Privacy policy

The short version

• We collect what it takes to run your wedding website, guest list and RSVPs, and nothing for advertising.
• Your guest list is yours. We never sell it, pass it on, or email your guests about us.
• There are no analytics or ad trackers on this site.
• You can ask to see, fix or delete what we hold about you at any time.

About us

Online Wedding Invitation is a small business run by Caitlin and Nicolas. This policy applies to onlineweddinginvitation.nz, including the couples’ dashboard and every wedding website and RSVP page we host. We follow the 13 information privacy principles (IPPs) in the Privacy Act 2020.

Information couples give us

Signing up takes a name, an email and a password. We never keep the password itself, only a hash of it that can’t be turned back.

As you plan, the dashboard stores whatever you add: your wedding date and town, the events and venues, the words and photos on your site, koha or registry details, your checklist, your seating plan and your suppliers, including quotes and what is still owing.

Information about guests

Guests reach us in two ways: the couple adds them, or they fill in an RSVP. Either way we may hold a guest’s name and household, an email address or mobile number, and for each event whether they are coming. An RSVP can also carry a meal choice, a plus-one, a song request, a note for the couple and dietary needs. We record when someone opens their personal invite link, so the couple can see who has seen it.

Dietary needs sometimes say something about a person’s health, like a severe allergy. We keep them only for the couple’s catering, show them only to the couple, and never use them for anything else.

The couple decides who is on their list, and we hold those details for them so the invite and RSVP can work. If you’re a guest and want something changed or taken off, the quickest route is the couple, though you’re welcome to write to us too.

When you just browse

Like any website, ours receives your IP address and basic browser details, and our host tells us which country a visit comes from. We use that only to offer our Australian site to visitors who seem to be across the Tasman.

People who join the early-access list give us an email address and, if they like, a wedding date.

What we use it for

To run the dashboard and publish the website you build. To deliver the save the dates, invites and RSVP reminders you decide to send, and password resets when you need one. To protect the service and the people using it from misuse. And to reply when you get in touch.

That’s it. No selling, no advertising profiles, no marketing to your guests.

The companies that help us

A few overseas companies help us run the site:

• Cloudflare: hosting, our database, photo storage and security
• Resend: sending email
• Google: the typefaces on our pages (your browser loads them from Google) and our own inbox
• Stripe, once paid plans are switched on: card payments. We never see full card numbers.

They store and process information on our behalf and can’t use it for their own purposes, so under section 11 of the Privacy Act we stay responsible for it, wherever their servers are (often the United States). If we ever disclose information to an organisation overseas for its own use, we’ll make sure IPP 12 is met first.

We would also share information if New Zealand law required it, such as a court order.

Cookies

Only the ones the site needs, and none that follow you around the internet:

• owi_session signs you in (30 days)
• theme remembers dark or light mode (12 months)
• stay_market remembers you’d rather stay on the New Zealand site (180 days)
• a cookie per password-protected wedding site you’ve unlocked (90 days)

Your browser also keeps a note of whether you’ve folded away the dashboard menu.

How long we hold it

For as long as your account is open. Your wedding site stays up for at least 12 months after the big day, and the Sent emails page keeps a copy of every email sent from it.

Ask us to close your account and we’ll delete it, along with your wedding, guest list, RSVPs, photos and email history, within 30 days, then from our backups within the following 30. During early access you do this by emailing us; we’ll confirm once it’s gone.

Security

Everything is sent over HTTPS. Passwords are salted and hashed, sign-in tokens are stored only in scrambled form, wedding site addresses include a random code so they can’t be guessed, and couples can add a password.

If a privacy breach happens that has caused, or is likely to cause, serious harm, we’ll tell the people affected and notify the Privacy Commissioner as soon as practicable, as the Act requires.

Your rights

Under IPP 6 and IPP 7 you can ask for a copy of the personal information we hold about you, and ask us to correct it. We’ll answer as soon as we can and within 20 working days, free of charge. Couples can already view, edit and export most of it from the dashboard.

Email from us

Invites a couple sends you are their message to you, not advertising. There’s an unsubscribe link at the foot of every one: click it and nothing more about that wedding will reach your inbox, though your RSVP link still works. If we send commercial email of our own, such as a launch note to our early-access list, it only goes to people who agreed to it, says who it’s from and carries a working unsubscribe, in line with the Unsolicited Electronic Messages Act 2007.

Get in touch

Questions, requests or complaints: hello@onlineweddinginvitation.nz. If you’re unhappy with how we’ve dealt with a privacy concern, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

Updates

When this policy changes we’ll change the date above, and we’ll email account holders before any change that affects them.