Privacy policy

1. Who we are

Handfastly is run by BIVERIO STUDIOS LTD, a company registered in England and Wales (company number 17162474), registered office: 6-7 St Mary At Hill, London EC3R 8EE, United Kingdom. We are registered with the UK Information Commissioner's Office (registration number ZC215138) and are the data controller for account, billing and website data.

Couples and photographers decide which guest details to request (for example meal choices or custom RSVP questions). For guest data we act on their behalf, and they are responsible for what they ask their guests.

Contact for anything about privacy: support@handfastly.com

2. What we collect

• Account: your name, email address, password (stored only as a secure hash), language, plan and payment status. Card details are handled by Stripe; we never see or store your full card number.
• Content you add: wedding and gallery details such as names, dates, venues, texts, music, photos and videos.
• Guest replies: name, attendance, number of guests and plus-ones, meal choice, dietary notes, answers to the couple's questions, messages, seat, and email or phone if the couple asks for them.
• Guest Moments: photos, videos, voice notes and texts guests upload, plus the name and caption they choose to add.
• Technical data: server logs (IP address, browser, pages requested) used to keep the service secure and fix errors.
• Where you came from: if you arrive through a link with a referral or campaign tag, we store that tag with your account when you sign up.

3. Why we use it and our legal basis

• To provide the service you signed up for: contract.
• To keep Handfastly secure, prevent abuse and improve it: legitimate interests.
• Analytics and advertising cookies: your consent, which you can withdraw at any time.
• Keeping billing records: legal obligation.

Dietary notes can reveal health or religious information. Guests give them voluntarily and only the couple who invited them can see them. Couples should only ask for what they need.

4. Cookies and analytics

We always store a few things in your browser that the site needs to work: your login, language, your cookie choice, and the referral tag from section 2.

Google Analytics and the Meta Pixel load only after you click "Accept" on the cookie banner. They run only on our marketing, demo, sign-up and checkout pages, never on guests' invitation, RSVP, gallery or Guest Moments pages, and never inside your dashboard. They tell us which ads and pages bring people to Handfastly. Google and Meta process this data under their own privacy policies.

If you accept and then create an account or buy a plan, our server also tells Meta about that sign-up or purchase directly, so we can measure our ads even when your browser blocks the Pixel. It sends a hashed (scrambled) copy of your email and account ID, your IP address, browser details and Meta's browser cookie. It never sends your name, your wedding or your guests' data. If you decline, or change your choice later, this stops.

You can change your choice at any time with "Cookie settings" at the bottom of the home page.

5. Who we share data with

We do not sell personal data. We share it only with providers that help us run Handfastly:

• Google Cloud: hosting, file storage and backups.
• MongoDB Atlas: database.
• Stripe: payments.
• Resend: sending emails.
• Google and Meta: analytics and advertising, only with your consent.

Guests' replies and uploads are visible to the couple or photographer who invited them. Invitation, gallery and Guest Moments pages can be opened by anyone who has the link, so share links only with people you trust.

6. International transfers

Our servers are in the United States. Transfers from the UK and EU are protected by the UK International Data Transfer Addendum and EU Standard Contractual Clauses, or by the EU–US Data Privacy Framework and its UK extension where the provider is certified.

7. How long we keep data

• Accounts: for as long as the account exists.
• Galleries and their guest uploads: until the gallery's end date, then 7 more days, after which they are permanently deleted. We email the owner before that happens.
• Lapsed studio subscriptions: content is kept for 7 days so you can renew, then permanently deleted after a final warning.
• Backups: deleted data disappears from our backups within about 120 days.
• Billing records: as long as UK tax law requires (currently 6 years).

8. Your rights

You can ask us to access, correct, delete, restrict or export your data, object to how we use it, or withdraw consent. Email support@handfastly.com and we will reply within one month.

Guests can contact the couple who invited them or write to us directly.

If you are unhappy with our answer, you can complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority in your country.

9. Security

All traffic is encrypted (HTTPS), passwords are stored as secure hashes, and access to production data is limited to the people who run Handfastly.

10. Children

Handfastly accounts are for adults. We do not knowingly create accounts for anyone under 18.

11. Changes

If we change this policy we will update the date at the top, and tell account holders by email about important changes.