Skip to content

Legal

Data processing agreement

Last updated: 3 October 2026

The short version

When you create a wedding site on Our Weddings, you decide what to ask your guests and why: who gets invited, what the RSVP form collects, whether photos, videos and a quiz are allowed. Because you make those decisions, you are the data controller for your guests' data, and we are your processor — we only hold and handle that data to run the site for you.

There are exceptions, where we are a separate controller in our own right: your own account, billing if you buy a paid plan, support requests (anyone's, including your guests'), the security logs we keep to protect the service, how we handle reports of unlawful content, and the automatic screening of uploads for explicit content (described below). Those are covered by our Privacy Policy, not by this agreement.

This page is that processor agreement, as required by Article 28 of the GDPR. It is between you (the controller) and Ruben Cipriano, Rua Doutor Mário Sacramento, 18, 2695-747 São João da Talha, Portugal (the processor).

What we process for you

Subject matter: running your wedding site. Duration: for as long as your site exists. Nature and purpose: storing, displaying and emailing the content your site collects, and keeping it safe and backed up. Data subjects: your guests, anyone who appears in what they upload or in what you publish, and the people you add as site admins or as notification recipients. Categories of data: guest names, RSVP answers, party sizes, dietary notes and messages; photos and videos with their captions and original file names; quiz answers, scores and the players' names and profile pictures; reports guests file about photos; the email addresses that receive your site's notifications; and technical data such as IP address, browser and a random device id, used for security and abuse prevention.

Please do not use the site to collect special-category data (health, religion, and similar). A dietary note can reveal it, so keep that question narrow, tell your guests what you need it for, or switch it off — when it is off, nothing is stored for it.

Automatic screening of uploads. As part of hosting your site, every image your guests upload, and sampled frames of uploaded videos, is analysed automatically for explicit content, by software that runs on our own servers. The result is a score between 0 and 1 and an outcome (clear, held for review, blocked), kept with the file's record and deleted with it; it does not identify anyone and is not used to profile anyone. We do this to keep the service safe and to enforce our Terms of Service by preventing the publication of explicit or unlawful content, so it applies to every site and a couple cannot switch it off. Where we decide that purpose we do so as an independent controller, on the basis of our legitimate interest (Art. 6(1)(f) GDPR); where it serves your site, it is also covered by your instruction to host the site safely. No image, frame or score leaves our servers.

Nothing is decided by the software alone. An image it flags is withheld from your guests until a person has reviewed it: you, in your site's Photos tab, or us as the platform operator. Either of us can restore it or delete it. The guest who uploaded it is told only that it cannot be published, and can write to us to contest that.

Our instructions come from you

We process guest data only on your documented instructions. Your instructions are the settings you choose in the admin area, the features you switch on, and any written request you send us. If we are ever required by law to process the data some other way, we will tell you first unless the law forbids it. If we think an instruction breaks data-protection law, we will say so.

Who can access it, and confidentiality

You and the people you add as site admins can see your site's data. On our side, the operator is the only person with administrator access to the platform; that access technically reaches every site, and we use it only to run, support and secure the service, when you ask us to help with your site, or when the law requires it. Everyone who can access guest data is bound by a duty of confidentiality.

Security measures

Under Article 32 we keep appropriate technical and organisational measures in place. Concretely, today that means:

  • All traffic is encrypted in transit over HTTPS/TLS.
  • Sign-in is OAuth-only, with an HttpOnly session cookie; there are no passwords for us to lose.
  • Role-based access control — site owners and the admins they add can only reach their own site's data.
  • Every upload is scanned for malware, by the application and again by the storage it is written to, and refused if infected.
  • Location and other metadata (EXIF, GPS) are removed from photos and videos when they are uploaded; an upload is refused if that fails.
  • Uploaded images, and sampled frames of videos, are screened automatically for explicit content on our own servers; a flagged image is withheld from guests until a person has reviewed it.
  • Rate limits on public actions, and a spam check on public forms — our own, self-hosted, with hCaptcha only as a fallback.
  • Audit logging of administrative and security-relevant actions, retained for 180 days.
  • The service runs on two servers in the EU: the main one in France, and one in Germany holding a live read-only copy of the database, which can serve your site read-only if the main server fails.
  • Photos and videos are stored in a private bucket at Backblaze B2 in the EU (Amsterdam, Netherlands), sent over an encrypted connection; we do not encrypt them ourselves before upload.
  • Off-site backups in the EU (Netherlands). Server snapshots are encrypted before they leave our servers; database backups are sent over an encrypted connection but are not yet encrypted by us before upload. Restoring the database from backup is tested every month.

We review these as the product changes. We do not currently hold an external security certification, and we do not claim one.

Sub-processors

You give us general authorisation to use the sub-processors below. If we add or replace one, we will post the change on this page and email site owners at least 30 days beforehand, so you have time to object. If you object on reasonable data-protection grounds and we cannot offer an alternative, you may close your site and we will delete the data.

  • Server4You — HEG US Inc., St. Louis, USA

    Our main server: runs the website and the database, and checks and resizes uploads (malware scan) before they go to their store.

    Data:
    The service's data: accounts, wedding sites, RSVPs, support requests, the emails you send us, billing records and logs; photos and videos only as working copies while they are checked and resized.
    Where:
    Strasbourg, France (EU)
    Transfer safeguard:
    Stored in the EU (Strasbourg), on a server only we administer, under a GDPR processor agreement (Art. 28) signed on 28 September 2026. HEG US Inc. is a US company that is not certified under the EU-US Data Privacy Framework; the GoDaddy group company that runs its platform, GoDaddy Operating Company LLC, is certified. We have asked HEG US Inc. for the EU Standard Contractual Clauses.

  • ZAP-Hosting — ZAP-Hosting GmbH, Münster, Germany

    Our second server: helps carry traffic to the site, keeps a live read-only copy of the database, and serves a read-only copy of the site while the main server is down.

    Data:
    A full copy of the database, requests passing through (including IP addresses), and short-lived copies of photos while the read-only copy is in use.
    Where:
    Germany (EU)

  • Backblaze B2 — Backblaze, Inc. (USA)

    The primary store for photos and videos, and off-site backups.

    Data:
    Photos and videos uploaded to wedding sites (the store itself), and backups of the database and of our servers' data.
    Where:
    EU region (Amsterdam, Netherlands)
    Transfer safeguard:
    Stored in the EU. Backblaze is a US company, certified under the EU-US Data Privacy Framework.

  • Cloudflare — Cloudflare, Inc. (USA)

    Sits in front of the site: DNS, the encrypted connection, protection against attacks and bots, and caching of pages and photos.

    Data:
    Every request to the site, including IP address, browser details and what is sent or uploaded; cached copies of photos.
    Where:
    Global network; Cloudflare is based in the USA
    Transfer safeguard:
    EU-US Data Privacy Framework (Cloudflare is certified) and Standard Contractual Clauses.

  • Brevo — Sendinblue SAS, Paris, France

    Delivers the emails the service sends.

    Data:
    The recipient's email address and the content of the email — for example the RSVP summary sent to the couple (each guest's name, answer, party size, message and any dietary note), a receipt, or a reply to a support request.
    Where:
    France (EU)

  • hCaptcha — Intuition Machines, Inc. (USA)

    Back-up spam check on public forms (RSVP, support requests), used only when our own spam check cannot load.

    Data:
    IP address, browser details and how the check was completed.
    Where:
    USA
    Transfer safeguard:
    EU-US Data Privacy Framework (certified) and Standard Contractual Clauses.

Each sub-processor is bound by data-protection terms no less protective than these. Where a provider processes data outside the EEA, the transfer safeguard is shown with it. Our own spam check, malware scanning, explicit-content screening, logs and statistics run on the servers above, so no sub-processor is involved in them (none for the screening of uploads: no image or score is sent to anyone); photos and videos are stored with Backblaze, listed above.

Not sub-processors, but worth telling your guests: if you add a map to your site, your guests' browsers load it directly from the OpenStreetMap Foundation, which receives their IP address; and people who sign in do so through the provider they choose (Google, Facebook or Microsoft).

Helping with guest requests

If a guest asks you for access, correction, deletion or a copy of their data, or objects to how it is used, most of it you can do yourself in the admin area — view RSVPs, remove photos, delete a guest's entries. Where the tools do not cover it, email [email protected] and we will help you answer within 2 business days. If a guest contacts us directly about your site, we will not answer for you — we will pass the request on to you.

Breaches, DPIAs, and prior consultation

If we become aware of a personal-data breach affecting your site, we will tell you without undue delay and within 72 hours of becoming aware, with what we know: what happened, who is likely affected, the likely consequences, and what we are doing about it. You are the one who decides whether to notify the supervisory authority or your guests, since you are the controller. We will also give you the information you reasonably need for a data-protection impact assessment or a prior consultation under Articles 35 and 36.

Deletion and return

You can download every photo and video on your wedding as one archive, as stored on your plan, from plans and billing or from the Photos tab of your wedding's admin. Your RSVPs are in the admin too; if you want a copy of them as a file, ask us and we will send it. When you delete your site or close your account, we delete the guest data we hold for you: RSVPs, photos and videos, quiz entries, notifications, and the records of the notices your guests were shown.

On the free plan, the photos and videos your guests upload are deleted 7 days after the plan's upload window closes (48 hours around the wedding date). We email you 3 days and 1 day before, so you can download them first. Your site and your RSVPs stay.

Some copies take longer to disappear: database backups age out after up to about 21 days; a deleted photo or video disappears from the site and the network provider's cache at once, but its copy in storage is held for 30 days by a retention lock and erased when it expires, so erasure is complete within 30 days; server snapshots are kept for up to 12 months, and security-log entries for up to 180 days. Two kinds of record are not deleted with your site. Reports guests filed about photos on your site are currently kept, as our record of how reported content was handled. Support requests that mention your wedding are detached from it rather than deleted, because each belongs to the person who sent it (often a guest): they are kept like any other support request, until 365 days after the last message of a closed request, or sooner if the sender deletes their account. Apart from these, we keep nothing, unless the law requires us to.

Showing our work

We will give you the information you need to show you meet Article 28 — that is this page, our security measures, and the sub-processor list above, kept current. If you need more for an audit or inspection, write to [email protected] and we will answer in writing, or arrange an audit at a reasonable time and frequency, at your cost, with 30 days' notice. We do not have an independent audit report to hand you today.

Accepting this agreement

This agreement forms part of our Terms of Service, which you accept when you sign in, and it applies to every wedding site you create for as long as that site exists. If we change it, we will update the date at the top and email site owners. Questions go to [email protected], or by post to Ruben Cipriano, Rua Doutor Mário Sacramento, 18, 2695-747 São João da Talha, Portugal.

← Back home·Privacy Policy·Terms of Service