beyond what an event genuinely needs; dietary answers can reveal health or religious belief.
When a host asks us to email an invitation, the guest receives it from OurGuestbook on the host's behalf. We keep the guest's email only to send that invitation and show the host their response.
6. International transfers
Some providers are in the US. We rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or the ICO's International Data Transfer Agreement or the Addendum to the EU Standard Contractual Clauses. Data held in Ireland is covered by the UK's adequacy arrangements for the EU.
7. How long we keep data
- Invitations, guest data, photos and guestbook entries: while hosting is live, then deleted up to 90 days after it ends, or sooner on request. Download your keepsake PDF before then.
- Orders and invoices: 6 years, for tax.
- Mailing list: until you unsubscribe.
- Server logs: up to 30 days.
- Cookie choice: up to 12 months.
8. Your rights
Under UK GDPR you have the right to:
- be told how your data is used (this policy);
- get a copy of your data (access);
- have wrong data corrected (rectification);
- have data erased in the cases the law allows (erasure);
- restrict how we use it;
- receive data you gave us in a portable format;
- object to processing based on legitimate interests, and to direct marketing at any time;
- withdraw consent at any time (this does not affect what happened before); and
- not be subject to a decision made only by automated means that has legal or similarly significant effects. We make no such decisions.
Email [email protected]with “Data request” in the subject. We reply within one month. We may ask you to prove who you are.
9. Complaints
If you're unhappy with how we've handled your data, email [email protected]with “Data protection complaint” in the subject. We'll acknowledge within 30 days and tell you the outcome. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.
10. Cookies
We use essential cookies and, only with your consent, a few optional ones. See the Cookie Policy, where you can change your choice at any time.
11. Children
OurGuestbook is not aimed at children under 13 and we do not knowingly collect their data. Hosts may include children as guests; the host is responsible for that data (section 5).
12. Changes
We will update this policy when what we do changes, and show the date at the top. For material changes we will email account holders.