Privacy Policy

Last updated 30 October 2026

1. Who is responsible

Bridewell (the web app at bridewell.io and the Bridewell app for Android, "we") is operated by:

Bridewell is operated by Ataman Software, org. no. 938 339 317
Grønvoll allé 8 A, 0661 Oslo, Norway
contact@bridewell.io

We are the data controller for the personal data described here. Bridewell is made in Norway. This policy follows the EU/EEA General Data Protection Regulation (GDPR) as implemented by the Norwegian Personal Data Act (personopplysningsloven), and the Norwegian Electronic Communications Act (ekomloven) § 3-15 for cookies and similar storage.

2. In short

We collect only what a wedding planner needs: your account details and the wedding information you and the people you invite enter.
No advertising, no data brokers, no selling of data, no profiling.
Only strictly necessary cookies are set. Optional, cookieless usage statistics run only if you switch them on.
Your data is stored on Cloudflare infrastructure in the EU. Account emails are sent through Resend.
If you buy a plan on the web, the payment is taken by Paddle as merchant of record, in its own secure payment form shown on our checkout page (pay.bridewell.io). If you buy in the Android app, Google Play takes the payment. Either way we never see your card details; we only learn that you paid and for which plan.
The Android app uses the same account and the same servers as the web app. It contains no advertising or analytics software. It keeps your sign-in in the phone's protected storage and a copy of the wedding data you last viewed on the phone, so it can show it without a connection; signing out removes both. If something fails in the app, it sends us a short error report so we can fix it (section 3).
Deleting your account deletes the weddings you own. Deleted data is permanently erased within 30 days.
Guests who reply through an RSVP link need no account; the reply page stores nothing on their device.

3. What we process, why, and on what legal basis

Data	Why	Legal basis (GDPR art. 6)	How long
Account: name, email address, password (stored only as a salted scrypt hash), whether the email is verified, plan (free, Premium, Pro or Business), timestamps. If you sign in with Apple or Google: the account identifier that provider gives us for you and the name and email address it shares — with Apple you may share a private relay address that forwards to your own — and, for Sign in with Apple in the Apple apps, a token that lets us withdraw Bridewell's access at Apple when you delete your account (stored encrypted).	Create and secure your account, sign you in with the methods you choose, send account emails.	Contract — 6(1)(b)	Until you delete your account or remove that sign-in method. A sign-up that is never verified is deleted after 7 days.
Wedding content you enter: partner names, wedding date, venue, budget figures and currency; guests (names, email, phone, address, RSVP, side, category, plus-one, dietary notes, notes); vendors (contact details, prices, notes, contract PDFs); checklist, timeline, seating, notes, shopping and registry items; inspiration photos and captions.	Provide the planner to you and your collaborators.	Contract — 6(1)(b)	Until deleted by you or a collaborator with edit rights, then permanently erased after 30 days.
Collaboration: memberships (role, display name, module permissions, whether amounts are visible), invite links (random token, expiry, use count, who created it), activity log (who changed what and when).	Share a wedding, enforce who may see and edit what, show recent activity.	Contract — 6(1)(b); legitimate interest in accountability between collaborators — 6(1)(f)	For the life of the wedding. The activity log keeps the newest 500 entries per wedding; older entries are deleted.
Shared run sheets: a random link token, a label, an optional passcode (stored only as a salted hash), expiry, revocation, how often the link was opened and when last. Whoever holds the link sees the couple's names, the date, the venue, the timeline events not marked private, and — only if you switch it on — the business contact details (type, name, contact person, phone, email) of the vendors on the job.	Give vendors and helpers the day's schedule without an account, on your instruction.	Contract — 6(1)(b)	Until you stop sharing, the link expires, or the wedding is deleted.
Guests who reply to an RSVP link: the reply (going or not), meal choice, dietary notes, whether a plus-one comes and their name, a postal address if the couple asks for one, a message to the couple, and when the reply was sent. The link itself is a random token; there is no guest account, no cookie, and no IP address is stored with the reply (only a one-minute rate-limit counter).	Let a couple collect replies from the people they invited; the couple decides which questions to ask.	Legitimate interest of the couple and the guest in a working RSVP — 6(1)(f)	As guest data, for the life of the wedding (section 7). Links stop working the day after the wedding.
Templates (Pro): the names, phases, categories, amounts and times of checklist, budget or timeline items you save for reuse — no names of guests or vendors, no dates.	Let professional planners reuse their own plans.	Contract — 6(1)(b)	Until you delete the template, then permanently erased after 30 days.
Technical and security data: IP address and browser identifier (user agent) stored with each sign-in session — the Account page lists your signed-in devices from these; IP-based rate-limit counters; error logs, written only when something fails: the time, the request's route (without any link token or form content), its status, your account number if you were signed in and the error message — and the error reports the web and Android apps send us when something fails in them (the error and where in the app it happened, the app version, the browser or phone model and system version). Email addresses and link tokens are removed from every log line; an error message can still quote a value that was involved in the failure.	Keep sessions secure and let you see and end them, stop password guessing and abuse, find and fix failures.	Legitimate interest in running a secure, reliable service — 6(1)(f)	Sessions: 30 days after last use. Rate-limit counters: 1 minute. Error logs: up to 7 days.
Contact form: the name, email address, topic and message you send us through the contact form, and the country your request came from.	Answer your question or request. Nothing is stored in the app database; the message goes straight to the operator's mailbox.	Legitimate interest in answering people who write to us — 6(1)(f); steps at your request before a contract — 6(1)(b)	In the mailbox until your enquiry is closed, at most 24 months.
Emails: your address, the message (email verification, password reset, invitation, the reminders you switch on, and — as the Reply-To address — the guest emails you send) and delivery status.	Deliver the account emails the service needs and the reminders you asked for. We never send newsletters or marketing.	Contract — 6(1)(b)	Delivery records are kept by our email provider for a limited period for deliverability and troubleshooting.
Reminder emails and calendar feed (optional): whether daily reminders and a weekly digest are on, the weekday, the time zone your browser reports, two random tokens (for the calendar feed and the one-click unsubscribe link), and a log of each reminder mail sent — the date and kind, never the content.	Send the reminders you switched on, once and only once, within your plan's monthly allowance; keep your calendar app up to date. The feed link is a secret: anyone holding it can read the feed, so replace it in Account if you shared it by mistake.	Contract — 6(1)(b): a feature you switch on, not marketing	Settings until you change them or delete your account; the send log 90 days.
Guests the couple emails through Bridewell (Premium and above): the guest's name and email address, the couple's message, which address each email went to and whether it was delivered, and — if the guest uses the link in the email — the date they asked to get no more of these emails. The email comes from "the couple via Bridewell"; replies go to the sender's own address, not to us. Every email carries a link to stop them, which needs no account.	Let a couple send invitations and wedding updates to the people they invited, on the couple's instruction; respect a guest's wish not to be emailed again.	Legitimate interest of the couple and the guest in communication about the wedding the guest is invited to — 6(1)(f). Never marketing; only wedding messages to invited guests (Terms §8).	The message with the wedding (section 7). Per-address delivery records 90 days. The opt-out as long as the guest is on the list.
Premium purchases: your plan, the Paddle customer, subscription and transaction identifiers, purchase status and dates, the record that you confirmed the purchase terms (plan, time, country), and the notifications Paddle sends us about the purchase (status changes, refunds — amounts, currency, no card data). For a purchase made in the Android app: the Google Play purchase token and order number, the subscription's status and dates, and your Bridewell account number, which the app attaches to the purchase so we can match it to your account. For a purchase made in the Apple apps once you are signed in there: the App Store transaction identifiers, the product, the purchase, renewal and expiry dates, whether it was refunded, whether it was made in Apple's test environment, and your Bridewell account number, which the app attaches to new purchases; if you had the app before Premium existed, Apple's record of the version you first installed, which keeps Premium free for you.	Unlock Premium, keep it in step with what you paid for, handle cancellation, withdrawal and refunds, prove what was agreed.	Contract — 6(1)(b); legal obligation for accounting and consumer-law records — 6(1)(c)	Purchase history for the life of your account. Raw payment notifications for 365 days.
Usage statistics (optional): page viewed, referrer, browser and device type, country, page-load timings — aggregated, no cookies, nothing stored on your device, no identifier that links visits to you.	Understand which parts of the app are used and how fast it loads.	Consent — 6(1)(a), and ekomloven § 3-15. Off until you turn it on; withdraw any time in Cookie settings.	Kept only in aggregate.

We do not make automated decisions with legal or similarly significant effects about you, and we do not use your data for marketing. If we ever want to send you anything beyond service emails we will ask for your separate consent first (markedsføringsloven § 15).

4. Information about other people

A wedding plan naturally contains information about others: your partner, guests, vendors. You decide what to enter, and Bridewell processes it on your instructions to provide the service.

Planning your own wedding. This is a personal or household activity, which the GDPR does not regulate for you (art. 2(2)(c)). It does apply to us as the service provider, and we treat that data with the same care as your own.
Planning for clients (professional planners, agencies). You are the controller of your clients' data and we act as your processor under GDPR art. 28. Write to us for a data processing agreement.
Enter only what you need. Dietary notes can reveal health or religious information, which the GDPR treats as special categories (art. 9). Record them only where needed for the event and remove them when the event is over.
Collaborators see what their role allows and nothing more. As owner you control invitations, roles and removal.
Shared run sheets pass on vendors' business contact details only if you switch that on. Use a passcode and a short expiry, and stop sharing after the day.
Guests who reply through a link see only their own household's names and answers — never anyone else on the list, never addresses or notes. You choose which questions are asked; a link can be revoked or replaced at any time.

5. Who can see your data

People holding a link you shared — a run sheet or an RSVP link — see only what that page shows, for as long as the link works.
Your collaborators, according to the role and module permissions you give them. Money amounts are hidden from anyone without financial access — the server never sends them.
The operator, only when needed for support you ask for, for security investigations or to meet a legal obligation — never routinely, and never for browsing your content.
Our processors listed in section 6, who act only on our instructions.
Authorities, if we are legally required to disclose.

We do not sell personal data and we show no advertising.

6. Processors and where data is stored

Provider	What they do for us	Where	Transfer safeguard
Cloudflare, Inc.	Hosting, edge network, database (D1), file storage (R2), server logs; bot and abuse protection on every request (a small security script served from our own domain, and a security cookie only when a check is needed); a human check on the contact form (Turnstile) when enabled; optional usage statistics (Web Analytics)	Database and files are stored in Cloudflare's Eastern Europe (EU) region. Requests are handled at the Cloudflare data centre closest to you.	EU–US Data Privacy Framework certification and EU Standard Contractual Clauses (Cloudflare Data Processing Addendum)
Resend, Inc.	Sending account emails (verification, password reset, invitations), the reminder and digest emails you switch on, and the emails couples send their guests (guest names, addresses and the message)	United States	EU–US Data Privacy Framework certification and EU Standard Contractual Clauses (Resend Data Processing Addendum)

Payments — Paddle, merchant of record

Premium is sold by Paddle (Paddle.com Market Limited (UK) and Paddle.com Inc. (US)) as merchant of record: it runs the payment form (shown inside a frame on our checkout page, pay.bridewell.io), collects the payment and the applicable VAT or sales tax, issues the receipt and processes refunds. For that purpose Paddle is an independent controller of the data it collects at checkout — name, email address, billing country and address, payment method details, tax identifiers — under its own privacy policy. We receive from Paddle only what is needed to unlock and manage your plan (identifiers, plan, status, dates and amounts — never your card number). Location: United Kingdom (EU customers) and United States (US customers); card data is processed by Paddle's PCI-DSS certified payment partners. Transfer safeguard: UK adequacy decision (EU→UK); EU Standard Contractual Clauses and the EU–US Data Privacy Framework for any US processing.

Payments in the Android app — Google Play

In the Android app, plans are bought through Google Play. Google runs the payment, collects the applicable tax, issues the receipt and processes refunds, and is an independent controller of the data it collects for that under its own privacy policy. We ask Google about a purchase using its token, and Google tells us about changes (renewal, cancellation, refund). We receive only what is needed to unlock and manage your plan — never your card number or billing address.

Payments in the Apple apps — App Store

In the Bridewell apps for iPhone, iPad and Mac, plans are bought through Apple's App Store. Apple runs the payment, collects the applicable tax, issues the receipt and processes refunds, and is an independent controller of the data it collects for that under its own privacy policy. When you are signed in to your Bridewell account in those apps, the app passes us Apple's signed record of your purchases, which we check against Apple's certificate before we rely on it, and Apple tells us about changes (renewal, cancellation, refund). We receive only what is needed to unlock and manage your plan — never your card number or billing address.

Signing in with Apple or Google

You can sign in with Sign in with Apple or Sign in with Google instead of, or as well as, an email address and password. The provider runs that sign-in and is an independent controller of the data it processes for it (see the Apple and Google privacy policies). We receive the identifier the provider uses for you with Bridewell, your name and the email address you choose to share, nothing else — no contacts, no other account data. If you use Apple's Hide My Email, our emails reach you through Apple's relay. You can remove a sign-in method in your account settings, and deleting your account withdraws Bridewell's access at Apple.

No one else receives personal data.

7. How long we keep data

Situation	Retention
Your account	Until you delete it (Account → Delete account).
A sign-up that never verified its email	Deleted after 7 days, together with its credential rows. It could never sign in and holds no wedding data.
An archived wedding	Kept read-only for as long as your account exists; deleted with your account or when you delete it.
A guest, task, photo or other item you delete	30-day grace period during which we can restore it on request, then permanent deletion of the record and any file.
A wedding you delete	30-day grace period, then permanent deletion of everything in it, including photos and contracts.
You delete your account	Sign-in data is removed immediately. Your memberships in other people's weddings are removed immediately. The weddings you own are deleted and permanently erased within 30 days.
Sign-in sessions	Expire 30 days after last use and are then deleted, including the IP address and browser identifier they carry.
Error logs and error reports	Up to 7 days.
Reminder send log	90 days (date and kind of each reminder mail, never its content).
Activity log of a wedding	The newest 500 entries; older entries are deleted nightly.
Guest email delivery records	90 days (which address, sent or not). The message itself and its totals stay with the wedding.
Premium purchases	Your purchase history stays with your account and is deleted with it. Raw payment notifications from Paddle, Google Play and the App Store are deleted after 365 days. Paddle, Google and Apple keep their own transaction records as the sellers for as long as tax law requires them to.
Database backups	Rolling point-in-time backups that roll off within 30 days.

8. Security

All traffic is encrypted (TLS with HSTS). Passwords are hashed with scrypt and never stored in clear text. Session cookies are HttpOnly, Secure and SameSite. A strict Content Security Policy blocks third-party scripts in the app; the one exception is Paddle's checkout script, which runs only on the separate checkout page (pay.bridewell.io) and may load nothing but Paddle's payment form. Every request is checked against your membership and permissions on the server; files are stored in a private bucket, are accepted only when their content matches the declared type, and are streamed only after that check in a sandbox that cannot run script. Cloudflare screens every request for automated abuse (see the Cookie Policy). Requests that change data are accepted only from our own pages and apps. Common and easily guessed passwords are refused; the Account page lists your signed-in devices and can sign out any of them; changing or resetting your password signs out every other device, and deleting your account requires your current password. Card details never touch our servers: payment happens in Paddle's PCI-DSS certified checkout frame, and every message Paddle sends us is cryptographically signed and verified before it changes anything. Sign-in and other endpoints are rate limited, and email addresses must be verified before an account can be used. No system is perfectly secure — if you find a weakness, please tell us at contact@bridewell.io. If a breach is likely to put your rights at high risk we will inform you and Datatilsynet (the Norwegian Data Protection Authority) as the GDPR requires (art. 33–34).

9. Your rights

You have the right to:

access the personal data we hold about you and receive a copy;
rectify inaccurate data;
erase your data ("right to be forgotten");
restrict or object to processing based on legitimate interest;
data portability — receive your data in a structured, machine-readable format;
withdraw consent at any time where processing is based on consent (this does not affect what happened before);
complain to a supervisory authority.

Much of this you can do yourself: change your name and appearance settings, edit or delete any entry, remove collaborators, sign out of all devices by changing your password, delete your account, and change cookie choices — all in the app. You can also download your data yourself, at any time and on every plan: Account → "Download my data" gives you a JSON file with your profile, every wedding you own, your templates, your plan and your sign-in sessions (data portability, art. 20); each wedding's Settings → Export gives you that wedding as PDF or Excel reports, JSON, each section as CSV and the schedule as a calendar file. PDF and Excel reports are prepared in your browser from the data you can access; export preparation does not upload it elsewhere. For anything else, a data processing agreement, or a copy in another form, email privacy@bridewell.io from the address on your account. We answer within one month (GDPR art. 12(3)) and never charge for a first request.

If you believe we handle your data unlawfully you can complain to Datatilsynet (the Norwegian Data Protection Authority), Postboks 458 Sentrum, 0105 Oslo, Norway, www.datatilsynet.no. If you live elsewhere in the EU/EEA you may instead contact the authority in your own country.

10. Children

Bridewell is for adults: you must be at least 18 to create an account. We do not knowingly collect data from anyone younger. If you believe a child has created an account, write to us and we will remove it.

11. Cookies and on-device storage

Described in full in the Cookie Policy. Summary: only strictly necessary cookies and storage by default; optional statistics only with your consent; no tracking cookies ever.

12. Changes to this policy

We will post any changes here with a new date. If a change is significant — new purposes, new categories of data or new recipients — we will tell you in the app or by email before it takes effect.

13. Contact

Bridewell is operated by Ataman Software, org. no. 938 339 317
Grønvoll allé 8 A, 0661 Oslo, Norway
contact@bridewell.io