Privacy Policy

Welcome to Arch.

Arch Wedding Ltd (“Arch”, “we”, “us” or “our”) provides an online wedding planning platform that helps couples organise their weddings, collaborate with partners, manage guests, create wedding websites, discover suppliers, use AI-assisted planning tools and purchase personalised wedding stationery.

We respect your privacy and are committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store, share and protect personal information when you:

• Visit archwedding.com or use the Arch platform.
• Register for a couple or supplier account.
• Collaborate on a wedding.
• Appear on a wedding guest list.
• Respond to an invitation or submit dietary requirements.
• Visit a wedding website created through Arch.
• Contact a wedding supplier through our directory.
• Use Ask Arch, our AI-powered planning assistant.
• Purchase a subscription, promotion or printed stationery.
• Contact us or exercise your privacy rights.

This policy applies to our current website and web application. Any future mobile applications may require additional privacy disclosures.

Arch is operated by:

Arch Wedding Ltd

A company incorporated in Scotland, United Kingdom.

Company registration number: SC906671

Registered office: 37 Brunstane Drive, Edinburgh, EH15 2NF

Privacy enquiries: support@archwedding.com

General enquiries: support@archwedding.com

Arch Wedding Ltd is the data controller for personal information it processes for its own purposes, including accounts and logins, subscriptions, payments and billing, supplier listings and enquiries, security and fraud prevention, service improvement, and legal, tax and accounting records.

For guest information that couples add or collect through Arch for their wedding — such as guest names, contact details, RSVPs, meal choices, seating and dietary information — the couple is the controller and Arch acts as their processor under the data processing terms in our Terms of Service, processing it only on the couple’s instructions.

Guests who have questions about how a couple uses their information should contact the couple. Arch will assist the couple with guest requests and may pass requests it receives to them.

3.1 Account information

When you create an Arch account, we may collect:

• Your name and email address.
• Authentication credentials or information provided by Google or Apple sign-in.
• Profile photograph or avatar.
• Account type, role and wedding membership.
• Account settings and preferences.
• Subscription and account activity.

Passwords are handled through our authentication provider and are not stored by Arch as readable passwords.

3.2 Wedding planning information

When you use Arch’s planning features, we may process:

• Names of the couple.
• Wedding dates and estimated dates.
• Ceremony and reception locations.
• Venue names and addresses.
• Wedding budgets, spending records and payment schedules.
• Planning tasks, deadlines and completion information.
• Supplier selections and planning notes.
• Wedding themes, preferences and styles.
• Wedding-day schedules and timelines.
• Music selections and links to third-party music services.
• Uploaded photographs and other wedding-related content.

Some information may identify other people, including partners, family members, wedding party members and suppliers.

3.3 Guest and household information

Couples may add information about invited guests, including:

• Names.
• Email addresses and telephone numbers.
• Postal addresses.
• Household and invitation groupings.
• Adult, child or other guest classifications.
• Invitation and attendance status.
• Meal choices and dietary preferences.
• Seating arrangements.
• Notes entered by the couple.
• RSVP submission details.

Guests may also submit or update certain information through a secure RSVP page.

Guests do not need to create an Arch account to respond to an invitation.

3.4 Dietary requirements and sensitive information

Arch provides fields for dietary preferences, food allergies and other requirements relevant to wedding catering.

Certain information, such as allergies, medical dietary restrictions or information revealing religious beliefs, may qualify as special-category personal data under UK or EU data protection law.

Dietary information is optional. Next to the dietary field, guests are told: “Your dietary information will be visible to the couple and may be shared with their venue or caterer where needed to accommodate your requirements.”

If a guest provides dietary information on their RSVP, they must tick a separate, unticked box confirming: “I explicitly consent to my dietary information being provided to the couple and shared with their venue or caterer where necessary to accommodate my requirements.” Leaving the dietary field empty never prevents a guest from sending their RSVP.

We record when consent is given or withdrawn, together with the version of the notice shown.

Guests can withdraw consent at any time by removing their dietary information on their RSVP page. Withdrawal removes the dietary information from the guest record and is recorded.

Couples may also enter dietary information for their guests to plan catering and seating. This is the couple’s own entry, made as controller, and is not guest consent. Arch records it as added by the couple; catering and seating exports label it “Added by couple — not confirmed”, while guest-entered details are labelled “Guest confirmed”. The guest can confirm, correct or remove it on their RSVP page, and any later change by the couple clears the earlier consent.

Stationery uses only the dietary information the chosen product needs — for example, place cards may show a short dietary flag for the catering team.

We intend this information to be used only for legitimate wedding catering, accommodation and safety purposes.

We encourage guests and couples to provide only the information reasonably necessary for these purposes and not to include unrelated medical histories or other sensitive details.

Suppliers do not have access to Arch’s guest records. Couples decide what to share with their venue, caterer or other suppliers outside Arch.

3.5 Children’s information

Couples may include children on guest lists and may provide their names, meal requirements, seating arrangements and related invitation information.

Arch is not intended to provide accounts directly to children.

Account holders must meet the minimum eligibility requirements stated in our Terms of Service.

Adults who submit information about children should provide only information reasonably necessary for organising the event and should have appropriate authority to provide it.

We take additional care where information relates to children, particularly sensitive dietary or health information.

3.6 Wedding websites and public content

Couples may publish wedding websites through Arch.

Depending on the content selected by the couple, these websites may display:

• The couple’s names.
• Wedding dates and venues.
• Event schedules.
• Wedding party names, photographs and descriptions.
• Travel and accommodation information.
• Menu information.
• Wedding stories, photographs and registry links.

Published wedding websites are accessible to anyone who has or discovers the website link.

Arch applies technical instructions requesting that search engines do not index these wedding websites. However, these instructions do not make a website private, prevent someone from sharing its link or guarantee removal of previously indexed information.

Couples should obtain appropriate permission before publishing information or photographs relating to other individuals.

3.7 Supplier information

Suppliers registering with Arch may provide:

• Business and trading names.
• Contact names and business contact information.
• Websites and social media links.
• Business locations and service areas.
• Portfolio photographs and descriptions.
• Service categories and business preferences.
• Subscription, promotion and payment information.
• Enquiry records and profile activity.

Information deliberately included in a published supplier profile may be publicly accessible.

3.8 Supplier enquiries

When a couple sends an enquiry through Arch, information shared with the selected supplier may include:

• The couple’s names.
• Wedding date and location.
• Venue details.
• Estimated guest numbers.
• Contact email and telephone number.
• The enquiry message.

The supplier receives this information to respond to the enquiry.

After receiving the enquiry, the supplier may process the information independently under its own privacy practices.

Arch does not currently manage contracts, booking deposits or payments between couples and independent wedding suppliers.

3.9 Stationery purchases

When you design or purchase personalised wedding stationery, we may collect and process:

• Customer and recipient names.
• Billing and delivery information.
• Contact details.
• Wedding wording, dates and venue details.
• Guest names and seating information included in printed products.
• Uploaded photographs and artwork.
• Personalisation choices and approved print proofs.
• Order details, production status and shipping information.
• Payment references and transaction records.

Information incorporated into stationery artwork, including guest names, seating information and dietary indicators or notes selected for printing, may be shared with Prodigi and relevant production and fulfilment partners to manufacture and deliver an order. Couples may also export guest dietary information and share it with caterers, venues or other wedding suppliers outside Arch.

3.10 Payment information

Arch uses Stripe to process subscription payments, supplier promotions and stationery purchases.

Stripe processes payment information required to complete transactions.

Arch may receive payment-related identifiers, transaction status, subscription details, billing information and limited payment method information.

We do not need to store your full payment card number within Arch’s application database.

3.11 Ask Arch AI information

When you use Ask Arch, we process:

• Questions and messages you submit.
• AI-generated responses.
• Relevant wedding planning context.
• Conversation history needed to maintain the interaction.
• Proposed planning actions and your decisions about those actions.

Ask Arch has two conversation modes:

Together: Conversations are available to both partners associated with the wedding.

Just Me: Conversations are restricted to the individual account holder within Arch’s access controls.

Relevant wedding context may include dates, budget summaries, task progress, wedding preferences and aggregated guest statistics.

Arch’s current context-building process is designed not to automatically include individual guest contact details, postal addresses, payment card information or individual dietary notes.

However, information you type directly into an AI conversation may be transmitted to our AI provider.

Do not enter unnecessary sensitive personal information, passwords, payment credentials or confidential third-party information into Ask Arch.

3.12 Technical and usage information

We may process technical information necessary to operate and secure Arch, including:

• IP addresses or derived security identifiers.
• Browser and device information.
• Authentication and session information.
• Security and rate-limiting records.
• Cookies and local storage identifiers.
• Technical error and service activity information.

Some security processes use hashed IP addresses to help prevent abuse.

We obtain personal information:

• Directly from you when you register, complete forms, make purchases or contact us.
• From another person, such as a couple adding you to a wedding guest list.
• From wedding guests who submit RSVP information.
• From account partners collaborating on a wedding.
• From authentication and payment providers.
• Through technical operation of the platform.

Where information is provided about another person, the individual supplying it should ensure that they have an appropriate reason or authority to do so.

We process personal information for the following purposes.

Where we rely on legitimate interests, we consider the purpose of the processing, its necessity and the impact on individuals.

Where consent is required, we will provide an appropriate mechanism to give and withdraw it.

Special-category information requires an additional lawful condition under applicable data protection legislation.

The precise allocation of controller and processor responsibilities, and the lawful basis for particular guest-data activities, will be documented in our internal data protection records.

We may share personal information with the following categories of recipients.

6.1 Wedding partners and organisers

Information entered into shared wedding planning features is generally accessible to authorised wedding members.

Private Ask Arch conversations are subject to separate access controls.

6.2 Wedding suppliers

Where a couple sends an enquiry or shares planning information with a supplier, the supplier may receive the information necessary for the relevant purpose.

6.3 Printing and delivery providers

We use Prodigi to assist with personalised stationery production and fulfilment.

Prodigi and relevant manufacturing or delivery partners may receive names, delivery addresses, contact information and artwork necessary to fulfil an order.

6.4 Payment providers

Stripe processes payments, subscriptions, billing and related transaction information.

6.5 AI providers

We use OpenAI technology to provide Ask Arch.

Relevant planning context, conversation messages and associated instructions may be transmitted to OpenAI to generate responses or perform supported web research.

Arch sets store: false for Ask Arch web research requests. Regular chat completion requests do not explicitly set this parameter, and provider-side retention depends on the applicable API terms and organisation settings. These arrangements should not be understood as a guarantee of zero retention.

Under OpenAI’s standard commercial API terms, customer API data is not used for model training by default, subject to the applicable contractual terms and settings.

6.6 Hosting and infrastructure providers

We use Lovable Cloud and associated Supabase infrastructure for database, authentication and file storage services, and Cloudflare infrastructure for application delivery and server execution.

6.7 Authentication and communications providers

Google and Apple may process information when you choose their authentication services.

Transactional email providers may process contact details and authentication-related information when sending platform messages.

6.8 Professional advisers and authorities

We may disclose information to accountants, legal advisers, insurers, regulators, law enforcement or other authorised parties where necessary and legally permitted.

We do not sell personal information to third-party data brokers.

We do not currently operate behavioural advertising or third-party advertising tracking through the Arch platform.

Arch is established in the United Kingdom, but its services and providers may involve processing in other countries.

Personal information may be processed or accessed in countries including the United Kingdom, European countries and the United States, and may be shared with international printing and fulfilment partners where required.

Where a transfer is subject to UK or EU data protection restrictions, we will use an applicable legal transfer mechanism, such as an adequacy decision, recognised contractual safeguards or another permitted mechanism.

Arch’s primary database and connected file storage are hosted in AWS Europe (Paris), region eu-west-3, France. Other service providers, including Cloudflare, Stripe, OpenAI, authentication, email and international print providers, may process information in other countries, including the United States, as described in this policy.

You may contact us for further information about relevant safeguards.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including providing services, fulfilling orders, maintaining records and meeting legal obligations.

Different categories of information may require different retention periods.

Examples include:

• Account information: Retained during the active paid period, including a scheduled cancellation period, then removed when the account is closed, except information that must lawfully be retained.
• Wedding planning information, guest lists, RSVPs, dietary notes, images, files and AI conversations: Scheduled for deletion at the end of the current paid period following confirmed cancellation or account-closure request, subject to legally required exceptions and any other valid user access rights.
• Guest and RSVP information: Retained for the wedding planning purpose and subject to the organiser’s instructions, our applicable responsibilities and the final retention schedule.
• AI conversations and summaries remain available during the account’s active period. Under the account-closure process, associated application records are deleted when the account closes; provider-side processing, legal records and backups are governed by their applicable retention arrangements.
• Stationery and transaction records: Retained where necessary for fulfilment, customer service, tax, accounting and legal obligations.
• Security records: Retained for periods proportionate to fraud prevention, service security and investigation needs.
• Backups: May be retained temporarily according to the relevant infrastructure provider’s backup arrangements.

Where data is no longer required, we will delete, anonymise or otherwise securely dispose of it, subject to applicable legal obligations.

Couple account holders can access account deletion functionality through Arch.

The wedding owner (the partner who holds the subscription) controls the wedding. A confirmed cancellation or account-deletion request by the owner stops renewal immediately and schedules closure of the entire wedding at the end of the already-paid billing period. At that date the wedding, its guest details, stored images and files, the owner’s account and every joined partner’s account are deleted, apart from records we must keep by law. Both partners are notified when closure is scheduled. Only the owner can reverse it before that date.

A joined partner cannot cancel the subscription or close the wedding. They can leave the wedding, keeping their own account, or delete their own account; the wedding then remains with the owner.

Deletion of database records does not necessarily mean that every associated record held by third-party payment providers, delivery providers or backup systems is immediately erased.

Certain transaction and accounting records may need to be retained under applicable law.

For suppliers, cancellation or an account-deletion request stops renewal and schedules closure at the end of the current paid period. Supplier profiles, portfolio files, offers and associated enquiries are then removed, except records required by law.

Guests may request access to, correction of or deletion of their information by contacting the wedding organiser or Arch, as appropriate.

A user may reverse a scheduled cancellation before the paid period expires. If reversed successfully, the scheduled account deletion is withdrawn and subscription renewal is restored only after the user has been shown and accepted the applicable recurring charge.

A cancellation or account-deletion request does not cause immediate loss of access during an already-paid period. Unpaid, free, trial or expired accounts require an appropriate separately disclosed closure process.

Depending on your location and applicable law, you may have rights to:

• Request access to personal information held about you.
• Correct inaccurate or incomplete information.
• Request deletion of personal information.
• Restrict certain processing.
• Object to processing based on legitimate interests.
• Receive certain information in a portable format.
• Withdraw consent where processing relies on consent.
• Challenge certain automated decisions where applicable.
• Complain to a relevant data protection authority.

These rights are subject to applicable legal conditions and exceptions.

We may need to verify your identity before fulfilling a request, particularly where disclosure could reveal another person’s private information.

We will respond within the time limits required by applicable law.

To exercise your rights, contact:

support@archwedding.com

If Arch processes guest information solely on behalf of a wedding organiser, we may need to refer the request to that organiser or assist them in responding.

UK complaints

Individuals in the United Kingdom may complain to the Information Commissioner’s Office (ICO):

https://ico.org.uk

Individuals in other jurisdictions may have the right to complain to their relevant supervisory authority.

Arch may be accessed from countries outside the United Kingdom.

Depending on where you live and which laws apply to Arch’s activities, you may have additional privacy rights.

For example, certain US state privacy laws provide qualifying residents with rights concerning access, correction, deletion and particular uses or disclosures of personal information.

Canadian, Australian and European privacy laws may also impose additional obligations where applicable.

We will assess and honour rights that apply to our processing activities.

Arch does not claim that every regional privacy law applies to every user or that all regional rights are identical.

Where required, we will provide additional jurisdiction-specific notices or mechanisms.

Arch uses cookies and browser storage for functions such as authentication, session management and interface preferences.

The current platform does not use third-party behavioural advertising pixels or conventional marketing analytics cookies.

Further information about the technologies we use, their purposes and applicable choices is available in our Cookie Policy:

https://archwedding.com/cookies

If we introduce optional tracking or analytics technologies, we will update our disclosures and obtain consent where required.

We use technical and organisational measures intended to protect personal information against unauthorised access, alteration, disclosure or loss.

These measures include, where applicable:

• Encrypted HTTPS connections.
• Authenticated account access.
• Database access restrictions and row-level security.
• Segregation of wedding data between accounts.
• Private storage and controlled access to uploaded files.
• Rate limiting on selected public functions.
• Verification of payment notifications.
• Restricted access to administrative credentials.
• Confirmation requirements before AI-proposed changes are applied.

No internet service can guarantee absolute security.

Users should protect their account credentials, invitation links and devices, and contact us if they suspect unauthorised access.

Wedding websites created through Arch may be publicly accessible.

Couples are responsible for choosing what information to publish and should avoid sharing unnecessary sensitive details.

RSVP invitation links may grant access to household invitation information. Recipients should avoid forwarding these links to unauthorised individuals.

Arch’s current RSVP journey uses a unique household invitation link or QR code. It does not provide a public guest-name lookup or require email verification. Anyone holding a valid household link may be able to access the associated household RSVP information.

Guests and couples should keep invitation links private. Regenerating a household invitation link invalidates the previous link.

Ask Arch generates planning suggestions using artificial intelligence.

AI-generated responses may be inaccurate, incomplete or unsuitable for a particular wedding.

Users should independently verify important information, including supplier availability, prices, contractual commitments, safety information and legal requirements.

Ask Arch may use relevant wedding planning context to personalise responses.

AI-proposed changes to wedding planning information require user confirmation through the platform’s supported action process.

More information is available in our AI Usage Policy:

https://archwedding.com/ai-policy

We may send essential service communications relating to account security, payments, orders and the operation of Arch.

Where we offer promotional communications, we will comply with applicable electronic marketing laws and provide appropriate choices, including unsubscribe mechanisms where required.

You may continue to receive essential transactional or security communications even if you opt out of marketing.

Arch may link to supplier websites, music platforms, gift registries, accommodation providers and other external services.

Those services operate under their own terms and privacy policies.

We are not responsible for the privacy practices of independent third parties merely because a link appears within Arch.

We may update this Privacy Policy to reflect changes in our services, legal obligations or data processing practices.

The current version and effective date will be displayed on this page.

Where changes are material, we will provide additional notice where required by applicable law.

We will not rely on a policy update alone to justify processing that requires a separate lawful basis, consent or other legal condition.

For questions about this Privacy Policy, privacy rights or personal information processed through Arch, contact:

Arch Wedding Ltd

Email: support@archwedding.com

Website: https://archwedding.com

We aim to address privacy enquiries promptly and in accordance with applicable law.