Privacy policy

For account holders, Aurelia is the controller of your account data.

For guests, the couple who sent the invitation decides what to ask and what to do with the answers. We process guest details on the couple’s behalf, only to run their invitation.

From couples (account holders):

• Account details: your name, email address and a securely hashed password — we never see or store the password itself.
• Invitation content: names, dates, venues, schedules, stories and anything else you type into the editor.
• Photos you upload. We re-encode every image, which removes hidden metadata such as the GPS location where it was taken.
• Order details: which plan you bought, the amount, currency and payment status. Card details go to Lemon Squeezy and never reach our servers.

About guests:

• Guest-list details a couple adds: household name, email, phone number, tags and private notes.
• RSVP replies a guest sends: name, email, whether they are attending, dietary requirements, a song request and a message to the couple.

When you contact us or report content: your name, email address and message, which we keep only as long as we need to deal with it.

Dietary requirements can reveal health or religious information. Guests choose whether to share it, and it is visible only to the couple.

Like any website, our servers receive basic technical information when you visit, such as your IP address and browser type. We use it to keep the service secure and working, and to limit abuse such as repeated RSVP submissions.

• To run your account and your invitation — this is necessary to provide the service you asked for.
• To process your purchase and keep records we are legally required to keep.
• To keep Aurelia secure and prevent fraud and misuse — our legitimate interest.
• To email you about your account or order. We do not send marketing email without your consent.

We do not sell personal data, and we do not use guest details for anything other than the couple’s invitation.

We use a small number of providers to run Aurelia. Each receives only what it needs:

• Lemon Squeezy — payment processing and receipts.
• Resend — delivers the messages you send us through our contact and report forms.
• Cloudflare — storage and delivery of uploaded photos.
• Our hosting and database provider — to run the application.
• Google Fonts — loads the typefaces on our pages; your browser sends your IP address to Google when it does.
• Google Maps — if a couple adds a venue map, it loads from Google when a guest opens that section.

We may also disclose data if the law requires it, or to protect the rights and safety of our users.

Published invitations can be seen by anyone who has the link. They are hidden from search engines, but please share the link only with your guests.

• Invitations and guest replies: while your account is open. When a plan ends, the invitation is archived (guests see only the couple’s names and date) and its content and replies are kept, not deleted.
• Deleted invitations and closed accounts: removed from our live systems within 30 days, and from backups when they cycle out.
• Order records: as long as tax and accounting law requires.

Depending on where you live, you can ask us to access, correct, export or delete your personal data, or object to how we use it. Couples can edit and delete most data themselves in the studio, and export RSVPs as a spreadsheet.

Guests: please contact the couple first, as they control their guest list. If you cannot reach them, write to us at hello@aurelia.org.uk and we will help.

You also have the right to complain to your local data protection authority.

Passwords are hashed with bcrypt, sessions use random tokens of which we store only a keyed hash, connections are encrypted, and access to production data is restricted. No system is perfectly secure; if a breach affects you, we will tell you promptly.

Our providers may process data outside your country. Where they do, we rely on appropriate safeguards such as standard contractual clauses.

Aurelia accounts are for adults. We do not knowingly collect data from children, other than names a couple adds to their guest list.

Questions about privacy: hello@aurelia.org.uk.