Privacy Policy

1. Information we collect

We collect the following categories of personal information:

• Account information — name, email address, phone number, and password (via Supabase Auth), including Google account details if you sign in with Google.
• Wedding website content — wedding date, venue, story, schedule, photos, and any other content a Couple chooses to publish.
• Guest information — names, phone numbers, RSVP status, dietary requirements, seating preferences, and messages submitted by wedding guests through an RSVP form.
• Photos — images uploaded by Couples and, where a shared gallery is enabled, by their guests.
• Vendor information — business name, category, service area, pricing, portfolio images, and contact details submitted for a marketplace listing.
• Payment information — Couple payments are currently made by direct bank transfer (EFT); BloomWed does not collect or store card numbers.
• Usage data — pages viewed, enquiries sent, and similar technical information collected automatically.

2. How we use your information

We use personal information to:

• Create and manage accounts, and publish wedding websites and vendor listings;
• Process RSVPs and share relevant details with the Couple whose wedding the guest is responding to;
• Send WhatsApp and email notifications, such as RSVP confirmations and wedding updates;
• Process once-off Couple payments;
• Connect Couples with Vendors through marketplace enquiries;
• Maintain the security of the Service and prevent misuse;
• Comply with legal obligations and respond to lawful requests.

3. Legal basis for processing

We process personal information on the basis of: your consent (for example, when a guest submits an RSVP or opts into WhatsApp updates); performance of a contract (providing the Service you signed up for); and our legitimate interests in operating and improving BloomWed, balanced against your rights. Guests should note that a Couple, not BloomWed, decides what guest information is collected via their RSVP form and how it is used for their wedding.

4. Who we share information with

We share personal information only where necessary, with:

• Supabase — our database, authentication, and file storage provider, which hosts account data, wedding content, and gallery photos;
• Twilio — to deliver WhatsApp and email notifications;
• Vercel — our hosting provider;
• The Couple whose wedding a guest RSVPs to, and a Vendor a Couple sends an enquiry to;
• Law enforcement or regulators, where required by law.

We do not sell personal information to third parties.

5. Public visibility

When a Couple publishes their wedding website, the content they choose to include (such as names, wedding date, story, and photos) becomes visible to anyone with the website link. Vendor marketplace listings are public and searchable by design. Guest RSVP responses and phone numbers are visible only to the Couple and are not published on the public wedding website.

6. Cross-border storage

Our service providers (including Supabase, Twilio, and Vercel) may store or process data on servers located outside South Africa. Where this occurs, we take reasonable steps to ensure your information receives a level of protection consistent with POPIA, including relying on providers with appropriate contractual and security safeguards.

7. Data retention

We retain personal information for as long as your account is active or as needed to provide the Service. If you close your account or a wedding website is taken down, we may retain certain records (such as payment history) for as long as required by tax or other legal obligations, after which the information is deleted or anonymised.

8. Security

We use reasonable technical and organisational measures to protect personal information, including access controls and row-level security on our database, encrypted connections, and restricted use of administrative credentials. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your rights

Under POPIA, you have the right to:

• Request access to the personal information we hold about you;
• Request correction or deletion of inaccurate or outdated information;
• Object to the processing of your personal information in certain circumstances;
• Withdraw consent (for example, to WhatsApp notifications) at any time;
• Lodge a complaint with the Information Regulator of South Africa.

To exercise these rights, contact us at hello@bloomwed.co.za. If your query concerns guest information on a specific wedding website, we may direct you to contact the Couple directly, as they control that content.

10. Children's information

BloomWed is not directed at children, and accounts may only be created by users 18 years or older. We do not knowingly collect personal information from children, other than a guest's name that a Couple or parent may include in their own guest list.

11. Cookies

We use essential cookies to keep you logged in and to remember basic preferences. We also use Google Analytics to understand aggregated page views and how visitors move through the Service (for example, which marketing pages are visited). This uses cookies and similar identifiers provided by Google. We do not use the data for advertising. You can opt out of Google Analytics with the Google Analytics opt-out browser add-on.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified via the Service or by email. The "Last updated" date at the top of this page reflects the most recent revision.

13. Contact and Information Officer

For any questions, requests, or complaints about this Privacy Policy or how your personal information is handled, contact us at hello@bloomwed.co.za. You may also lodge a complaint with the Information Regulator of South Africa at inforeg@justice.gov.za.