Privacy Policy

Last updated: September 28, 2026

This Privacy Policy explains what information ToBeWed LLC ("ToBeWed," "we," "us," or "our") collects when you use ToBeWed (the "Service"), how we use it, who we share it with, and what rights you have over it.

We wrote this to be readable. If you have questions, reach us at support@tobewed.app.

1. What information we collect

1.1 Account information.

When you create an account, we collect your email address and a hashed (encrypted) version of your password. We do not store plaintext passwords. An account, created with email and password, is required to use the Service.

1.2 Wedding planning data.

The core of the Service is the planning information you enter: your wedding date, venue details, vendor names and contact information, your budget and payment records, and planning notes. This data is stored in your account and is not shared with other users or third parties except as described in this Policy.

1.3 Guest data.

When you add guests to the Service, you provide us with personal information about those individuals, typically their names, contact information (email address and/or mailing address), dietary preferences, and RSVP status. You are responsible for ensuring you have the appropriate right or permission to add other people's personal information to the Service.

1.4 Vendor contract documents.

When you use the AI Autofill feature, you upload vendor contract PDFs. These documents may contain personal and financial information about you, your partner, and your vendors. Please see Section 4 (AI-Assisted Contract Parsing) for the full description of how these files are handled.

1.5 Billing information.

If you purchase the Premium Unlock, your payment is processed by Stripe, Inc. We do not receive or store your credit card number, expiration date, or CVV. Stripe shares with us a payment confirmation, a customer identifier, and transaction metadata (amount, date, status). For more information on how Stripe handles payment data, see https://stripe.com/privacy.

1.6 Usage and technical data.

We collect standard technical information when you use the Service: your browser type and version, device type, operating system, pages visited within the Service, and feature interactions. IP addresses appear in our hosting providers' standard server logs and are retained per their policies. This data helps us understand how the product is being used and where errors occur.

We use Vercel Web Analytics for site-level analytics. Vercel Web Analytics is designed to be cookie-free; it does not place tracking cookies on your device or build cross-site behavioral profiles. See Vercel's data practices at https://vercel.com/docs/analytics/privacy-policy.

2. How we use your information

We use the information we collect to:

• Provide the Service: store and display your planning data and process your purchases.
• Improve the Service: understand aggregate usage patterns and identify errors. We do not use individual users' planning content for product development.
• Send you essential communications: account confirmations, security notices, and purchase receipts. We do not send marketing email without your opt-in.
• Comply with legal obligations: including responding to valid legal requests and maintaining required records.
• Prevent fraud and abuse: including enforcing usage limits and our Terms of Service.

We do not sell your personal information to third parties. We do not use your wedding planning data, guest data, or vendor documents for advertising purposes.

3. Third-party processors

We share data with the following service providers as necessary to operate the Service. Each processor is contractually required to handle your data only for the purposes we specify.

We do not currently use Google Analytics, Meta Pixel, advertising networks, or third-party ad-tech tools. If that changes, we will update this Policy before doing so.

3.1 Embedded third-party content (Design tab).

The Design tab allows you to embed third-party content directly within the Service, including Pinterest boards, Google Slides presentations, Canva decks, and other web content you choose to add by pasting a link. These embeds are loaded by your browser directly from the third party's servers; ToBeWed does not proxy or intermediate that connection.

Because your browser contacts those companies directly when rendering an embed, they may receive your IP address and may set their own cookies or use other tracking technologies on your device. This happens under their privacy policies, not ours. In particular:

• Pinterest. To display a Pinterest board, the Service loads Pinterest's official embed script directly into the page. That script is delivered by Pinterest and operates under Pinterest's privacy policy, which may include setting cookies or collecting usage information. Pinterest content only loads on Design boards where you have added a Pinterest link.
• Google and Canva embeds load in a contained frame directly from their servers.
• Other links you paste are embedded as-is in a frame, meaning your browser loads that content directly from whatever website you chose.

Their privacy policies:

• Pinterest: https://policy.pinterest.com/en/privacy-policy
• Google: https://policies.google.com/privacy
• Canva: https://www.canva.com/policies/privacy-policy/

ToBeWed does not control and is not responsible for the data practices of these companies or of any website whose content you choose to embed. They are not data processors we have engaged on your behalf; they are independent third parties whose content you are loading through the embed feature.

4. AI-assisted contract parsing: how your uploaded documents are handled

This section describes the data flow for the AI Autofill feature in detail, because it involves uploading documents that may contain sensitive personal and financial information.

What happens when you use AI Autofill.

When you upload a vendor contract PDF and trigger Autofill, the uploaded document, including any images, letterheads, and signatures it contains, is transmitted to Anthropic, PBC via Anthropic's Claude API. Anthropic's model reads the document and returns structured data (vendor name, contract amounts, key dates, and similar fields) to the Service, which pre-populates your form fields. You review and confirm the results.

Anthropic's data practices (default API policy).

• Anthropic does not use data submitted via the API to train its AI models.
• Per Anthropic's standard API retention policy, API inputs and outputs are deleted within 30 days of processing (Anthropic may retain data longer where required to enforce its usage policy or by law).
• Uploaded contract PDFs are processed by the API and are not retained by Anthropic at rest beyond this window.

For Anthropic's full data handling terms, see https://www.anthropic.com/legal/privacy and https://www.anthropic.com/legal/aup.

Our own retention of uploaded PDFs.

When the AI Autofill request completes, ToBeWed does not retain a separate copy of the document; it is handled in memory during the API call. The original uploaded PDF file is stored in your Supabase account storage and remains associated with your account until you delete it or delete your account. When you request account or data deletion, uploaded files are removed within 30 days.

AI Autofill availability.

AI Autofill is a Premium feature. Where the Service makes a limited allowance of Autofill uses available to free accounts, that allowance is described in the Service at the time of use and may change. Unlimited AI Autofill is included with the Premium Unlock, and the current limit is always reflected in the app.

5. Cookies and local storage

Cookies. ToBeWed itself sets no cookies, including for login. We do not use advertising cookies, behavioral tracking cookies, or third-party cookie networks.

Local storage. Your login session is kept in your browser's local storage, not a cookie. The Service also uses local storage to cache your planning data for performance, so the app loads quickly even on slow connections. This cached data mirrors what is stored server-side in your Supabase account and does not include data not already present in your account.

Analytics. Our analytics provider (Vercel Web Analytics) is cookie-free by design and does not set cookies on your device.

Embedded third-party content. When you use the Design tab to view an embedded Pinterest board, Google Slides presentation, Canva deck, or other linked content, your browser loads that content directly from the third party's servers (for Pinterest boards, this includes Pinterest's own embed script). Those companies may set their own cookies on your device as part of that connection. Those cookies are not set by ToBeWed and are not subject to our cookie practices; they are governed by those companies' own policies. See Section 3.1 for links.

6. Data retention

We retain your account and planning data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days of your deletion request, subject to any data we are required to retain for legal or financial compliance (for example, payment records required for tax purposes).

Anthropic deletes API-transmitted contract data within 30 days of processing (see Section 4). ToBeWed deletes uploaded PDF files from Supabase storage within 30 days of an account or data deletion request.

7. Your rights: GDPR (EEA, UK, and Switzerland residents)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) or equivalent law applies to our processing of your personal data. You have the right to:

• Access: request a copy of the personal data we hold about you.
• Correction: request that we correct inaccurate or incomplete personal data.
• Deletion ("right to be forgotten"): request that we delete your personal data, subject to legal retention requirements. You can also delete your account directly from the Settings panel at any time.
• Restriction: request that we restrict processing of your personal data in certain circumstances.
• Portability: receive your personal data in a structured, machine-readable format.
• Object: object to processing based on our legitimate interests.
• Lodge a complaint: file a complaint with your local supervisory authority if you believe we have processed your data unlawfully.

Our legal basis for processing your personal data is primarily contract performance (we process your data to provide the Service you signed up for) and legitimate interests (improving the Service, fraud prevention). Where we process data based on your consent (for example, optional communications), you may withdraw consent at any time.

To exercise any of these rights, contact us at support@tobewed.app. We will respond within 30 days.

8. Your rights: CCPA (California residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you the following rights:

• Right to know: request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, our purposes for collecting it, and the categories of third parties we share it with.
• Right to delete: request that we delete personal information we have collected from you, subject to legal exceptions. You can also delete your account directly from the Settings panel at any time.
• Right to correct: request correction of inaccurate personal information.
• Right to opt out of sale or sharing: we do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of.
• Right to non-discrimination: we will not discriminate against you for exercising your CCPA rights.

To submit a request, contact us at support@tobewed.app. We will respond within 45 days (with a possible 45-day extension if needed).

9. Data security

We take reasonable technical and organizational measures to protect your personal data against unauthorized access, loss, or disclosure. These measures include:

• Data transmitted between your browser and our servers is encrypted using HTTPS/TLS.
• Account passwords are hashed using industry-standard algorithms; we do not store plaintext passwords.
• Your planning data is stored in Supabase with row-level security so that each user's data is isolated from other users.
• Payment data is handled entirely by Stripe; we never touch raw card numbers.

No security measure is perfect. We cannot guarantee that unauthorized access, disclosure, or loss will never occur. If we become aware of a breach that is likely to affect your rights or interests, we will notify you as required by applicable law.

10. Children's privacy

The Service is intended for users 18 years of age and older (see our Terms of Service). It is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it promptly.

11. International data transfers

ToBeWed is operated from the United States. If you access the Service from outside the United States, your data will be transferred to and processed in the United States. For EEA/UK users, we rely on standard contractual clauses or equivalent transfer mechanisms established by our processors (Supabase, Vercel, Anthropic) to legitimize these transfers.

12. Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date and notify you by email or in-app notice for material changes. Your continued use of the Service after notice constitutes your acceptance of the updated Policy.

13. Contact

If you have questions about this Privacy Policy or a data rights request, contact us at:

support@tobewed.app

ToBeWed LLC
c/o Northwest Registered Agent LLC
2389 Main St. STE 100
Glastonbury, CT 06033, USA