Privacy & Cookies Policy | Wedding Experts

1. Who we are

Last updated: 5 November 2026.

This policy explains what personal data we collect on theweddingexperts.uk and in The Wedding Experts Business mobile app, why, who we share it with, how long we keep it and the rights you have.

The website is operated by The Wedding Experts OU, registration number 16920228, Tartu mnt 67/1-13b, Kesklinna linnaosa, Tallinn 10115, Harju maakond, Estonia. We are the controller of the personal data described here. Contact us at info@theweddingexperts.uk.

2. What we collect

Your account

Your name, email address, password (stored only in encrypted, hashed form), mobile phone number and whether you have verified it, your language, and your settings and preferences. If you sign in with Google or Apple, we receive your name, email address and an account identifier from them. If you choose to hide your email with Apple, we receive the relay address Apple creates.

If you are planning a wedding

Requests you make: the occasion, date or approximate date, area, number of guests, budget, the services you need and your description. Enquiries and quote requests you send to suppliers, the suppliers you save, and the messages and files you exchange with them. If you use our planning tools, the information you add to them, such as your budget, checklist and guest list.

If you are a supplier

Your business details and listing: business name, categories, areas covered, address and map location, photos, descriptions, prices, website and social media links, frequently asked questions and offers. Your plan and billing history. Statistics about your listing, such as views, enquiries and requests unlocked. Messages and files you exchange with couples, and any automatic first message you set up.

Payments are taken by Stripe. We never see or store your full card details; we keep a Stripe customer reference, your plan and your invoices.

If you write a review

Your review and any photos you add, your name as shown on the review, your verified email address and mobile number, and the proof you give of working with the supplier, such as a receipt, contract or booking confirmation. Only our moderators see the proof. It is used only to validate your review and is never shown on the listing.

Guests on a couple's guest list

If a couple adds you to their guest list, we hold the name they enter for your household, the number of guests, your RSVP answer and any note you leave, and your email address if the couple adds it to send you an invitation. The guest privacy notice on RSVP pages explains this in more detail.

If you use The Wedding Experts Business app

The app is for suppliers. It uses the same account and listing data as the website. This is what is specific to the app:

• Choosing your country. The first time you open the app while signed out, it asks Cloudflare which country your IP address is in, so it can open the service for the right country. If that is not available, it uses your phone's region. We keep only the service you end up on, not your IP address.

• Notifications. If you allow them, we store your device's notification identifier with your account, to tell you about new requests, enquiries, messages and your account. Notifications pass through the Expo push service (650 Industries, Inc., USA) and the notification services of Apple and Google, and these handle the text of each notification. We delete the identifier when you sign out or turn notifications off. You choose which notifications you get in the app's settings.

• Location, camera and photos. The app asks for your location only when you tap to use your current location to place your business's pin on the map. Only the pin's position is stored, and it is shown on your listing. The app uses the camera and your photos only when you add photos to your listing, your collections or a message.

• Usage statistics and errors. To improve the app and find errors, we use PostHog (PostHog Inc., with data stored in the European Union) as our processor. It records the screens you open, how long they and our servers take to respond, actions such as unlocking a request or sending a message (identifiers only, never the content), device details, your IP address and the approximate location derived from it, and error reports. This is linked to your account identifier, not your name or email.

• Session replay. For the same purpose, the app records the screens while you use it. Recordings hide all text fields, images and anything about couples, such as names, contact details, requests and messages.

The app has no advertising, does not use your device's advertising identifier and does not track you across other apps or websites. Nothing is bought in the app.

Collected automatically

When you use the website, our servers and our network provider record technical information such as your IP address, browser and device type, the pages requested and the date and time. We use it to deliver the website, keep it secure and fix errors. We also record events such as listing views, enquiries and requests unlocked, to show suppliers their statistics and to run and improve the service.

We do not ask for special category data, such as health or religious beliefs. Please do not include it in requests or messages.

3. How we use it and our lawful basis

UK data protection law requires a lawful basis for each use of personal data. Ours are:

• To create and run your account, publish listings, send and show requests, enquiries, quotes and messages, process subscriptions and send you service emails about your account — performance of our contract with you.

• To show a request's contact details to suppliers who unlock it — performance of our contract with you, which is what the request is for.

• To review listings, requests and reviews before publication, verify phone numbers and email addresses, and prevent spam, fraud and abuse — our legitimate interests in keeping the marketplace genuine and safe.

• To measure how the website and the app are used, including the app usage statistics and session replay described in section 2, and improve them — our legitimate interests in running and developing the service.

• To tell you about features, tips and offers related to your use of the website — our legitimate interests, or your consent where the law requires it. Every such email has an unsubscribe link and you can opt out at any time in your account settings.

• To measure and improve our advertising on Facebook and Instagram: when you create an account or send a request, our servers tell Meta that it happened, together with your email address, phone number and name in hashed (scrambled) form, your IP address and browser type, so that Meta can match it to people who saw or clicked our ads — our legitimate interests in measuring and improving our advertising. This does not use cookies. You can object at any time (see section 9).

• To keep accounting records and comply with the law, and to establish or defend legal claims — legal obligation and our legitimate interests.

Where we rely on legitimate interests, we have balanced them against your rights, and you can object at any time (see section 9). We do not sell your personal data. We do not make decisions about you with legal or similarly significant effects based solely on automated processing.

4. Automated and AI tools

Message assistant for suppliers. Suppliers on a paid plan can ask an assistant to suggest or improve a message to a couple. To do this we send the supplier's published listing details, the details of the couple's request (first name, type and date of the event, area, services, number of guests and description) and, when improving a message, the supplier's draft and the latest messages in the conversation. The couple's surname, email address and phone number are not sent. The supplier reads, edits and sends the message themselves; nothing is sent automatically. The texts the assistant produces are deleted within 90 days.

Listing drafts. When a supplier signs up, we may read the supplier's own public website and use an AI model to prepare a draft listing, which the supplier reviews before publishing.

First-message check. The first message a supplier writes in a conversation can be checked by AI against a short list: a greeting with the couple's name, who the supplier is, a starting price and a link to their work. If something is missing, the supplier is told and can still send the message.

Checking requests. Couples' requests go through automatic rules and may then be checked by an AI model to see whether they are genuine and complete. These checks can only approve a request. Anything in doubt goes to our team, and only our team can reject a request.

These tools use Amazon Bedrock (Amazon Web Services) on infrastructure in the European Union. Amazon acts as our processor and does not use the content to train models.

5. Who we share it with

Other users. Published listings and reviews are public. Couples' contact details are shared only with suppliers who unlock their request (up to 5 per service) or whom the couple contacts. Those suppliers become independent controllers of that data and are responsible for how they use it.

Service providers who process data on our behalf and only on our instructions:

• Amazon Web Services, for hosting, databases, file storage, sending email, address and location lookups, and the AI tools above. Data is stored in the European Union (Frankfurt);

• Cloudflare, which delivers the website and protects it against attacks;

• Prelude, which sends the text message codes we use to verify phone numbers;

• our email provider, for the mailbox that receives your emails to us;

• Google and Apple, only if you choose to sign in with them, and for delivering notifications in the app;

• Expo (650 Industries, Inc.), which sends notifications to the app;

• Google, for the website analytics described in section 8;

• PostHog, for the app usage statistics and session replay described in section 2;

• DataForSEO, which we use to fetch a supplier's public Google reviews when the supplier asks us to show them.

Stripe processes subscription payments. For some processing, such as fraud prevention and its legal obligations, Stripe acts as an independent controller under its own privacy policy.

Meta Platforms Ireland Limited receives the advertising data described in section 3 and, only if you accept advertising cookies, the Meta pixel data described in section 8. Meta and we are joint controllers for collecting and sending that data; Meta then processes it as an independent controller under its own privacy policy.

Maps on the website load images from OpenStreetMap, which receives your IP address like any website you visit.

We may also disclose data where the law requires it, to protect the rights or safety of others, or to a buyer or successor if our business is reorganised or sold, in which case this policy continues to apply.

6. Transfers outside the UK

We are based in Estonia, in the European Economic Area, and our main systems are in the European Union. The UK recognises the EEA as providing adequate protection for personal data.

Some of our service providers may process data in other countries, including the United States. Where they do, we rely on the UK Extension to the EU-US Data Privacy Framework, the ICO's International Data Transfer Agreement or Addendum, or another safeguard recognised by UK law. You can ask us for details.

7. How long we keep it

We keep your account data for as long as your account is open. When you delete your account, we delete or anonymise your personal data, except: billing and accounting records, which the law requires us to keep for 7 years; data we need to keep to deal with a legal claim or a dispute; and copies in backups, which are deleted on their normal cycle.

Closed requests stay in your account history until you delete your account. Suppliers who unlocked a request before it was closed keep the details they received as independent controllers.

Guest lists are deleted six months after the wedding date or, if no date is set, 24 months after the couple's last change.

Proof given with a review is deleted 30 days after the review is rejected, and is otherwise kept with the review. Texts produced by the message assistant are deleted within 90 days. App session recordings are deleted after 30 days, and other app usage data after 12 months at most. Server and security logs are kept only as long as needed to run and protect the website.

8. Cookies and similar technologies

Strictly necessary storage, which the website needs to work and which does not need your consent:

• your sign-in session, stored in your browser so that you stay signed in;

• your language and the choices you make in our cookie banner;

• security cookies that Cloudflare may set to tell people from automated traffic.

Analytics. We use Google Analytics to understand how the website is used: which pages are visited, how visitors arrive and which features they use, so that we can improve it. It sets cookies named _ga and _ga_RSM9TPGFJ1, which last up to two years. Google processes this data on our behalf, which may involve transfer to the United States under the UK Extension to the EU-US Data Privacy Framework. We remove sign-in links and similar details from page addresses before they are sent.

Advertising. Your choice in our cookie banner decides whether Google may use this data to personalise advertising, and whether the Meta pixel loads. Only if you accept, the Meta pixel records the pages you visit on the website and sets cookies named _fbp and, if you arrived from one of our ads, _fbc, which last up to 90 days. We use it to measure our ads on Facebook and Instagram and to show our ads to people who have visited the website. If you decline, the Meta pixel does not load. To change your choice, clear this website's data in your browser and the banner will ask again.

You can delete or block cookies in your browser settings at any time. Blocking strictly necessary storage may stop parts of the website working, such as staying signed in.

The app has its own usage statistics, described in section 2.

9. Your rights

You have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to how we use it, and to receive the data you gave us in a portable format. Where we rely on your consent, you can withdraw it at any time.

You can update most of your details, download your data and delete your account in your account settings on the website. In the app, go to Menu, Settings, Delete account. Couples must close any open requests before deleting their account. For anything else, email info@theweddingexperts.uk. We will reply within one month.

If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

10. Security

We protect your data with encrypted connections, hashed passwords, restricted staff access and regular security updates. No system is completely secure, so please use a strong password and keep it private.

11. Children

The website is for adults. We do not knowingly collect personal data from anyone under 18.

12. Changes to this policy

We will post any changes on this page with a new date. If a change significantly affects how we use your data, we will tell you by email or on the website before it applies.

13. Contact

The Wedding Experts OU, Tartu mnt 67/1-13b, Kesklinna linnaosa, Tallinn 10115, Harju maakond, Estonia. Email: info@theweddingexperts.uk.