Skip to main content

Privacy Policy

Last updated 30 September 2026. This describes how Medding ("Medding", "we", "us"), actually handles data today: what the product genuinely does, not a generic template.

Who is responsible for your data

Medding is the data controller for accounts (couples', planners' and vendors'), payment records, the public vendor directory, and what you send to Medding itself, such as a support ticket or a business's request to be listed. For the wedding data a couple or planner adds to a workspace (the wedding and its events, guests and their contact details, invitations, RSVPs and the answers guests give, the website, photos, tasks, budget and vendors), the workspace owner decides what is added and why. They are the controller of that data, and Medding processes it on their behalf, as their processor.

What processing on a couple's behalf means

For a workspace's wedding data, Medding:

  • uses it only to run the parts of Medding the workspace uses (showing the couple's website to their guests, recording RSVPs, sending the invitations and reminders the couple sends, and so on), and never for its own purposes, for advertising or to profile anyone;
  • shows it only to the workspace's members, as their role allows; to the guests the couple invites, each of whom sees only their own invitation; and to anyone who opens the couple's published website, for the sections and events the couple shows publicly. Medding's staff console shows a wedding's overview (the couple's names, the date and location, the guest numbers they estimated, the website's address and status, its events and their dates, its members and their roles, and its billing), the support tickets its members send us, and the vendors it has messaged through the directory. It does not show the guest list, guests' contact details, RSVPs or messages;
  • protects it as the Security section below describes;
  • lets the workspace owner or partner export all of it, and the owner delete it, at any time, as Data export and deletion below describes;
  • relies on two kinds of provider to do this: the hosting provider whose servers hold the database and uploaded files, and the SMTP relay that delivers the emails Medding sends.

What we store

  • Your account: your name, email address and phone number, your password (hashed, never stored as you typed it) and, if two-step sign-in is on, your authenticator secret and backup codes, stored encrypted. For each signed-in session, the IP address and browser it came from, which your account page shows you (the address only roughly), and from which you can sign any of them out. If you belong to more than one wedding, which of them you used last, so that Medding opens it next. Invitations you send to join your workspace: the invited email address, the role and who sent it.
  • Wedding data: your wedding and event details, your guest and invitation records (including any phone number or town you add to tell guests apart, and when each guest last opened their personal invitation link), guests' RSVPs, the names of the people they bring and the answers they give, your website's content, your tasks, budget and vendor records, and uploaded files. Uploaded files are stored on the servers Medding runs, not with a third-party media host.
  • Payments: for each purchase or subscription, and each payment for a directory listing upgrade, what was bought, its price, any discount and the amounts (the VAT Stripe collected among them), any refund or dispute and how it ended, which member of the workspace bought it, when they agreed that the plan starts at once and to which wording, the plan an upgrade was bought from, and Stripe's references for the customer, the checkout last opened, the payment, the invoice and any dispute. Never card details, and not the billing address or tax ID you give Stripe at checkout, which Stripe keeps. For a plan our staff activate for a payment made another way (a bank transfer, cash, or a complimentary plan), how it was paid, its reference, why, and which of our staff recorded it. For a checkout that used a discount code, which workspace's checkout held the code and whether it was paid. We also log each payment notification Stripe sends us: its Stripe reference and type, whether it came from Stripe's test or live mode, when it arrived, whether we processed it and, if we couldn't, why.
  • Vendors: a directory listing's business details and photos, which are public; the account of a business that claims its listing; the details a business sends us through “List your business”; messages and quotes between couples and vendors; and the reviews couples write.
  • Support tickets and their messages.
  • Security records: an audit log of sensitive actions (who did what, and when), and counts of recent requests from each IP address, used to slow down repeated attempts to sign in or guess an invitation.

Why we process it

We process account and wedding data to provide the service you've signed up for (performance of a contract), to keep the service secure and prevent abuse (legitimate interest), and to meet our legal obligations, such as answering a valid legal request (legal obligation). A couple who adds guests' details does so under their own lawful basis for organising their wedding, and we process that data only as their processor, to operate the service.

Guest data is never advertising inventory

Guest lists, contact details, and RSVP responses are never sold, shared with advertisers, or used to build marketing profiles. There is no third-party analytics or tracking script on Medding.

Who can see what

A wedding's data is visible to the members of its workspace, scoped to their role, and to Medding's staff only as the section above describes; its guests, and visitors to its website, see only what the rest of this section describes. Guests' email addresses and phone numbers are visible only to the couple and the planners and family members they give guest-management access; a member with view-only or collaborator access sees guests' names without them, and a vendor member never sees the guest list. The same goes for guests' dietary needs, whether written on their guest record or given in their RSVP. Guests' other RSVP answers are visible to every member who can see the replies, view-only and collaborator access included. When a guest replies by phone, in writing or in person, a member who manages the replies can record it for them; the reply then shows who recorded it and how the guest gave it. Guests never receive accounts. They reach their own invitation either by opening a private, revocable link, or by entering their full name on the wedding's website; a name lookup is rate-limited, returns only that guest's own invitation, never reveals whether any other name exists, and asks for one extra detail (such as a town) when two guests share a name. Because a name is not proof of who someone is, a guest found by name sees only whether they and their companions are coming, never their earlier answers or their companions' names; those appear only through the personal link. The email confirming an RSVP lists the guest's answers and links back to their personal link only when it goes to the guest's own email address; one sent to an address they share with their group only thanks them. A guest invited only to one event never receives the details of an event they weren't invited to (its name, date, venue, deadline or RSVP questions), at any layer, including the API. Words the couple writes themselves, in a section of their website, an RSVP question or an email's message, reach whoever the couple shows or sends them to, and can mention an event that reader isn't invited to. Someone who opens a wedding's website without an invitation sees none of its events unless the couple has chosen to show that event publicly, and photos on the site reach only the visitors who can see the section they are in. A couple can also switch the name search off, so that guests can reach their invitation only from their personal link.

When a guest opens their personal link, Medding records the time on that link: only the latest time, with no history, and never where it was opened from or on what device or browser. A messaging app fetching the link to show its preview doesn't count. It is shown beside each guest on the wedding's Invitations page, to the members who can see both that page and the guest list (the couple, their planners, and family members or viewers they give that access), so they know who has opened their invitation. A link to a wedding's website, personal or not, previews in a messaging app with only what the website shows everyone: the couple's names, and the date, place and photo of its opening section when that section is public. A preview never names the guest or any event.

Who we share data with

We use a small number of specific providers, and don't sell or rent your data to anyone: Stripe processes payments (at checkout we send it your email address and a reference to your workspace, and Medding never sees or stores your full card details); an SMTP relay delivers the emails Medding sends (sign-up and password emails, workspace invitations, guest invitations and reminders and the tests of them members send to themselves, RSVP confirmations, purchase receipts, subscription confirmations and notices of new vendor messages), and is not a marketing platform; and our hosting provider runs the servers that hold the database and uploaded files. We disclose data to anyone else only where the law requires it, such as in response to a valid legal request.

International transfers

Stripe, our hosting provider and our email relay may process personal data outside the UK and the EEA. Where they do, that transfer needs a recognised safeguard, such as an adequacy decision or standard contractual clauses. Email hello@medding.org to ask which providers we use, where they process data and which safeguard applies.

How long we keep data

We keep your data for as long as your account and workspace exist: nothing is deleted because it hasn't been used for a while. If a wedding workspace is deleted, its data and uploaded files are removed as described below. Apart from the periods this page names, we haven't set fixed retention periods.

Payment records: each purchase and subscription is part of our accounting records, which we keep for tax and accounting purposes (a legal obligation), so deleting a workspace doesn't delete them. They are kept without the workspace, and without anything that could name the couple or their guests: what stays is what was bought and at which price, any discount used, the amounts, the currency and VAT, any refund or dispute and how it ended, the plan an upgrade was bought from, when the buyer agreed that the plan starts at once and to which wording, the dates, the status, Stripe's references for the customer, the checkout, the payment, the invoice and any dispute, and, for a payment made another way, how it was paid and which of our staff recorded it. Which member of the workspace bought it is deleted, and so are a payment's reference and our staff's reason for it. The workspace's billing account is deleted with the workspace, and with it the manual grants our staff made to it (an allowance added to its plan by hand, such as more guests); a plan our staff activated for a payment made another way is a purchase, and is kept like any other. We keep each record for six years after the end of the UK financial year (1 April to 31 March) of its last transaction, and a daily task then deletes it: for a purchase, the latest of its payment, its refund and its withdrawal by our staff; for a subscription, the later of the start of its last billing period and its cancellation; and for either, if it had none of those, when it was made. The log of Stripe's payment notifications has no link to any workspace, so deleting a workspace leaves it in place, except that the reason we recorded for a notification we couldn't process is deleted if it names the workspace. Each notification is deleted six years after the end of the financial year it arrived in. Medding doesn't store invoices: Stripe makes one for each purchase, as it does a subscription's, and keeps it with its own records of the payments it processes, under its own terms; we keep only its reference, and link to it from the receipt we email. A discount code's record of the checkouts that used it stays when a workspace is deleted, no longer linked to it; a referral reward, which belongs to the workspace it was given to, is deleted with that workspace, and its record with it. What a business pays for its directory listing is kept with the listing.

We keep paired backups of the database and uploaded files for disaster recovery only. Our backup job removes each backup at its first successful run after the backup is more than 14 days old, so deleted data can remain in a backup until then.

Data export and deletion

From Workspace settings, a workspace owner or partner can download a complete export of a wedding at any time, as a zip file. It holds a data.json file with the wedding and its events, members and pending member invitations, households, guests and the companions they add, every RSVP (including companions' replies), invitation links (when they were issued, used, last opened or revoked, never the link itself), invitation campaigns and their recipients, the test invitation emails members sent themselves, seating, tasks, budget, vendors and conversations with vendors, website content, gallery photo details, support tickets, guest list imports and their results, when guests unsubscribed from invitation emails, the wedding's activity and audit history, and its purchase history, with how each purchase was paid; alongside it, the actual photos and files uploaded to the wedding.

Anyone with a Medding account, couples, planners and vendors alike, can download their own account data: their profile, the workspaces they belong to, the support tickets they opened and any other support messages they wrote, the messages they wrote in vendor enquiries and any vendor reviews they wrote, and, for a vendor, their claim, the quotes they sent and the listing they manage with its cities and photos. The export holds only what you can still see in Medding: a ticket comes with its replies while you can still open that wedding's support tickets, and a quote with the couple's response while you still manage the listing. If you've been removed from the wedding, your role no longer shows its support tickets, or your listing access is suspended, it keeps only what you wrote yourself. Planners find this under Workspace settings, vendors under Your account in the vendor portal.

Members who can see a wedding's RSVPs can also download one event's replies as a spreadsheet file (CSV): everyone coming, with the answers they gave. Guests' contact details and dietary needs are in it only for a member who may see them, and so is the event's dietary list for the caterer.

Exports never contain passwords, sign-in sessions, or the secrets behind invitation links, and each one is recorded in our audit log with who asked for it and when.

The couple, their planners and family admins can delete a guest. Deleting a guest removes them at once, with their event invitations, RSVPs (and the replies of anyone they added), tags, seats and personal invitation links. A campaign keeps its record of the invitations it sent, which is who each one went to, at what address, for which events and whether it arrived, as part of the wedding's history, and nothing more is sent to a guest once they are deleted, not even the confirmation of an RSVP still waiting to go out. Photos a guest added to the wedding's gallery stay in it, no longer linked to them, until the couple removes them. If a guest unsubscribed from invitation emails, we keep a one-way fingerprint of their email address (never the address itself) for that wedding, so adding them to the list again never starts the emails again; it is deleted with the workspace. A guest list imported from a CSV file is kept only until its guests have been added; for any row that could not be added, or was added with a note to check, the name it gave and the reason are kept until you dismiss the import's results or import another file.

The couple and their planners can delete a vendor from the wedding's vendor list, or one of the contracts and quotes kept with it. Deleting either removes it at once: no one can open the files from then on, and a background task deletes them from storage straight afterwards. Conversations with a vendor from the directory, and a review you published of them, belong to the wedding and to the vendor's listing rather than to your vendor list, so they stay.

Only the workspace owner (not a partner or planner) can permanently delete the whole workspace, and not while it still has a subscription running: that has to be cancelled first. Its records are deleted at once, apart from its purchase and subscription records, which are kept for the accounts as How long we keep data describes, and its uploaded files are deleted from storage by a background task straight afterwards. Our audit log records that a workspace was deleted, and by whom, but not its name or web address, and the entries it kept about what was done in the wedding, like our staff's entries about it (a plan they activated, or a manual grant), keep only what was done, by whom and when, none of the details. Anyone can delete their own Medding account, including a vendor who never joined a wedding. Both are self-service, with no email required, and both ask for your password again first. Account deletion is blocked while you're the only owner of any workspace, not just the one you're looking at, so no wedding is left without an owner; we list those workspaces so you can make someone else an owner or delete them first.

When you delete your account we delete your sign-in, sessions and memberships, and cancel any emails still queued to you. What you wrote inside a wedding, such as tasks, messages, support tickets or a review, belongs to that wedding and stays with it, without your name. If you managed a vendor listing, it's unlinked from you and hidden from the directory; its business details stay with us so couples who contacted you keep their conversation history, and we'll remove the listing completely if you ask. Our audit log records that an account was deleted, but not its email address. For anything these tools don't cover, email hello@medding.org and we'll act on it directly.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, and to object to or restrict certain processing. The export and deletion tools above cover most of these directly and immediately; for anything else, or if you're not satisfied with our response, email hello@medding.org — UK/EU residents also have the right to complain to their local data protection authority (the ICO, in the UK). If you are a guest, the couple who invited you controls your wedding data: ask them first, or email us and we'll pass your request on.

To ask us for a copy of what we hold about you, or to have it erased, email hello@medding.org from the address we hold for you, or write to us at the same address with your name, and say which you want. We log every request, answer within 30 days of receiving it, and tell you what we did. A copy contains your own records only, and only the events you were invited to, never another guest's details. Erasing a guest removes their record, invitations, replies, seats and personal links, and a household they were the only member of; queued emails to them are cancelled, and we keep a one-way fingerprint of their email address so they are never emailed by that wedding again. The wedding's own financial, billing and audit records, which hold no guest details, are kept.

Security

Passwords are hashed, never stored in plain text. Sessions use secure, same-site cookies. Medding staff, and anyone who turns it on, sign in with a code from an authenticator app as well as a password, and resetting a password signs out every device; changing it from your account page signs out every device but the one you changed it on. Changing your email address takes effect only once you open the link we send to the new address, and we tell the old address that the change was asked for. An invitation to join a workspace is a single-use link that only the invited email address, once verified, can accept; until then it shows nothing about the wedding. Access to a wedding's data always passes through server-side authorization tied to workspace membership — never a client-side check alone. Guest invitation links use random, hashed, revocable tokens, not guessable IDs. Uploaded files are validated and stored outside any publicly browsable directory. Every photo is re-encoded when it is uploaded, which removes the location (GPS) and camera details a phone writes into the file, so a guest's photo never publishes where it was taken.

Cookies

Medding sets only the cookies it needs to work. All of them are its own, and none is used for analytics, advertising or tracking:

  • medding.session_token (named __Secure-medding.session_token on a secure connection) keeps you signed in. It holds a random, signed session token; scripts on the page can't read it (HttpOnly), requests other sites make in the background don't carry it (SameSite=Lax) and, on a secure connection, it is sent only over HTTPS. It lasts 30 days, renewed at most once a day while you use Medding, and signing out removes it.
  • medding.sign_up_binding (__Secure-medding.sign_up_binding on a secure connection) is set when you create an account. It holds only a random value, which lets the verification link sign you in on the device and browser that signed up, and it expires after seven days. Like the session cookie, it is HttpOnly and SameSite=Lax, and on a secure connection it is sent only over HTTPS.
  • medding.two_factor (__Secure-medding.two_factor on a secure connection), if two-step sign-in is on, holds a signed, random reference to your sign-in for up to ten minutes while you enter your code, then is removed. It is HttpOnly and SameSite=Lax too, and on a secure connection it is sent only over HTTPS.
  • medding_referral is set when you open Medding from a referral link (an address ending in ?ref= and a code). It holds only that code, so that the wedding workspace you go on to create is credited to the couple who sent you the link, and it is removed as soon as that workspace is created, or after seven days. It is never used for a workspace you already have. It is HttpOnly and SameSite=Lax, and sent only over HTTPS on the live site.
  • medding_guest_ followed by the wedding's address is set when a guest finds their invitation by typing their name on a wedding's website, so that the website remembers their invitation on that device for two hours. It holds a random token, never a name or contact details; it is HttpOnly and SameSite=Lax, sent only over HTTPS on the live site, and its path is the whole of Medding (/), so that the wedding's photos, which load from their own addresses, receive it too. “Not you?” on the response form removes it, together with any medding_rsvp_ cookie, the older name for the same cookie, which Medding no longer sets.

Children's data

Medding accounts require the account holder to be at least 18 (see our Terms of Service). A guest record may describe a child (for example, a family member added to an invitation when responding), but that record is basic attendance information supplied by the adult who holds the invitation, not an account or profile belonging to the child.

Changes

If how we handle data changes in a way that matters to you, we'll update this page and its date and, where practical, tell you directly.

Questions? Email hello@medding.org.