This is a draft. A few details about the business are still to be filled in, where you see words in square brackets, and a solicitor is still to read it.
Privacy notice
What Posie keeps about you, why, who helps us look after it, and how to see it, change it or have it deleted.
Last updated 27 October 2026.
Who we are
Posie makes wedding and celebration websites, invitations, planning tools and a photo booth, at withposie.com and posiebooth.com. Posie is run by [LEGAL NAME], company number [COMPANY NUMBER], of [REGISTERED ADDRESS]. We are registered with the Information Commissioner's Office, number [ICO REGISTRATION NUMBER].
You can reach us about anything in this notice at [CONTACT EMAIL]. A real person reads every message, and we will answer within a month, usually much sooner.
Two kinds of people, two roles
Posie is used by hosts, the people planning a wedding or celebration, and by their guests. The law treats our part differently for each.
- For hosts, we are the controller. When you sign in, pay or write to us, we decide what is kept and why, and we answer to you for it.
- For guests, the host is the controller and we are their processor. A host adds you to their guest list and chooses what to ask you. We keep your details and replies on their behalf, only to run their event, and never for our own purposes.
A host can bring a partner onto their event. A partner is a host too: they can see and change what the host can, including your details as a guest, and they decide what is done with them alongside the host. The person who made the event stays its owner.
If you are a guest with a question about why you are on a list, or what a host asked you, it is best to ask the host first. You can always write to us too, and we will help or pass your message on.
What we keep about hosts
- Your email address, so you can sign in with an emailed link. There is no password to keep.
- What you make: your event's names, dates, places and wording, the theme and look you choose, your schedule, travel notes, budget, suppliers, checklist and seating plan.
- The photos, videos and artwork you upload.
- What you buy: which plan, when, and the price. Stripe takes the card payment. We never see or keep your full card number.
- If you add a cash fund, how guests can pay you: a bank account, an IBAN or a payment app. We keep these encrypted, show you only a masked hint once saved, and log every change.
- If you invite someone onto your event, such as your partner: their email address, who invited them and when, so we can send the invitation and recognise them when they sign in. An invitation that is not used stops working after 14 days. We also keep who is on each event, and tell everyone on it when someone joins.
- Messages you send us, and the record of emails we send for you.
What we keep about guests
Only what a host adds, or what you choose to give on your household's private page:
- Your name, and any email address and phone number the host adds, so they can send you a card or a link.
- Your replies: who is coming to which part of the day, any message you leave, songs you ask for and a note in the guestbook.
- Dietary needs and allergies, only if you tick to agree that we may keep them. These can say something about your health or beliefs, so we treat them with extra care. Untick the box and they are deleted.
- Photos and videos you add, and the ones the booth takes of you, with any name or message you type there.
- Gifts you say you are buying from a gift list, or a gift you note against a cash fund, with the amount and message you choose to give. Posie never handles the money itself.
- When you checked in on the day, if the host uses check-in.
- The language you chose to read your page in.
Guests do not need an account. Your household's link is private: anyone with it can open your page, so please do not post it publicly.
Why we use it, and on what basis
The law asks us to name a lawful basis for each use. Ours are these:
- To give hosts the service they signed up for or paid for: running your account, your event and your purchases. This is a contract with you.
- To run an event for its host: showing guests their page, taking replies and sending cards. We do this on the host's instructions, as their processor, and the host relies on their own basis, usually their legitimate interest in inviting their guests.
- Dietary needs and allergies: your explicit consent, which you can take back at any time by unticking the box.
- Keeping records of payments, as tax law requires: a legal obligation.
- Keeping Posie safe and working: stopping misuse, limiting how fast things can be sent, and fixing faults. This is our legitimate interest, and we keep it to what is needed.
We do not sell anyone's data, show advertising, or use it to profile people. We do not send marketing emails unless you have asked for them, and every one would let you stop with one click.
Who helps us, and where
A few companies run parts of Posie for us. Each works only on our instructions, under a written agreement, and keeps data secure.
- Supabase keeps the database, sign-in and stored photos and videos, on servers in Frankfurt in the European Union.
- Vercel runs withposie.com and the web app. Its servers can be in the UK, the EU or the United States.
- Netlify runs posiebooth.com and the photo booth's pages, from servers that can be in the EU or the United States.
- Resend sends our emails: sign-in links and the cards hosts send. It sends from Ireland, and can hold records in the United States.
- Stripe takes card payments. It is based in Ireland for UK customers and can process data in the United States. Stripe is also responsible in its own right for some of what it does, such as preventing fraud.
Where data goes outside the UK, it goes only to a country the UK recognises as protecting it properly, or under the UK's approved contract terms with that company, such as the international data transfer addendum.
How long we keep things
- An event, its guest list, replies, photos and videos: while the host keeps the event, and until 12 months after the event's day. Then we delete them, unless the host has asked us to keep them for longer.
- Dietary needs: until the guest unticks the box, the host removes the guest, or the event is deleted.
- A host's account: until you ask us to close it. We then delete it and your events within 30 days.
- Payment records: six years, because tax law requires it.
- The record of emails sent: as long as the event it belongs to.
- Copies held in backups: up to a further 30 days, then they are overwritten.
Your rights, and how to use them
You can ask us:
- for a copy of what we hold about you
- to correct anything wrong
- to delete it
- to stop or limit how we use it, or object to a use
- for your data in a form you can take elsewhere
- to take back a consent you gave, such as for dietary needs
Write to [CONTACT EMAIL] and tell us which event it is about, if you know. It costs nothing. We may ask you to show it is you before we act. We answer within a month. If you are a guest, we will usually involve the host, because it is their list.
If you are unhappy with how we have used your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Children
Hosts must be 18 or over. Children are often guests, though. A host may add a child's name to their household, and a child may appear in booth photos or ones guests share. We keep these only for the event, like any guest's, and hosts should take care over which pictures of children they share and with whom. Posie is not meant for children to use on their own, and we do not knowingly collect a child's email address.
Keeping it safe
Data is encrypted on its way to and from Posie, and stored in a database that lets each host reach only their own events. Bank and payment details for cash funds are encrypted again before they are stored. An invitation link can be used once, only by someone signed in with the email address it was sent to, and we keep only a scrambled copy of it. Only the few people who run Posie can reach the systems behind it, and only to look after them. If something ever went wrong that put your data at risk, we would tell you and the Information Commissioner's Office as the law requires.
Changes to this notice
If we change how we use data, we will update this page and the date at the top, and tell hosts by email before a change that matters takes effect.