Privacy Policy
Last updated: September 24, 2026
1. Who we are
Belweds (“we”, “our”, “us”) is a wedding planning platform that helps couples organise their wedding events, manage guest lists, vendor menus, RSVPs, and more. Our platform is operated from India. By using Belweds you agree to the collection and use of information described in this policy.
2. Information we collect
Information you provide directly
- Account information: name, email address, password (hashed)
- Wedding details: couple names, date, venue, events
- Guest information: names, email addresses, phone numbers, dietary requirements
- Vendor information: business name, contact details, menu content
- RSVP responses and guestbook messages
- Payment information: processed securely by Stripe — we do not store card data
Information collected automatically
- IP address, browser type, device information
- Pages visited, features used, time spent
- Error logs and performance metrics
3. How we use your information
- To provide and improve the Belweds platform
- To send you transactional emails (RSVP alerts, payment receipts, account notices)
- To allow you to share your wedding page and coordinate with guests and vendors
- To process payments through Stripe
- To detect and prevent fraud and abuse
- To comply with legal obligations
4. Vendor privacy
Vendor menus are private by default. Vendors cannot see each other's menus or pricing. Vendor menu data is only visible to the couple and — after the unlock date set by the couple — to guests of that specific wedding. We enforce these restrictions at the database level using Row-Level Security (RLS) policies.
A review you write about a vendor is public on that vendor's page and shows your first name and last initial, unless you choose to post without your name. Our team can see which account wrote a review so that abuse can be dealt with; the vendor and other visitors cannot. If you delete your account, your name is removed from the reviews you wrote.
5. Data sharing and processors
We do not sell your personal data. We share it only with the processors below, each for the stated purpose and bound by a data processing agreement:
| Processor | Purpose | Data |
|---|---|---|
| Supabase | Database, authentication and file storage (AWS ap-south-1, Mumbai) | Account, wedding, guest and RSVP data |
| Stripe | Payment processing (PCI-DSS Level 1) | Name, email, payment details — we never see or store card numbers |
| Resend | Transactional email delivery | Email address, name, email content |
| Cloudinary | Photo storage, resizing and delivery | Photos you or your guests upload |
| Hostinger | Hosting of our application server | IP address, request logs |
| Cloudflare | Network protection and delivery in front of our server | IP address, request metadata |
| PostHog | Product analytics — only if you accept the cookie banner | Pseudonymous usage events, device and browser information |
| Sentry | Error monitoring | Error reports, which may include IP address and browser information |
6. Data retention
We keep personal data only as long as we need it for the purpose it was collected for:
- Account and profile: while your account is active; erased when you delete your account (backups roll off within 30 days)
- Wedding data (events, guest lists, RSVPs, menus, photos): while the couple’s account is active; archived weddings are purged after 30 days
- Guest RSVP details: for the couple’s wedding, until the couple deletes it or the guest removes their data (anonymised immediately)
- Payment and invoice records: up to 8 years, as required by Indian tax and company law
- Security and audit logs: 12 months
- Error reports (Sentry): 90 days
- Analytics events (PostHog): up to 12 months
- Rate-limit counters: minutes to a day
7. Your rights
Under India's Digital Personal Data Protection Act, 2023 (and the GDPR where it applies) you have the right to:
- Access and portability — couples can download all their wedding data from Settings → Your data → Export my data.
- Correction — edit your details in your profile or settings, or ask us.
- Erasure — delete your account yourself from Settings (couples), Profile (vendors and family members). Guests can remove their RSVP data with the “Remove my RSVP data” link on their RSVP confirmation.
- Withdraw consent — e.g. decline analytics in the cookie banner, or turn off search indexing of your wedding page.
- Grievance redressal — contact our Grievance Officer (below), and if unresolved, the Data Protection Board of India.
- Nominate a person to exercise these rights on your behalf in the event of death or incapacity.
For anything else, email [email protected]. We respond within 30 days.
Grievance Officer
In accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and the rules made under them, our Grievance Officer is:
The Belweds Grievance Officer, Grievance Officer, Belweds. Email: [email protected]
We acknowledge grievances within 48 hours and aim to resolve them within 30 days.
8. Security
We use industry-standard safeguards: TLS encryption in transit, AES-256 encryption at rest, Row-Level Security on all database tables, and regular security audits. Passwords are never stored in plain text — Supabase Auth handles credential hashing using bcrypt.
9. Cookies
We use a session cookie (httpOnly, Secure, SameSite=Lax) for authentication. We do not use advertising cookies. Product analytics (PostHog) load only after you accept the cookie banner.
10. Children
Belweds is not directed at children under 13. We do not knowingly collect data from children. If you believe we have inadvertently collected such data, contact us to have it removed.
11. Changes to this policy
We may update this policy from time to time. When we do, we will update the “Last updated” date and, for material changes, notify you by email or in-app notice.
12. Contact
For privacy questions or data requests, contact us at [email protected] or our Grievance Officer at [email protected].