Privacy policy

When you sign in with Google we receive your name, email address and profile picture. We store the content you put into your website — names, dates, venues, photographs — and a record of your payments.

RSVP responses contain whatever your form asks for, which you choose. That data belongs to you: we store it so your dashboard can show it and so you can export it. We do not market to your guests and do not sell their details to anyone.

Google handles sign-in. Firebase stores your account and website data. Cloudflare R2 stores uploaded files and published pages. Razorpay processes payments and holds the card details — we never see them.

We set two: a session cookie so you stay signed in, and a refresh cookie so you are not asked to sign in every hour. Both are httpOnly. There are no advertising or analytics cookies on published wedding sites.

Your site and its RSVP responses are kept while your account exists. Ask us to delete your account and we remove the site, its files and the responses.

You can ask for a copy of your data, ask for it to be corrected, or ask for it to be deleted. Write to hello@whitestair.com and we will respond within 30 days.