Privacy Policy

1. Information we collect

We collect the following categories of personal information:

• Account information — name, email address, phone number, and password (via Supabase Auth), including Google account details if you sign in with Google.
• Wedding website content — wedding date, venue, story, schedule, photos, and any other content a Couple chooses to publish.
• Guest information — names, phone numbers, email addresses, RSVP status, meal choices, dietary requirements, seating preferences, the names of additional guests, and messages submitted through an RSVP form or entered by the Couple. Each guest also has a personal invitation code, which forms part of their RSVP link.
• Photos — images uploaded by Couples and, where a shared gallery is enabled, by their guests.
• Voice messages — short audio recordings (up to 60 seconds) that a guest chooses to record for the Couple on the wedding day, together with the name the guest types in. A recording is a voice, so it is personal information. Only the Couple can listen to it; it is not published on the website.
• Vendor information — business name, category, service area, pricing, portfolio images, and contact details submitted for a marketplace listing.
• Payment information — Couple payments are currently made by bank transfer (EFT). We keep the payment reference, amount, date, package and any proof of payment you send us. BloomWed does not collect or store card numbers.
• Chat messages — if you use “Talk to us”, we keep your name, email address, the page you were on and the messages you and our team exchange, so we can answer you.
• Usage data — pages viewed, enquiries sent, and similar technical information collected automatically.

2. How we use your information

We use personal information to:

• Create and manage accounts, and publish wedding websites and vendor listings;
• Process RSVPs and share relevant details with the Couple whose wedding the guest is responding to;
• Send WhatsApp and email notifications, such as RSVP confirmations and wedding updates;
• Process once-off Couple payments;
• Connect Couples with Vendors through marketplace enquiries;
• Maintain the security of the Service and prevent misuse;
• Comply with legal obligations and respond to lawful requests.

3. Legal basis for processing

We process personal information on the basis of: your consent (for example, when a guest submits an RSVP or opts into WhatsApp updates); performance of a contract (providing the Service you signed up for); and our legitimate interests in operating and improving BloomWed, balanced against your rights. Guests should note that a Couple, not BloomWed, decides what guest information is collected via their RSVP form and how it is used for their wedding.

4. Who we share information with

We share personal information only where necessary, with:

• Supabase — our database, authentication, and file storage provider, which hosts account data, wedding content, and gallery photos;
• Twilio — to deliver WhatsApp messages. Messages sent over WhatsApp are also subject to WhatsApp's own terms and privacy policy;
• Our email providers — to deliver account, sign-in verification, payment and notification emails;
• Google — if you choose to sign in with Google, and for aggregated analytics (see Cookies);
• Vercel — our hosting provider;
• The Couple whose wedding a guest RSVPs to, and a Vendor a Couple sends an enquiry to;
• Law enforcement or regulators, where required by law.

We do not sell personal information to third parties.

5. Public visibility

When a Couple publishes their wedding website, the content they choose to include (such as names, wedding date, story, and photos) becomes visible to anyone with the website link. Vendor marketplace listings are public and searchable by design. Guest RSVP responses and phone numbers are visible only to the Couple and are not published on the public wedding website. A guest's personal RSVP link is private to that guest: anyone who holds it can open that guest's RSVP page, where their email address and phone number appear only partly hidden. We ask that links are not shared.

6. Cross-border storage

Our service providers (including Supabase, Twilio, and Vercel) may store or process data on servers located outside South Africa. Where this occurs, we take reasonable steps to ensure your information receives a level of protection consistent with POPIA, including relying on providers with appropriate contractual and security safeguards.

7. Data retention

Public wedding websites are taken offline six months after the wedding date (see our Terms for how this works). After that, you can still sign in. We keep your account, guest list and uploaded photos for up to 12 months after your website goes offline, so you can still review or download them. We then delete or anonymise them unless you ask us to keep them or the law requires otherwise. You can ask us to delete your information earlier at any time. We keep payment records for as long as tax and other laws require. Chat conversations are deleted 12 months after they are closed.

Voice messages are kept for a shorter time than the rest: they are deleted automatically when the public wedding website goes offline, six months after the wedding date. A Couple can delete any voice message earlier from their dashboard at any time, or ask us to delete them by emailing us, and we will do so.

8. Security

We use reasonable technical and organisational measures to protect personal information, including access controls and row-level security on our database, encrypted connections, and restricted use of administrative credentials. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your rights

Under POPIA, you have the right to:

• Request access to the personal information we hold about you;
• Request correction or deletion of inaccurate or outdated information;
• Object to the processing of your personal information in certain circumstances;
• Withdraw consent (for example, to WhatsApp notifications) at any time;
• Lodge a complaint with the Information Regulator of South Africa.

To exercise these rights, contact us at hello@bloomwed.co.za. If your query concerns guest information on a specific wedding website, we may direct you to contact the Couple directly, as they control that content.

10. Children's information

BloomWed is not directed at children, and accounts may only be created by users 18 years or older. We do not knowingly collect personal information from children, other than a guest's name that a Couple or parent may include in their own guest list.

11. Cookies

We use essential cookies to keep you logged in and to remember basic preferences. If you arrive through a vendor's personal BloomWed link, we also keep a small cookie for 60 days that remembers which vendor recommended us, so that we can tell them when a couple signs up through their link. We also use Google Analytics to understand aggregated page views and how visitors move through the Service (for example, which marketing pages are visited). This uses cookies and similar identifiers provided by Google. We do not use the data for advertising, and we take care not to send guests' personal invitation codes to Google Analytics. You can opt out of Google Analytics with the Google Analytics opt-out browser add-on.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified via the Service or by email. The "Last updated" date at the top of this page reflects the most recent revision.

13. Contact and Information Officer

For any questions, requests, or complaints about this Privacy Policy or how your personal information is handled, contact us at hello@bloomwed.co.za. You may also lodge a complaint with the Information Regulator of South Africa at inforeg@justice.gov.za.