Privacy policy

Who we are

Online Wedding Invitation is run by its founders, Caitlin and Nicolas. This policy covers onlineweddinginvitation.au, the dashboard couples use to plan, and the wedding websites and RSVP pages we host for them. “We” and “us” means us; “you” means anyone using the site, whether you are planning a wedding or replying to an invitation.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

What we collect

From couples who create an account:

• your name, email address and password (stored only as a one-way hash that we cannot read)
• your wedding details: the date, your town, the events, venues and their addresses
• what you put on your website: words, photos, your story, registry or wishing well details
• your planning notes: the checklist, seating plan, and the suppliers you add along with what you have paid them

About guests, entered by the couple or by the guest when they RSVP:

• names, households, email addresses and mobile numbers
• whether each person is coming to each event, their meal choice, any plus-one, and whether a guest is a child
• dietary requirements, a song request or a message to the couple
• when someone opened their personal invitation link

Dietary requirements can reveal health information (an allergy, coeliac disease), which the APPs treat as sensitive information. It is only collected when a guest or the couple chooses to enter it, it is used only so the couple can plan their catering, and we never use it for anything else.

From anyone who visits: the technical details every website receives, such as your IP address, your browser and the country your connection comes from. We use the country only to suggest our New Zealand site if you seem to be there. We do not run analytics or advertising trackers.

If you join our early-access list, we keep your email address, your wedding date if you gave it, and which country you signed up from.

How we use it

• to run your account and wedding website, and to show your guests the pages you have published
• to send the emails you ask us to: save the dates, invitations and RSVP reminders to your guests, and password resets to you
• to keep the service secure, for example by spotting misuse or attempts to break in
• to answer you when you write to us

We don't sell personal information, rent out guest lists or use them for advertising, and we don't email your guests about our own products.

Guest lists belong to the couple

When couples add guests, they decide what goes on the list and who receives which email. We hold and process those details on the couple’s behalf so the invitation can work.

Couples: please only add people you are genuinely inviting, and use their details for your wedding. Guests: if you would like your details changed or removed, ask the couple, or write to us and we will help.

Who else handles it

A small number of service providers help us run the site. Each only receives what it needs to do its job:

• Cloudflare hosts the site, our database and uploaded photos, and protects it from attacks.
• Resend delivers the emails sent from the site.
• Google serves the typefaces on our pages (your browser fetches them from Google, which sees your IP address) and runs the mailbox your emails to us arrive in.
• Once paid plans open, Stripe will process card payments. We will never see or store your full card number.

These providers are based in, or keep data in, countries outside Australia, including the United States. Before using them we take reasonable steps under APP 8 to make sure they treat personal information consistently with the APPs, which includes choosing providers with strong security and contractual privacy commitments.

We may also disclose information where an Australian law requires it, for example to a court, or to a law enforcement body acting with legal authority.

Cookies

We use a handful of cookies, all needed for the site to work or to remember a choice you made. None of them track you across other websites.

• owi_session keeps you signed in, for up to 30 days.
• theme remembers light or dark mode, for a year.
• stay_market remembers that you chose to stay on the Australian site, for six months.
• One cookie for each password-protected wedding website you unlock, so guests needn’t retype the password, kept for 90 days.

The dashboard also remembers, in your own browser, whether you folded its menu away.

How long we keep it

Your account and wedding are kept while your account is open, and wedding websites stay online for at least 12 months after the wedding date. A copy of each email sent from your wedding stays on your Sent emails page, so you can always see what went to whom.

If you ask us to delete your account, we delete it with your wedding, guest list, photos and sent emails within 30 days, and copies in our backups expire within a further 30 days. During early access this is done by email: write to us and we will confirm once it is done.

Keeping it safe

Passwords are stored only as salted one-way hashes. Sign-in cookies hold a random token, and we keep only a scrambled version of it. Each couple’s website lives at an address with a random code, so nobody can find it by guessing names, and couples can add a password. Everything travels over HTTPS.

No system is perfectly secure. If a data breach is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

Access and correction

Couples can see and change almost everything in the dashboard, and export the guest list as a spreadsheet. Anyone can ask us for access to the personal information we hold about them, or ask us to correct it (APPs 12 and 13). We will reply within 30 days and won’t charge for it.

Emails

Emails a couple sends you through us are personal invitations, not marketing. Each one has an unsubscribe link at the bottom; use it and we will stop sending you emails about that wedding, while your invitation link keeps working. We will only send marketing emails of our own if you have agreed, for example by joining our early-access list, and each one will identify us and let you unsubscribe, as the Spam Act 2003 requires.

Questions and complaints

Write to hello@onlineweddinginvitation.au. If you have a complaint about how we have handled your information, tell us what happened and we will respond within 30 days. If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

If we change this policy in a way that matters, we will update the date at the top and, if you have an account, email you beforehand.