Data processing agreement

About this agreement

This agreement is between you and Chirpee LTD, a company registered in England and Wales (company number 17320087), whose registered office is at 66 Paul Street, London EC2A 4NA, trading as wedplanner.io. It applies when you use wedplanner.io for a business, for example as a wedding planner or agency, and forms part of our terms of service.

For the plan data in your weddings, you are the controller and we are the processor. For your own account data we are the controller, as the privacy policy describes.

The processing

Subject and purpose: running your weddings on wedplanner.io, their plans, websites, guest pages and emails.

Duration: while you use the service, and then until the data is deleted as described below.

What we do: store the data, show it to the people you invite and to visitors of a website you publish, send the emails you ask us to send and the emails the service sends for a wedding, such as reply confirmations, answer the assistant questions you ask, translate the plan into the languages you choose, read the documents you ask us to read, and paint the art you commission.

Types of data: names, contact details, travel and accommodation, meal choices and dietary needs that may reveal health or religious beliefs, replies, photos, documents and messages.

People: couples, guests, the wedding party, suppliers, and your own team.

Our commitments

We process the data only on your instructions, which are your use of the product and this agreement, including for transfers outside the UK and EU, unless the law requires otherwise. If it does, we tell you first unless the law forbids it. We tell you if we think an instruction breaks data-protection law.

Everyone at wedplanner.io who can reach the data is bound to keep it confidential.

We help you answer requests from the people whose data you hold, and with any assessment or consultation the law asks of you about this processing.

We give you the information you need to show that this agreement is kept, and we allow audits by you or an auditor you choose, on reasonable notice and at most once a year unless a breach or a regulator requires more.

Security

Encryption in transit and at rest, authorisation on every request, no direct access to the database from the browser, access limited to what a role needs, and an audit trail of who changed what.

Sub-processors

You allow us to use these sub-processors: Vercel (hosting, application in Ireland), Supabase (database and files, Ireland), Clerk (sign-in, United States), Resend (email, sent from the EU), Inngest (background tasks, United States), PostHog (product analytics, EU), Sentry (error reports, EU), Anthropic (the assistant, translation, writing help and document reading, United States) and OpenAI (commissioned art only, United States).

Each is bound to obligations at least as protective as these, and we remain responsible to you for them. We email you before we add or replace one. If you object and we cannot meet the objection, you can end the service and we refund a fair share of what you paid in advance.

Paddle sells the plans as our merchant of record. It holds billing details, not the plan, and is responsible for them itself.

Transfers to the United States are covered by the EU Standard Contractual Clauses with the UK Addendum, or by the EU-US Data Privacy Framework and its UK Extension where the provider is certified.

If something goes wrong

We tell you without undue delay after we become aware of a breach affecting your data, and give you what you need to meet your own notification duty.

At the end

Before you delete a wedding or stop using the service, you can ask us for a copy of its data in a common format.

When a wedding is deleted, we keep it for thirty days so it can be restored. Then its plan is purged. Its uploaded files are not yet removed automatically: ask us and we delete them. Closing your account does not delete the weddings you belong to.

Liability

Liability under this agreement is as set out in our terms of service.