Privacy Policy

Last updated: 9 June 2026

1. Introduction

This app is a private, invitation-only platform for a specific wedding. It is built and operated by Merchiston & Grant Ltd (“we”, “us”), who act as both the data controller and the data processor for information you share through it.

Access is strictly limited to guests invited by the event administrators. This policy explains what we collect, why, who can see it, and the rights you have.

2. Information we collect

Your name (first and last), used to introduce you to other guests.
Your email address and/or mobile number, used only to deliver sign-in links and, if you opt in, notifications.
An optional profile photo you choose to add.
Content you post in the app: photos, videos, comments, guest-book messages, quiz answers, and wagers.
A device push-notification token, if you grant permission.
If you order photo prints: the delivery name and postal address you enter, and a record of your orders (the items, the amounts charged, and order/tracking references). Your payment card details are entered directly with our payment processor (Stripe) and are never seen or stored by us or by the app. See section 5b.
Limited technical information at sign-in (IP address, device user-agent) for security and abuse prevention.
If you submit a bug report from within the app: the description you type, an optional screenshot, and a small set of device diagnostics (iOS version, device model, app version/build, locale, timezone, screen size, and available memory). See section 10 for how this is handled.

3. Why we collect it

To sign you in via magic link (email or SMS).
To display your content to the other verified guests of this event.
To send you notifications about the event if you have opted in.
To take payment for, produce, and deliver any photo prints you order.
To keep the app secure and to investigate misuse.

We do not run third-party analytics, advertising, or social-sharing tools in the app.

4. Who can see your information

Content you post is visible to other verified guests of this wedding. The event administrators and any photographers with administrative roles have broader read access so they can moderate content and assist guests.

We do not share your personal data with any third parties except the infrastructure and operations providers we use to run the app. These providers process data on our instructions only:

Heroku (Salesforce) — application hosting and database.
DigitalOcean Spaces — storage for your photos, videos, and other uploaded media.
Resend — transactional email delivery (sign-in links, admin alerts).
Twilio — SMS delivery of sign-in links, if you chose to sign in by phone.
Apple Push Notification service and Google Firebase Cloud Messaging — delivering push notifications, if you opted in.
Stripe — only if you order prints: securely processing your card or wallet payment. See section 5b.
Prodigi — only if you order prints: producing and posting them. They receive the photo you chose and your delivery name and address. See section 5b.
Google (Places) — only if you use the address auto-complete when ordering a print: what you type in the address field is sent to Google to fetch matching address suggestions.
Productive.io — only for bug reports you choose to submit from the in-app “Report a problem” screen. See section 10 below for exactly what is sent.

5. Sharing photos and videos

By sharing photos or videos on this app, you agree that other verified guests may view, download, and print them for their own personal use in connection with this event.

5a. Speech wager

The app includes a “Speech wager” feature where guests can log a guess at how long the speeches will run and a notional stake to add a bit of fun. This is a social guessing game, not a gambling product. No money is collected, held, or transferred by the app, and we take no commission. Any settlement that guests choose to make between themselves is an entirely offline, private arrangement and is not facilitated by the app.

5b. Ordering photo prints

The app lets you order physical prints, canvases, and framed prints of photos from the event. This is an optional, paid service operated by Merchiston & Grant Ltd. When you place an order:

Delivery address. We collect the recipient name and postal address you enter (or, if you pay with Apple Pay or Google Pay, the address you authorise from your device wallet) so the prints can be shipped to you.
Payment. Card and wallet payments are processed by Stripe. You enter your card details directly with Stripe — they are never seen or stored by us or by the app. We pass Stripe a small set of order details (the amount, an order reference, the wedding, your name and email, and which photos were ordered) so the payment can be reconciled and a receipt issued.
Fulfilment. To produce and post your prints, the photo(s) you chose and your delivery name and address are sent to Prodigi, our print-and-ship partner. Prodigi process this only to fulfil your order, under their own privacy policy.
Address suggestions. If you use the address auto-complete, the text you type in the address field is sent to Google Places to return matching suggestions.
Order records. We keep a record of your orders (items, amounts, and order/tracking references) for accounting, tax, and customer-support purposes for as long as the law requires.

Stripe (privacy policy) and Google (privacy policy) each process this data as described above. You are only asked for an address and payment if you choose to order a print — browsing and sharing photos never requires either.

6. Reporting content

If you see anything in the app — a photo, video, comment, message, wager note, or another guest’s profile — that you believe is inappropriate, abusive, or shouldn’t be here, you can report it from within the app. Tap the “…” menu on the item and choose Report, and optionally add a short note telling us what’s wrong.

We commit to reviewing every report within 24 hours and taking appropriate action — which may be removing the content, asking the person to change it, or revoking their access. In urgent cases you can also email us directly at abuse@merchistonandgrant.co.uk.

7. Blocking another guest

You can block any other guest from the app. While blocked, their photos, videos, comments, and guest-book messages won’t appear in your feeds, and they won’t be listed on your guest list. Blocking is personal — it only affects what you see, not what other guests see. You can unblock someone at any time from Profile › Blocked users.

8. Deleting your account

You can delete your account any time from Profile › Delete my account. When you do:

We clear the personal details on your account (name, email, phone, photo) immediately.
Photos, videos, comments, and messages you’ve already shared stay on the event so the couple and other guests don’t lose their memories — but your name is replaced with “Former guest” and your profile photo is hidden.
Your active sign-in sessions are revoked immediately.

If you want your shared content fully removed as well, email privacy@merchistonandgrant.co.uk and we’ll delete it too, subject to the couple’s wishes.

9. Children

Photographs and videos of people under 18 may appear in media shared by guests, taken with the couple’s consent. We do not run facial recognition, automated tagging, or any AI identification against media in this app. If you’re concerned about a specific image of a minor, please use the in-app report mechanism or contact us at privacy@merchistonandgrant.co.uk for immediate removal.

10. Bug reports (“Report a problem”)

If you tap Report a problem anywhere in the app, you can optionally send us a description of what went wrong and a screenshot. When you submit:

The description, screenshot, and the device diagnostics listed in section 2 are sent to Productive.io, the project-management tool Merchiston & Grant Ltd uses to track engineering work.
Your display name, your role (guest / photographer / admin), and — if you have them on your account — your email address and phone number are included on the ticket so we can follow up with you about the issue. Your sign-in credentials (magic-link tokens, session cookies, etc.) are not sent.
A copy of the report is also stored on our own server so we can see what went out even if Productive is down.

Productive.io processes the data on our behalf under their own privacy policy. If you’d prefer to send a bug report without going through Productive, email us directly at privacy@merchistonandgrant.co.uk instead — the in-app form is entirely optional.

11. Retention and deletion

Data is retained for the duration of the event and a limited grace period afterwards. Administrators can end the event at any time, which closes the platform to new activity. You can ask for your personal data or specific content to be removed by contacting the event administrator or writing to us at the address below.

12. Your rights (UK/EU GDPR)

You have the right to access, correct, port, and request deletion of your personal data, and to object to or restrict certain processing. To exercise any of these rights, contact us using the details below. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk).

13. Security

Data is transmitted over encrypted connections (HTTPS). Sessions are secured using short-lived tokens. Media is stored in private cloud storage and served via short-lived signed links; it is never publicly indexed. Card payments are handled entirely by Stripe, a PCI-DSS certified payment provider — we never receive or store your full card number.

14. Changes to this policy

If this policy changes in a material way, we will notify you in the app and, where practical, by email.

15. Contact

Merchiston & Grant Ltd
Email: privacy@merchistonandgrant.co.uk
Abuse reports: abuse@merchistonandgrant.co.uk