Privacy Policy

This policy covers two different groups of people, and the difference matters:

• Customers — people who hold an account with us. For your data, we are the controller: we decide what to collect and why.
• Guests — people whose details a customer adds to an invitation. For their data we are only the processor; the customer decides. Guests should read section 16, which is written for them.

1. What we collect from customers

We do not buy personal data from anyone, and we do not build advertising profiles.

2. What we hold on behalf of customers

Guest names, phone numbers, email addresses, postal addresses, relationship notes, RSVP answers, dietary and accessibility requirements, photographs, gift and contribution records. We hold these on our customer's instructions. We do not use them for our own purposes.

3. How it is protected

• Everything travels over TLS and is encrypted at rest.
• Access is separated per customer at the database level, so one account cannot read another's data.

Section 12 lists what is in place today and what is still being built. We would rather be specific than reassuring.

4. Who else touches the data

Only the processors listed in section 11, each for a stated purpose and under contract. We keep that list current. We do not sell personal data to anyone, ever.

We will disclose data to a public authority only where we are legally required to, and where the law allows it we will tell the person affected.

5. Where it is stored

Primary storage is in Sydney, Australia (ap-southeast-2). We are an Indian business, but the database sits outside India, so we say so plainly rather than leaving you to guess.

India’s data protection framework permits transfer to any country the central government has not restricted, and Australia is not restricted. For anyone in the UK or EU, the transfer runs on the Standard Contractual Clauses in our provider’s data processing agreement. Some processors operate globally — section 11 says which.

6. How long it is kept

You can delete most of it sooner yourself. Where we cannot delete — a payment record we are required to keep — we keep only that record and remove the rest.

7. Children

Accounts are for adults. A guest list may include children, because weddings include children — we hold no more than the name and the details the customer entered, we do not profile them, and we never serve them advertising or behavioural tracking.

8. If something goes wrong

If a breach puts personal data at risk we will notify the relevant authority within 72 hours where required, and tell the people affected without undue delay, with what happened and what to do about it.

9. Complaints

Write to support@wedpage.in, or to our grievance officer — see section 14. You also have the right to complain to the Data Protection Board of India, or to your local supervisory authority.

10. Changes

Changes are published here with a new version number. Material changes are notified by email before they take effect.

11. Sub-processors

These are the only companies that process personal data for WedPage. Each is under contract and may use the data only to provide its service to us. This section is part of our data processing agreement, and we keep it current.

We update this list before a new sub-processor starts handling data. Customers on planner or business terms can ask to be notified in advance — write to support@wedpage.in.

12. Security

A wedding guest list is one of the more sensitive lists a family will ever assemble: full names, phone numbers, home addresses, allergies, and photographs of children. We treat it that way.

What is in place today

• Encrypted in transit and at rest — TLS on every connection, AES-256 on stored data.
• Separated per customer — enforced by the database itself with row-level security, not only in application code, so one account cannot read another's data.
• Passwords are never stored — only an irreversible hash, handled by our authentication provider.
• Payment details never reach us — cards are handled entirely by Razorpay.

What we are still building

We would rather tell you this than let the list above imply more than it says. These are committed and in progress, and this section is updated as each one lands:

• Application-layer encryption of guest names, phone numbers, addresses and dietary notes, with keys held outside the database.
• Guest details masked from our own staff by default, with any reveal recorded.
• Automatic removal of location data from uploaded photographs.
• Hardware security keys for staff, and an authenticated gateway in front of administrative systems.

Availability

Data is backed up by our hosting provider, and restores are tested rather than assumed.

Reporting a vulnerability

If you have found a security problem, please tell us at support@wedpage.in before disclosing it anywhere else.

• We acknowledge within 2 working days and keep you updated.
• We will not pursue legal action for good-faith research that does not access other people's data, degrade the service, or extract more than is needed to prove the issue.
• With your permission, we credit reporters here.

Please do not test with real guest data, run automated scanners against production, or attempt denial of service.

13. Your rights, and how to use them

How to ask

Email support@wedpage.in from the address on your account, saying which right you are exercising. We may ask one question to confirm it is you — we will never ask for a password.

We reply within 30 days. If a request is unusually complex we will tell you inside that window and say how much longer it will take. There is no charge.

If you are a wedding guest, not a customer

Your details belong to the couple's guest list, so ask the couple first — they can act at once. If you would rather not, or you get no reply, write to us and we will make sure it is handled. See section 16.

What we cannot delete

Payment and tax records, which Indian law requires us to keep for eight years. We delete everything else and keep only that record.

14. Grievance redressal

If something has gone wrong and the usual support route has not fixed it, this is the escalation.

India’s Digital Personal Data Protection framework is being brought into force in stages, so which parts of it bind us changes over time. Rather than track that in a policy page, we publish a named officer and a timeline now, and hold ourselves to them regardless of what is in force on any given day. If the law later requires more, we will do more.

What to include

• Your name and the email address on the account.
• What happened, and when.
• What you have already tried, and any ticket or payment reference.
• What outcome you want.

What happens

1. Within 2 working days — we acknowledge, with a reference number.
2. Within 15 days — we investigate and give you a decision in writing, with the reasoning.
3. If we need longer, we tell you inside those 15 days and say why.

If you are still not satisfied

You can complain to the Data Protection Board of India for data-protection matters, or to the appropriate consumer forum for a commercial dispute. For payment disputes, Razorpay and your bank both have their own complaint routes.

15. Cookies

Short, because there is not much to it. WedPage does not run advertising and does not embed third-party trackers on customer-facing pages.

Every cookie in that table is strictly necessary — it keeps you signed in or keeps the site secure. We set no analytics, advertising or tracking cookies at all, which is why you have not been shown a consent banner: there is nothing optional to consent to. If that changes, this section changes first and we will ask before setting anything.

You can block or delete cookies in your browser settings. Blocking the essential ones will sign you out and stop the dashboard working.

16. If you are a wedding guest

You have probably arrived here from a wedding invitation. Everything above is addressed to our customers — the couple. This part is addressed to you, in plain terms, and it is the only part you need.

What is held about you

• Whatever the couple entered — usually your name, and a phone number or email so the invitation could reach you.
• Your reply: whether you are coming, to which ceremonies, and how many people with you.
• Anything you chose to add — a dietary requirement, an allergy, an accessibility need, a message on the wish wall, a photograph you uploaded.
• Basic technical information when you open the invitation, so it loads and stays secure.

Dietary, allergy and accessibility notes

These can say something about your health or your religion, so they get extra care. They are shown only to the couple and the people they have given access to. You never have to fill them in. Leave the field blank and nothing is lost but the caterer's convenience.

Photographs

A photograph you upload is visible to the couple and to whoever they share the album with.

Photographs often carry hidden location information from the camera that took them. We do not currently remove it, so if that matters to you, turn off location tagging in your camera before you take the picture, or ask the couple not to publish the photograph.

Who can see your details

The couple, family members and planners they have given access to, and the companies that store the data and deliver the messages — listed in full under sub-processors. Nobody else.

How long

Until twelve months after the wedding, then it is deleted automatically. The couple can delete it sooner, and you can ask them to.

What you can ask for

You can ask to see what is held about you, correct it, or have it deleted.

1. Ask the couple first. It is their guest list, and they can act immediately.
2. If you would rather not, or you get no reply, write to support@wedpage.in. We will pass it to them, make sure it is acted on, and confirm back to you. We answer within 30 days.

You can also complain to the Data Protection Board of India, or to your local privacy regulator.

Children

If a child is on the guest list, we hold only the name and details the couple entered. We never profile children and never show them advertising.

Who to contact

support@wedpage.in  ·  +91 81056 56565  ·  Grievance redressal