Privacy Policy

wed.cards runs the website and app at wed.cards. We are an Indian company, based in India, and we follow India's data protection law in full.

We go further than we have to. Europe's privacy rules are the strictest in the world, and we apply that same standard to everyone who uses wed.cards, wherever you live — not because a regulator makes us, but because we would rather run one high standard than a different one per country. In practice that means you can download or delete your data yourself at any time, turn off analytics with one switch, see exactly how long we keep everything, and read the name of every company that touches your information.

One important exception. When you upload a guest list, those details belong to you, not to us. You decide whose information goes in and what it is used for; we simply hold it and act on your instructions. The terms for that are in our guest data terms.

Address: HQ — Pune, India 411057
Privacy contact: support@wed.cards

How we work out your country — and why nobody else finds out. We need to know your country so we can show you the right currency, so that visitors in India see rupees and UPI rather than euros. We work this out on our own servers, using a lookup file stored inside the application. Your IP address is used for that check and then thrown away. It is never sent to an outside service, never saved against your account, and never written down in full.

We don't build profiles of you, we don't follow you around other websites, and no computer makes important decisions about you on its own.

We only use your information for things you would expect, and for nothing else. Analytics runs by default so we can see which pages help — you can switch it off whenever you like, and it stops straight away. Marketing emails only ever go out if you asked for them.

You can turn analytics off, or unsubscribe from marketing, at any time from Profile → Privacy & Data — or from our Cookie Policy page if you're not signed in. Either takes effect immediately.

We never sell your information, and we never share it so that someone else can market to you. We do share it with the companies we need to run the platform. Here is every single one, what they get, and where they are. They may only use your information to do the job we hired them for, never for their own purposes.

Adding to this list. If we ever bring in a new company that handles your information, we update this section at least 30 days beforehand. If you have a genuine concern about one of them, write to support@wed.cards and we will work it out with you.

How we work out your country, and why nobody else is involved. We used to send every visitor's IP address to an outside geolocation service just to decide which currency to show. We stopped. The app now carries its own lookup file and does that on our own servers. The company that publishes the file is deliberately not on the list above — we download it from them, and they get nothing back from us: not your IP address, not even the fact that you visited.

We will also hand over information if the law genuinely requires it — a valid court order, for example — and we will tell you when we are allowed to.

Your invitation page is public by default. Anyone with the link can open it, and search engines may find it, unless you set an access code. Please keep that in mind when adding photos or personal details.

We are based in India, and our systems are hosted in India and Europe. A few of our providers are in the United States, so some information moves between countries.

Whenever that happens, we put the strongest protection agreements available in place with the company receiving it — the same ones European businesses are required to use — and we apply them to everyone's information, not just to users in Europe. If the Indian government ever restricts transfers to a country we use, we will move or stop that processing.

You can ask us what protections apply to any particular transfer by writing to support@wed.cards.

We delete things once the reason we collected them has passed. A wedding has an end date, which makes that unusually easy for us to know, so we act on it rather than quietly hanging on. Your guests' names, phone numbers and addresses are the most sensitive information we hold, and those people never signed up with us, so we don't keep their details a year after they could possibly be needed.

You always get warned first. Nothing is deleted on a schedule without telling you. We email you at least 30 days beforehand when your wedding data or an unused account is coming up for deletion, so you can save a copy — or simply log in to keep the account going.

The one thing we keep. When you delete your account we erase everything except payment records. Indian tax law requires us to keep those for eight years, and that obligation overrides your deletion request. It is the one exception, and we would rather point it out plainly than bury it. Those records are stripped of anything identifying the moment your account goes: we remove your name, email, phone number and address, and keep only the amount, date and receipt reference. An auditor can confirm a payment happened; nobody can tell it was you.

Deleting sooner. You don't have to wait for any of these timings. Delete an archived invitation from your dashboard, or your whole account from Profile → Privacy & Data. If a guest asks you to remove their details, you can delete them from your guest list straight away.

Everything below is available to everyone, wherever you live. Most of it you can do yourself right now in Profile → Privacy & Data. None of it costs anything, and we reply within 30 days.

If something has gone wrong, or even just feels wrong, please tell us. We would far rather hear about it than have you leave quietly — we will look into it properly, and if we have made a mistake we will say so and fix it.

Who handles it. We are required to name the person responsible for answering your questions and complaints, and to publish how to reach them:

What happens, and when:

• Within 72 hours — we acknowledge your message and give you a reference number.
• Within 30 days — you get a written answer explaining what we found, what we have done, and what happens next. We hold ourselves to this strictly.
• If it is genuinely complicated — we may need longer, but we will tell you inside the first 30 days, explain why, and keep you updated. We will not just go quiet.

To help us sort it out quickly, include the email address on your account, what happened, and what you would like us to do about it.

If we still don't resolve it. Please come to us first — it is the fastest route, and what the law expects. If our answer doesn't satisfy you, or we fail to reply in time, you can escalate to the Data Protection Board of India, the authority that oversees us. Please quote your reference number.

If you are in Europe or the UK you may also contact your local privacy regulator. We should be straight with you about what that achieves: we have no European office, so no European authority supervises us directly and their powers over us are more limited than over a local company. That is exactly why we commit to the same 30-day answer and the same standard of care for you as for anyone else — what you get from us doesn't depend on who can force us.

wed.cards is for adults. You need to be 18 or over to create an account, and we ask you to confirm that when you sign up. We do not knowingly collect information about children, and we never track or advertise to them.

If your guest list or photos include a child, you are confirming you have the right to share those details with us — which for a child means their parent or guardian is happy with it. If you think a child's information has reached us when it shouldn't have, tell us at support@wed.cards and we will remove it promptly.

We use a small number of cookies to keep you signed in and the site secure — those are essential and can't be turned off while you use the service.

We also use Google Analytics and Microsoft Clarity, both on by default. They count visits and show us which parts of a page people actually use. Neither builds a profile of you: Google Analytics is set to shorten your IP address before Google ever sees it, and Clarity masks the text you type so form entries are not captured. You can switch both off with the single switch on our Cookie Policy page, or in Profile → Privacy & Data — either way they stop immediately.

We also show ads, through Google AdSense. They fund the free plan. They are not personalised: ad storage, advertising data and ad personalisation are switched off permanently in our setup, so your browsing is never used to target ads at you and we run no retargeting. Ads appear at the foot of a page, and never on a payment screen. The analytics switch does not remove them — an ad-blocker or your browser settings will, and we don't work around either.

The full list — what each cookie does and how long it lasts — is on the Cookie Policy page.

We take security seriously and we work at it continuously. Passwords are stored scrambled and can never be read back, not even by us. Everything travels over an encrypted connection and is stored encrypted. Only the few people who genuinely need access to live data have it. We run automated security testing against our own systems and keep everything patched and up to date.

What we can honestly promise. We will always take every reasonable step to keep your information safe, and we will never cut corners on it. What no service on the internet can promise — and we would rather tell you plainly than pretend otherwise — is that nothing will ever go wrong. Software has flaws, suppliers have outages, and determined attackers exist.

So: we don't guarantee the service will always be available or completely free of faults, and where something goes wrong despite our precautions, or because of an event genuinely outside our control, our responsibility is limited as set out in our Terms of Service. That is not us stepping away from our duty to look after your information — we remain fully accountable for that — it is simply an honest statement of what can and cannot be promised.

You have a part to play too. Choose a strong password, keep it to yourself, and tell us straight away if you think someone else has got into your account. In practice that is the most common way information gets exposed, and it is the one thing only you can prevent.

If your information is ever caught up in a security incident, we will tell you. Not just the regulator — you, directly. We hold ourselves to the strictest standard here: there is no “too small to mention” category, and we would rather over-inform you than quietly hope you don't notice.

We aim to notify the authorities within 72 hours of finding out, and to tell affected people as soon as we understand what happened. Alongside that we will explain what we are doing about it and what, if anything, you should do.

We are based in India. Indian law applies to this policy, and any dispute would be handled by the courts of Sangli, Maharashtra, India.

That doesn't take away rights you have where you live. Nothing here overrides the consumer protections of your own country. We're not trying to use our location to give you less — the promises on this page are made to you directly, wherever you are.

We keep a dated record of every meaningful change. If something changes that materially affects how we use your information, we will tell you by email or in the app before it takes effect — and where your permission is needed, we will ask again rather than assume.

Anything about this policy, your information, or a formal complaint: support@wed.cards — see Privacy Policy for how complaints are handled and how quickly. For anything else, write to hello@wed.cards.

Post: HQ — Pune, India 411057