Cookie Policy

This Cookie Policy explains how Arch uses cookies and similar browser technologies when you visit our website, use our wedding planning platform, access a wedding website created through Arch, or respond to a wedding invitation.

Arch is operated by Arch Wedding Ltd, a company registered in Scotland under company number SC906671.

Our website is https://archwedding.com.

For questions about cookies or privacy, contact support@archwedding.com.

This policy should be read alongside our Privacy Policy, which explains how we collect, use, share and protect personal information.

Cookies are small files that websites may store on your device to support functionality such as authentication, security and payment processing.

Websites may also use other forms of browser storage, including:

• Local storage (localStorage): Information stored in your browser that can remain available between visits.
• Session storage (sessionStorage): Information generally retained for the duration of a browser tab or session.
• Similar technologies: Other mechanisms that store information on, or access information from, your device.

These technologies can serve different purposes. Some are necessary for a service to function, while others may be used for analytics, advertising or personalisation.

Based on our current technical implementation, Arch uses browser storage for authentication and first-party functions. The identified keys are: the sign-in session key set by our authentication service (sb-…-auth-token); aisle.referral (supplier referral attribution, local storage); aisle.returnTo (where to return after signing in, session storage); aisle.perksSeenAt and aisle.perksHintShownAt (interface state, local storage); aisle.perksHintSession (interface state, session storage); aisle:sev:{type}:{slug} (first-party supplier impression de-duplication, session storage); and stationery-draft:{key} (in-progress stationery designs, session storage). These keys are not sent to third-party advertising or marketing platforms by Arch’s identified application code.

Account authentication

When you sign in to an Arch account, our authentication service uses browser local storage to maintain your authenticated session and support token refresh.

This enables couples and suppliers to remain signed in while using their accounts.

This storage is used for authentication and account security, rather than advertising or behavioural tracking.

Authentication information may remain in browser storage until you sign out, the session expires, or the information is otherwise removed.

Secure RSVP sessions

Arch has technical support for a short-lived, secure RSVP session cookie named __Host-arch_rsvp.

This cookie is designed to maintain an authorised RSVP session and has a maximum lifetime of two hours.

It is configured with security protections including HttpOnly, Secure and SameSite=Strict.

This cookie is not used by Arch’s current direct invitation-link and QR-code RSVP experience. It belongs to a separate verified-session feature that is currently disabled.

Direct invitation links and QR codes

Guests can respond to invitations using the unique link or QR code supplied by the couple.

This direct RSVP process does not require guests to create an account, provide an email address or complete email verification.

The invitation’s access credential is contained in the unique RSVP URL rather than stored in an RSVP session cookie.

Guests should treat their invitation links as private and avoid sharing them with people who should not have access to their household invitation.

Arch works with external service providers to support certain features.

These providers may use cookies or similar technologies when you interact with their services.

Stripe — Payments

Arch uses Stripe to process payments, including subscriptions and stationery purchases.

When you open a payment checkout, Stripe may use cookies or similar technologies to support payment processing, security, fraud prevention and other functions associated with its services.

The exact cookies and storage technologies used may depend on Stripe’s configuration and the checkout experience.

Further information is available in Stripe’s Privacy Policy.

Google — Sign-in

If you choose to sign in using Google, you will interact with Google’s authentication services.

Google may use cookies or similar technologies during that authentication process.

These technologies are associated with the sign-in process initiated by you.

Further information is available in Google’s Privacy Policy.

Apple — Sign-in

If you choose to sign in using Apple, you will interact with Apple’s authentication services.

Apple may use cookies or similar technologies during that process.

Further information is available in Apple’s Privacy Policy.

Hosting and authentication infrastructure

Arch uses external infrastructure and authentication services to operate and secure its platform.

These services may process technical information required to provide hosting, authentication and security functionality.

Our current application code does not identify additional first-party tracking cookies associated with these services.

Couples can create wedding websites through Arch to share information about their celebrations.

Based on our current technical review, public wedding websites do not set first-party cookies or use browser storage for analytics, advertising or visitor tracking.

Visitors can browse these websites without creating an Arch account.

Where a guest wishes to respond to an invitation, the wedding website directs them to the unique RSVP link or QR code provided by the couple.

The public wedding website does not offer a guest-name lookup or email verification journey.

At the time of our most recent technical review, Arch’s application code did not contain implementations of:

• Google Analytics or Google Tag Manager.
• Meta Pixel or other social media advertising pixels.
• Third-party product analytics platforms such as Mixpanel, PostHog or Hotjar.
• Advertising or behavioural tracking cookies.
• Application-defined marketing attribution cookies.

Arch does not currently use these technologies in its identified first-party application implementation.

If we introduce non-essential analytics, advertising or similar tracking technologies in the future, we will assess the applicable legal requirements and implement any necessary consent or objection controls before using them.

We will update this policy accordingly.

Under UK law, some technologies that store information on or access information from your device require consent, while certain technologies qualify for legal exceptions.

For example, browser storage that is strictly necessary to provide an account sign-in or a payment service requested by you may not require prior consent.

Based on the technologies identified in our current application code, Arch does not currently operate a cookie consent banner or preferences centre.

If we identify or introduce technologies that require consent, we will provide appropriate controls before activating them.

We will not use the absence of a cookie banner as a reason to deploy non-essential tracking without the permissions required by law.

You can manage or remove cookies and stored website information through your browser settings.

Most browsers allow you to:

• View and delete cookies.
• Remove stored website data.
• Block cookies from particular websites.
• Restrict third-party cookies.
• Clear browsing data.

Please be aware that deleting or blocking essential authentication storage may sign you out of Arch or prevent some account functions from operating correctly.

Cookies used by Google, Apple or Stripe may also be subject to the settings and controls provided by those services.

Different technologies have different storage periods.

Arch’s ordinary direct-link RSVP process does not require an RSVP session cookie.

We will review this information when our integrations or technical implementation change.

We may update this Cookie Policy when we change our services, introduce new technologies or need to reflect changes in applicable law.

The latest version will be available on our website, with its updated effective date.

Where a change requires consent or another specific user control, we will implement that requirement as appropriate.

For questions about this Cookie Policy, contact:

Arch Wedding Ltd

Registered in Scotland

Company number: SC906671

Registered office: 37 Brunstane Drive, Edinburgh, EH15 2NF

Email: support@archwedding.com

Website: https://archwedding.com

Our registered office and other statutory company information are available through our company information disclosures.