Privacy Policy

Last updated: 04 November 2026

1. Who this applies to, and two different roles

This policy covers two different relationships with personal data, and it matters which one applies to you:

If you are a couple who purchased BigDaySpy for your wedding — we are the data controller for your own account details (name, email, payment information via Stripe). You are the data controller for the photos, videos, and guest contact details collected through your game — you decide who to invite and what happens to their captures. We act as your data processor for that guest content: we store it securely on your behalf, but the decisions about collecting and using it are yours.

If you are a wedding guest — the couple whose event you're attending is the data controller for your name, email (if they sent you an invite), and any photos/videos you submit. We process that data on their behalf as described in this policy. Questions about your own data should generally go to the couple first; we're happy to help route these appropriately.

2. What data we collect, and why

Data	From whom	Purpose	Legal basis
Name, email, event date	Couple (at signup)	Provisioning your account, sending service communications	Contract (performing the service you purchased)
Payment details	Couple (at checkout)	Processing payment — handled entirely by Stripe, we never see your full card details	Contract
Guest names and email addresses	Couple (added to guest list) or guest (if they self-identify when capturing)	Sending invite emails, tracking whether an invite was opened, attributing captures	Legitimate interest of the couple / contract with the couple
Photos and videos	Guests, via the game	Delivering the core service — a shared album for the couple	Contract with the couple
Review submissions	Couple, after their event	Displaying testimonials on our marketing site, with your consent	Consent (reviews are moderated and only published if approved)
Marketing contact details	Couple, if opted in / imported from tenant list	Occasional service or product updates	Consent / legitimate interest, with an unsubscribe link on every email

3. Where your data is stored

Photos, videos, and gallery data are stored on a dedicated Nextcloud instance. Account and guest-list data is stored in a database on our web hosting. Once your download window closes, a packaged copy of your gallery may also be temporarily stored directly on our web hosting for the duration of the grace period described below, before permanent deletion. Payment processing is handled entirely by Stripe — see Stripe's own privacy policy for how they handle payment data. We do not sell or share your data with any other third party for their own marketing purposes.

4. How long we keep data

Photos, videos, and your gallery: accessible for 30 days after your Event date. At that point, if your gallery contains content, we automatically package it into a ZIP and email you a direct download link, which remains valid for a further 14-day grace period, after which everything is permanently deleted. See our Terms of Service for the full detail — this is a hard deletion, not recoverable afterwards.
Account and guest-list data: retained for the same window as above, after which the tenant record is marked deleted. Some minimal transactional records (e.g. payment confirmation) may be retained longer where we have a legal obligation to do so (such as UK tax record-keeping requirements).
Marketing contact details: retained until you unsubscribe (every marketing email includes a working unsubscribe link) or request deletion directly.

5. Your rights

Under UK GDPR, you have the right to:

Access the personal data we hold about you
Rectify inaccurate data
Erase your data (subject to the legal retention exceptions noted above)
Restrict or object to certain processing
Port your data to another service where technically feasible
Withdraw consent at any time, where consent is the basis for processing (e.g. marketing emails, published reviews)

To exercise any of these rights, contact hello@bigdayspy.co.uk. If you're a wedding guest with a question about a specific couple's use of your data, we may need to direct you to that couple first, since they are the data controller for guest-submitted content.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been mishandled.

6. Cookies

We use only strictly necessary session cookies required for admin login to function (keeping you logged in to your dashboard). We do not use tracking, analytics, or advertising cookies. See our Cookie Policy for full detail, including how to manage your preferences.

7. Security

Guest photo/video uploads are transmitted over HTTPS. Each couple's storage account is kept separate and private — guests cannot browse other guests' or other couples' galleries. Passwords are stored as salted cryptographic hashes, never in plain text. Storage account credentials used internally are encrypted at rest.

8. Children's data

This service is intended for use by adults planning or attending a wedding. It's reasonably foreseeable that photos and videos captured through the game may incidentally include images of children who are guests at the event — this is treated with the same storage and deletion safeguards as any other content, and is entirely under the couple's (the data controller's) direction as to who is invited and what's appropriate to capture.

9. Changes to this policy

We may update this policy from time to time. Material changes will be reflected in the "Last updated" date above.

10. Contact

hello@bigdayspy.co.uk