Contents · 17 sections
Who we are
In short Build The Day runs buildtheday.com, the app and the wedding websites made with it. For your account we decide what happens to your data.
Build The Day ("we", "our", "us") is the data controller responsible for the personal data in your account. That covers the website buildtheday.com, the Build The Day web application at app.buildtheday.com and every wedding website we host, at a buildtheday address or on your own domain.
For the guests you add, you are the controller and we look after their details for you. Section 3 explains how that works, and section 7 covers wedding planners.
Our data protection lead answers every privacy question. Email [email protected]; section 17 has the details. If you have any concerns about how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
What we collect
In short What you type in, what your guests send back, what you buy, and, if you allow it, how you use buildtheday.com.
- Your account
- Your name, email address and password. The password is stored as a hash, never in plain text, so nobody can read it, us included. Your account preferences and settings. Planners also give a business name and address.
- Your wedding
- The date, venues, events and their descriptions, your story, the words and photos on your website, your budget, timeline and seating plan.
- Your guests
- What you and your guests add: names, email addresses and contact details, replies, plus-ones, meal choices, dietary requirements, answers to your questions, photos, guestbook messages and drawings. Section 3 covers this.
- Payments
- Your billing name and address, what you bought, your transaction history and any refund. Card numbers are processed and stored entirely by Stripe. We never see or store your full card number.
- Domains
- If you buy a domain through us, the registrant details the registry needs: name, address, email and phone number.
- Use of the site
- On buildtheday.com, and only if you say yes: pages visited, time on each page, referring addresses, browser, device and operating system, an anonymised IP address and a rough location by country or city.
- Messages
- Emails you exchange with our support team, and a record of each email we send for you: who to, when, and whether it was delivered.
- Safety
- Error reports and an audit log of sensitive actions such as wipes and refunds, so we can put things right and prove what happened.
We collect it through:
- Direct interactions. When you create an account, build your wedding website, add guests, make a purchase or contact us.
- Guest interactions. When your guests reply, sign your guestbook, upload photos or use your wedding website.
- Automated technologies. Cookies and analytics tools that collect technical data when you browse buildtheday.com, only with your consent for anything that is not essential.
- Third-party services. Payment confirmations from Stripe. We do not buy data about you from anyone.
Your guests' details
In short You add your guests and you decide what happens to their details. We hold them for you, keep them private and never contact your guests for ourselves.
When you add guests, or they reply on your website, you are the controller of their details and we process them for you. As the account holder you are responsible for having a lawful basis to share your guests' data with us, typically legitimate interest or consent. We only use it to run your wedding: to show your website, take replies, send the emails you choose to send, and draw your seating plan and lists.
Guests never need an account. They sign in to your website with a passcode, their name, or their name and a code we email them, depending on the setting you choose. Their replies go through our server, never straight into the database, and every sign in is rate limited.
Dietary and access needs can be health information. A guest chooses whether to tell you about an allergy or a wheelchair space. We only use it to show it to you and on the lists you print for your caterer and venue.
If you are a guest whose details were added by a couple or a wedding planner, you have the same rights as everyone else, set out in section 12. You can ask the couple directly, or email us at [email protected].
Why we use it
In short To run what you signed up for, to keep it safe and to keep the records the law asks for. Analytics only with your yes.
| What for | Lawful basis | What that means |
|---|---|---|
| Run your account, host your wedding website, take replies and manage your guest list, meals and seating | Contract | We need it to give you what you signed up for. |
| Take payments, give refunds and renew domains | Contract | Necessary to fulfil your purchase, including the yearly renewal of a domain bought through us. |
| Send transactional emails: confirmations, invitations, reminders and milestones | Contract | Necessary to deliver the service you asked for. For your guests, it rests on your basis as the couple. |
| Measure how buildtheday.com is used, with Google Analytics | Consent | Only after you choose to allow analytics in the cookie banner. You can change your mind. |
| Detect fraud and prevent abuse | Legitimate interests | Protecting the service and the people who use it: rate limits on guest sign in, error logs, the audit log. |
| Answer your support requests | Legitimate interests | So we can help when you write to us. |
| Keep tax and accounting records, and answer lawful requests | Legal obligation | Required by law, including HMRC. |
You can withdraw consent for analytics at any time from Cookie settings, by clearing your cookies or through your browser. Withdrawing consent does not affect the lawfulness of anything done before you withdrew it.
We use your data to create and maintain your account, host and serve your wedding website, process replies and manage your guest list, meal choices, seating and dietary requirements, store and serve photos, guestbook entries and other wedding content, process payments for add-ons, tiers and subscriptions, send transactional emails on your behalf, understand anonymous use of buildtheday.com (with consent), answer your support requests, detect and prevent fraud or abuse, and meet our legal obligations.
We never sell your personal data to anyone, use it for advertising or marketing profiling, share your guest list, wedding content or personal details with anyone for their own marketing, train anyone's models on your photos or words, or make automated decisions or profile you in ways that produce legal effects.
Who handles it
In short A few trusted companies help us run Build The Day. Each one only sees what it needs, under a data processing agreement with us, and none of them may use your data for their own purposes.
| Processor | Why | What it sees | Where |
|---|---|---|---|
| Supabase | Authentication and the database | Account data, weddings, guest lists, replies and purchase records | European Union, Frankfurt |
| DigitalOcean App Platform | Hosting for buildtheday.com, the app and every wedding website | All application data, as pages are served | United Kingdom |
| DigitalOcean Spaces | File storage and delivery | Cover photos, galleries, guest uploads, guestbook photos, drawings, music and exports | United Kingdom, London |
| Stripe | Payments, planner subscriptions and refunds | Billing name, address, payment details and transaction records | United States, with UK GDPR safeguards |
| Resend | Transactional email, to you and to your guests | Recipient email addresses, the email itself and delivery records | United States, with UK GDPR safeguards |
| Openprovider | Registers a domain you buy through us | Your registrant name, address, email and phone number | Netherlands |
| Google Tag Manager and Google Analytics | Anonymous use of buildtheday.com, only if you allow it | Anonymised IP address, pages visited, device information | United States, with UK GDPR safeguards |
Three more services are reached directly by a visitor's browser when a wedding website uses them. They are not our processors, so their own privacy policies apply.
| Service | Why | What it sees | Where |
|---|---|---|---|
| Google Fonts | The typefaces on wedding websites | A visitor's IP address when the fonts load | United States |
| OpenStreetMap, Nominatim and Overpass | Venue maps, address search, places to stay nearby | The address searched, a visitor's IP address | United Kingdom and European Union |
| what3words | Three word addresses for venues | The place looked up | United Kingdom |
We may also share data when the law requires it, or with a buyer if Build The Day is ever sold, in which case this policy goes with it and we will tell you first.
Outside the UK
In short Your files stay in the UK. Some services are in the EU or the US, and each transfer is covered by the safeguards UK law asks for.
Some of our processors are based outside the United Kingdom. Where your data is transferred outside the UK, we make sure appropriate safeguards are in place:
- Standard Contractual Clauses approved by the ICO, built into our agreements with US based processors (Stripe, Resend and Google).
- Adequacy decisions where they apply, for transfers to the EU. Supabase processes data in the EU (Frankfurt), covered by the UK and EU adequacy arrangement.
- DigitalOcean processes data within the United Kingdom.
You can ask for a copy of the safeguard that applies by emailing [email protected].
Wedding planners
In short If you plan weddings for clients, you are in charge of your clients' and their guests' data, and we process it for you.
If you use Build The Day as a wedding planner managing weddings for your clients, you are the data controller for the personal data of your clients and their guests, and Build The Day is your data processor. Our responsibilities are set out in a data processing agreement, which is available on request. Your team members and collaborators see only the weddings you add them to.
Cookies
In short A few small essential cookies keep you and your guests signed in and remember your choice. Analytics cookies only arrive if you allow them.
Google Tag Manager loads in Consent Mode v2 with every kind of storage denied, and analytics stays off until you choose to allow it. We have set Google Analytics up with IP anonymisation, advertising features switched off (no remarketing and no demographics reporting) and data sharing with Google for advertising turned off. The cookie policy lists every cookie, what it does and how long it lasts, and shows you how to change your choice.
How long we keep it
In short As long as you need it for your wedding, then you choose when it goes. Payment records stay longer, because the law says so.
| What | How long |
|---|---|
| Your account and wedding data | As long as your account is active, plus 30 days after you ask us to delete it. |
| Guests, replies, meal choices, dietary information and answers | As long as the wedding website exists, or until you wipe them after the day. |
| Guest photos, guestbook messages, drawings and other media | As long as the wedding website exists. A wipe deletes the files as well as the records. |
| Your cover, logo and page photos | Until you delete the wedding. A wipe leaves them, so your site can be reopened. |
| The wipe receipt | Numbers only, such as 82 guests, 64 said yes. Kept with the wedding so your day in review still works. No names. |
| Payment records | 7 years, as UK tax law requires. |
| Transactional email logs | 90 days. |
| Analytics data | 14 months, with anonymised IP addresses. |
| Support correspondence | 2 years after we last hear from you. |
After your wedding, your website can stay up as a keepsake for as long as your account is active and you choose to keep it open. You can ask us to delete your account and everything in it at any time.
After the day
In short The day after your wedding, you choose how long your website stays up. When you are ready, wipe your guests' details for good.
From the day after your wedding, the After the day page in your account asks how long your website should stay up: 3, 6, 12 or 24 months, or close it now. Here is how that runs for a wedding on 5 June 2027.
The wipe is a real delete. You type to confirm, and then your guests go, with their replies, meal choices and answers, guestbook messages, drawings, the gallery and the photo files themselves. Your cover, logo and page photos stay so the site can still be reopened. All that remains is a receipt with numbers and no names, so your day in review still reads "82 guests, 64 said yes".
Export anything you want to keep before you wipe. We cannot bring it back.
Keeping it safe
In short Encrypted in transit, locked down account by account, and card details never touch our servers.
We take appropriate technical and organisational measures to protect your personal data, including:
- Everything between your browser and our servers, every page and every upload, is encrypted with TLS (HTTPS).
- Passwords are hashed with industry standard algorithms and never stored in plain text. Sign in and sessions are handled by Supabase.
- Database access is restricted by role based access controls, and every table has row level security, so each account can only reach its own weddings.
- Guests never touch the database. Their replies go through server routes that check who they are first.
- Photos upload straight to storage on a signed link that expires. Our application is hosted on DigitalOcean within the United Kingdom.
- Payments are handled entirely by Stripe, certified to PCI DSS Level 1. We never store card details on our servers.
- Sensitive actions, such as wipes and refunds, are written to an audit log.
- Regular security updates and dependency monitoring.
If something goes wrong and it puts your data at risk, we will tell you and, where the law requires it, the Information Commissioner's Office within 72 hours.
Your rights
In short Your data, your call. Ask us for any of these, free, and we will reply within one month.
- See it
- The right of access: ask for a copy of the personal data we hold about you.
- Correct it
- The right to rectification: most of it you can change yourself in your account. For the rest, ask us.
- Delete it
- The right to erasure: ask us to delete your personal data, subject to the records the law makes us keep.
- Take it with you
- The right to data portability: your data in a structured, machine readable format.
- Limit it
- The right to restrict processing: ask us to hold your data but limit how we use it.
- Object to it
- The right to object to anything we do on the basis of legitimate interests.
- Change your mind
- The right to withdraw consent for analytics cookies at any time, from Cookie settings.
- A person, not a machine
- Rights about automated decisions: we do not carry out automated decision making or profiling.
To use any of these rights, email [email protected]. We may ask you to prove who you are first. We will respond within one month, as the law requires. If your request is complex we may extend this by a further two months, and we will let you know within the first month. There is no fee, unless a request is manifestly unfounded or excessive.
Children
In short Our services are for adults. Children can be on a guest list, and we treat their details with care.
Our services are not directed at children under 16, and you must be 16 or over to open an account. We do not knowingly collect personal information from children under 16 for an account; if we find we have, we delete it promptly. Couples often add children as guests or plus-ones: add only what you need, such as a name and a meal choice. If you believe a child has given us personal data, contact us at [email protected].
Other websites
In short Links to other sites follow those sites' own privacy rules.
Our website and wedding websites may link to other websites, such as a venue or a gift list. We are not responsible for their privacy practices, and we encourage you to read their privacy policies before giving them any personal data.
California residents
In short If you live in California, the CCPA gives you similar rights, and we do not sell personal information.
If you are a California resident, the California Consumer Privacy Act (CCPA) gives you additional rights:
- The right to know what personal information we collect, use and disclose.
- The right to delete your personal information.
- The right to opt out of the sale of personal information. We do not sell your data.
- The right to non-discrimination. We will not treat you differently for using your rights.
To use these rights, contact us at [email protected].
Changes to this policy
In short When something important changes, we update the date and tell you.
We may update this policy from time to time to reflect changes in our practices or the law. When we make significant changes, we will update the date at the top of this page and, where appropriate, email active account holders. We encourage you to look at this policy now and then.
Contact and complaints
In short Write to our data protection lead. If we cannot put it right, you can complain to the ICO.
Any question about your data
talk to our data protection lead.
Tell us your name, the email on your account and what you would like. We reply within one month.
- Write to
- The data protection lead, Build The Day
- [email protected], subject Privacy
- We reply
- Within one month
The Information Commissioner
If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office: online at ico.org.uk, by phone on 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would like the chance to put it right first.