What we do with your things

The short version

• We collect your email address so we can send you a gallery link and your album design.
• We store the photographs you upload so we can curate, design and print from them.
• We never publish, sell, license or train anything on your photographs.
• We never show your pictures as samples without your written permission.
• Ask us to delete everything and we will, without asking why.

Who we are

Brides Bindery is the data controller for the information described here. Write to [email protected] about anything on this page, including to exercise any of the rights below.

What we collect, and why

What	Why	Lawful basis
Your email address	To send your gallery link, your album design and answers to your questions.	Consent, and performance of a contract once you order.
Your name and, if you give it, your event date	So the album is right and so we know when it is needed.	Consent, then contract.
The photographs you upload	To build your gallery, curate a selection, design the album and print it.	Consent, then contract.
Delivery address and order details	To make and ship what you ordered, and to keep the records tax law requires.	Contract, and legal obligation.
Details you add after signing up, if you choose to	Your names, a date, the occasion, roughly how many photographs, a gallery link, a phone number, a note and where you first heard of us — to start your album sooner and reach you the way you prefer. Where you heard of us tells us which channels actually bring couples here.	Steps you ask us to take before a contract; legitimate interest for where you heard of us. Every field is optional.
Basic technical data	A shortened IP address and a timestamp, stored with your sign-up as a record of when you consented; and a one-way scrambled form of the full address, which cannot be turned back into it, kept to block automated abuse.	Being able to show your consent, and a legitimate interest in keeping the site usable.

Photographs are special, and we treat them that way

Photographs of identifiable people are personal data about everyone in them, not only about you. Some of what is in a wedding gallery may also be sensitive — a religious ceremony, for instance. So:

• Your gallery is unlisted and excluded from search engines by default, and can be password-protected on request.
• Access inside our team is limited to the people working on your album.
• We do not use your photographs to train machine-learning models, ours or anyone else's.
• We do not use them in marketing, on this website, or on social media unless you tell us in writing that we may — and you can withdraw that at any point.

How long we keep things

• If you never order: tell us and everything is deleted immediately. Otherwise uploads and design files are removed after twelve months of inactivity, and we email you first.
• If you order: we keep the print files while the guarantee runs, so a damaged album can be remade without you finding the originals again. Ask and we will delete them sooner.
• Your gallery: stays up for as long as you want it. It does not silently expire.
• Sales records: retained for as long as tax and accounting law requires, typically several years. This is the one category we cannot delete on request.
• Anti-abuse records: a one-way scrambled form of your IP address and the times of your recent submissions, cleared away once they are an hour old.

Who else sees your data

Only the suppliers we need to do the job, each bound by contract to use the data only on our instructions:

• Hosting and storage for the website and galleries.
• Cloudflare, which delivers this website and shields it from attacks, so every visit to the site passes through it.
• Our email provider, for the messages we send you.
• Payment processing, if you order — we never see or store your full card details.
• The courier, which gets a name and a delivery address and nothing else.

We do not sell data and we do not share it with advertising networks. We run no advertising trackers. The only analytics are the ones described under Cookies: Google Analytics, and only if you allow it, and Cloudflare's page counter, which sets no cookie.

Cookies

We set no advertising cookies and never will. Nothing here is shared with advertisers, sold, or used to follow you around other websites.

We do ask about one thing. If you allow it, Google Analytics sets a cookie so we can see how people move through the site and which pages actually help couples decide — that, for instance, nobody ever reaches the page about cover materials. You are asked before it is set, not after; declining changes nothing about how the site works, and we do not ask again.

With analytics on, we switch off Google's advertising features, shorten your IP address before it is stored, and strip everything after the page name from the address we send except the tags that say which link or advert brought you — so a private gallery link never reaches Google, even if it is sitting in your address bar. The page you came from is cut down the same way: to its path if it was one of ours, and to the bare domain if it was anyone else's.

When you sign up or fill in the optional form, analytics records that you did and the choices you ticked — the occasion, roughly how many photographs, where you heard of us — and whether you added a date, a phone number, a gallery link or a note. Never what you typed: no address, name, number or link.

Changed your mind? Clearing this site's data in your browser removes the answer and the cookie, and you will be asked again on your next visit.

Separately, we count page views with Cloudflare Web Analytics. The site is delivered through Cloudflare, and this counter sets no cookie, keeps nothing on your device and does not fingerprint your browser. It records which page was viewed, which site sent you there, and broad details such as your country and the kind of device — never who you are. Because it leaves nothing on your device, we do not ask about it.

Two further technical notes:

• Fonts are served by Google Fonts, so your browser requests files from fonts.gstatic.com and Google sees that request.
• If you sign in to a gallery, a strictly necessary session cookie keeps you signed in.

None of these is used to profile you.

Where your data is processed

Our hosting and production are in Europe. Where a supplier processes data outside the European Economic Area, that transfer is covered by the European Commission's standard contractual clauses or an adequacy decision.

Your rights

If the GDPR or UK GDPR applies to you, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it elsewhere in a portable format. Where we rely on consent you can withdraw it at any time, which does not affect anything done before you withdrew it. You can also complain to your national data protection authority.

One email to [email protected] is enough. We answer within thirty days and usually within two working days.

Security

Traffic is encrypted in transit. Uploads are stored on access-controlled storage that is not publicly listable. Gallery links are long and unguessable, and can be password-protected. Access to production systems is limited to the people who need it. No system is perfect, and if something did go wrong that put your data at genuine risk, we would tell you and the regulator — not quietly hope you did not notice.

Changes

If this notice changes in a way that matters, we will email anyone it affects rather than relying on you to re-read the page. The date at the top always reflects the current version.