Privacy Policy

Who we are

Wedlisted is an online wedding gift list. Couples publish a list of cash goals, and guests contribute money toward them. This policy explains what personal data we collect, why, and the choices you have. It covers the Wedlisted website at wedlisted.com and the service behind it.

The data controller is OWLOPT (KvK 91652200), which operates Wedlisted, based in the Netherlands. Because we operate from the European Union, the EU General Data Protection Regulation (GDPR) and the Dutch implementing law (UAVG) apply.

For any privacy question, or to exercise the rights described below, email us at privacy@wedlisted.com. We have not appointed a formal Data Protection Officer; if that changes, we will name them here.

The short version

• We collect the bare minimum we need to run a gift list: a couple's sign-in email and their list content, and for each gift the guest's name, email, an optional message, and the amount.
• Card and payment details never touch our systems. Payments are handled entirely by Stripe.
• We use no third-party analytics, no advertising pixels, and no marketing trackers. The only cookies we set are the strictly necessary ones that keep a couple signed in, so we show no cookie banner.
• You can export your data and delete your account from inside the app at any time.

What we collect and why

If you are a couple (you have an account)

• Your email address, so you can sign in and so we can send you transactional messages (receipts, contribution notifications, and account emails). Sign-in itself is passwordless and handled by our authentication provider, WorkOS, using a magic link or Google sign-in. We never see or store a password.
• Your list content: your display name, your list's web address (its slug), your currency, and the goals you create (each goal's title, optional photo, and optional target amount).
• A reference to your connected Stripe account so we can route gifts to you. See “Payments” below. We hold the reference, not your banking or card details.

Our lawful basis for this is the performance of our contract with you (providing the service you signed up for).

If you are a guest (you contribute to a list)

• Your name, email address, an optional message, and the gift amount. Guests do not have accounts and never sign in.
• Your name, message, and gift amount are shared with the couple you are giving to, which is the whole point of contributing, and the couple can see them and send you a thank-you. Your email is used for your receipt and to let the couple thank you.

Our lawful basis here is the performance of the contribution you asked to make, and our legitimate interest in letting the couple recognise and thank their guests.

Payments: your card details never reach us

All payments are processed by Stripe. When a guest gives, the payment is a direct charge on the couple's own connected Stripe account: the money settles straight to the couple and Wedlisted never holds the funds. Wedlisted takes only a small platform fee, which is added on top of the gift and paid by the guest. We never take a cut of the gift itself.

Card numbers, bank details, and other payment credentials are entered directly into Stripe and never touch Wedlisted's servers. We receive back only non-sensitive confirmation data (for example, that a payment succeeded and its amount). Stripe is the party that performs identity verification (KYC) on couples and handles refunds, payouts, and chargebacks. Stripe processes this data as an independent controller under its own terms and privacy policy, which we encourage couples and guests to read at stripe.com/privacy.

Cookies and tracking

We set only strictly necessary cookies: the session cookie that keeps a signed-in couple authenticated and a small preference (such as your light/dark theme choice). We do not use analytics cookies, advertising cookies, or any third-party tracking or marketing pixels, and we do not sell or share data with advertisers. Because we set no non-essential cookies, no cookie-consent banner is required. If we ever add analytics, we intend to use a cookieless, privacy-preserving option so this stays true.

Who processes your data (sub-processors)

We keep our supplier list short and use reputable providers. Each acts on our behalf under a data-processing agreement, except where noted that they act as an independent controller.

Some providers may process data outside the European Economic Area; where they do, transfers rely on the appropriate safeguards (such as the EU Standard Contractual Clauses). A current, detailed list of sub-processors and their locations is available on request at privacy@wedlisted.com.

How long we keep your data

We keep a couple's account and list data for as long as the account is open. When a couple deletes their account, we delete the list and its goals; deleting a list cascades to its contribution records at the database level. Contribution history is otherwise treated as immutable while a list is active, so a couple's thank-you records and totals stay accurate.

Some data may be retained longer where the law requires it. For example, Stripe and we may need to keep certain transaction records to meet tax and accounting obligations. Beyond those obligations, we keep personal data only as long as it serves the purposes described here, and delete or anonymise it once it is no longer needed.

Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you, and receive a copy of it (data portability).
• Rectify data that is inaccurate or incomplete.
• Erase your data (“the right to be forgotten”), subject to any legal retention obligations.
• Restrict or object to certain processing, and to withdraw consent where processing relies on it.

Couples can exercise the main rights directly in the app: your account settings include a data export (download your list and contribution data) and a delete account action. For anything else, or if you are a guest, email privacy@wedlisted.com and we will respond within the timeframe the law requires (normally one month).

If you believe we have mishandled your data, you have the right to lodge a complaint with your supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority).

Children

Wedlisted is intended for adults arranging a wedding and their guests. It is not directed at children, and we do not knowingly collect data from anyone under the age at which they can consent to online services under applicable law.

Changes to this policy

We may update this policy from time to time. We will post any material change here and update the “Last updated” date at the top. Continued use of Wedlisted after a change means you accept the revised policy.