Privacy policy

I Said Yes is run by Gary Nunn. We are registered with the Information Commissioner’s Office, registration number ZC285018.

For anything to do with personal data, email planner@isaidyes.ai. We do not currently have a statutory Data Protection Officer; the same address reaches the person responsible for data protection.

Two roles apply, and they matter because they decide who answers for what.

• The planner is the controller. A planner (the person or business that owns a workspace) enters details about the couples they work for, those couples' guests, suppliers, budgets and schedules. The planner decides why and how that data is used. Under UK GDPR they are the controller of it, and their own privacy notice to their clients should cover their use of I Said Yes.
• We are the processor for that data. We store it, show it to the people the planner has invited, send the emails the planner asks us to send, and nothing more. Section 11 sets out our processor commitments, which form part of our terms with every planner.
• We are the controller for a small amount of data about the planner's own account: their name, email address, password hash, sign-in history and billing details, plus the emails we send about their account.
• A planner's Post-it notes on their own Today page are visible to that planner alone, not to anyone else in their workspace. They are left out of the workspace export; each planner can download or delete their own from the Post-it list, and they are deleted when the planner leaves the workspace or the account or workspace is deleted.

Couples, their families and guests: your planner put your details in. If you want something changed or removed, ask your planner first. If you would rather ask us, email planner@isaidyes.ai and we will help, working with the planner where we must.

As processor, on the planner's instructions:

• Couples: first and last names, email addresses, phone numbers, postal addresses, the wedding date and venue, and anything the planner writes in notes.
• Guests: names, household groupings, postal and email addresses, phone numbers, RSVP responses, meal choices, dietary requirements, accessibility needs, ages of children, gift and thank-you notes, and the time a household opened its invitation from its own link (nothing else about the guest or their device). Dietary and accessibility details can reveal health information, which is special category data; we process it only because the planner needs it to feed and seat people safely.
• Suppliers: business and contact names, emails, phone numbers, addresses, private ratings and notes.
• Team members and clients who sign in: names, email addresses, when they last signed in, the comments they write and the tasks they tick.
• Files the planner uploads: contracts, invoices, plans, mood board images.
• Files a planner sends us so that we can move her weddings in, under the migration agreement she signs first: whatever her previous tool or spreadsheet exports, which usually includes her guests' dietary and access needs.

As controller, about the planner's account:

• Name, email address, business name, address, phone, website, VAT status.
• A one-way hash of the password (we never see the password itself), sign-in timestamps and session identifiers.
• Subscription and payment records, handled by our payment provider; we do not store card numbers.
• Support emails you send us.
• If you book an onboarding call with us: your name, email address, your workspace's name, your answers to the booking questions and the email addresses of anyone you invite along.
• If you ask for roadmap updates on our roadmap page: your email address, your name if you give it, the sentence you agreed to and when, and when you confirmed. We email you only about what we have built and are building, only once you have confirmed from the email we send, and never share the address. Every email has a link to stop them; when you use it we keep only the address, marked as stopped, so we never email it again by mistake. We keep no record of your internet address.

A guest's dietary requirements and access needs can reveal health information: an allergy, coeliac disease, a condition that means they need a step-free route. UK GDPR calls this special category data (Article 9), and we treat it as that, not as ordinary personal information:

• We process it only as the planner's processor, so that she can feed and seat people safely, and for nothing else.
• It appears on the planner's own screens, in her day pack and on the caterer's sheet for that wedding, and nowhere else: never in our admin area, never in another supplier's pack, and on a public RSVP page only within the guest's own household.
• A note is kept in the guest's own words. Where I Said Yes highlights an allergy, the highlight sits beside those words and never replaces them.
• Where a planner uses the AI that reads dietary notes, the notes are sent to the AI service that reads documents for us, in the United States, as the list of the services we use sets out.
• Where a planner asks us to move her weddings in, the dietary and access notes in her files are handled under the migration agreement: private storage, a named list of who touches them, carried across exactly as written, and deleted within 30 days of her confirming the move.

A planner can choose to connect her own mailbox so that her email sits with the wedding it belongs to. Nothing is connected unless she does it herself, and she can disconnect at any time from her settings.

• She signs in on the page of the service that connects her mailbox. We never ask for, see or keep her email password.
• We bring in the email in her Inbox and Sent folders. We never read Spam, Trash or drafts, and we never read her contacts or her calendar.
• The words of every email, and any file that came with one, are encrypted with a key of her workspace’s own before they are stored. The key is held apart from the database, so a copy of the database on its own cannot open them. They do not appear in our internal admin tools in any form, and nobody at I Said Yes reads them.
• An email is matched to a wedding only by the exact address it came from or went to. Email from an address we do not recognise is listed by sender and subject only, and nothing about it is examined, until she files it herself.
• No email is ever sent to an AI model. A file that arrived by email is read for her only if she first files it on a wedding and then asks for that one file to be read.
• A couple never sees their planner’s email. Who opened which conversation is recorded for 90 days and shown only to the workspace’s owner.
• Disconnecting revokes the connection and deletes every email, file and thread we brought in. Email belonging to a deleted wedding is deleted with it. Her email is included in the export she can ask for, and in no other copy.

People who write to a planner should know that their email to her may be kept in I Said Yes on her behalf. She is the controller of it, as she is of the rest of her workspace, and requests about it go to her first.

Where it is switched on, a planner can talk her morning briefing through out loud. Nothing is heard until she presses Talk through my day, and her browser asks her permission for the microphone first.

• While the call runs, her microphone audio and anything she types go to the speech services that hold the conversation, outside the UK: a natural voice service that hears her and answers aloud, with a second speech service doing the thinking, or that second service alone where the natural voice is not set up. They are sent the parts of her plan that I Said Yes looks up to answer her, from the weddings she can see: couples' and guests' names, guests' replies, meals and tables, the running order, tasks, the budget, suppliers, her notes, new enquiries, her calendar entries and the invoices she is owed.
• When she asks about them, that includes guests' dietary and access needs in their own words, so that she can hear who has an allergy without looking. These are health details about guests, so they are looked up only when she asks, only for weddings she plans, and never for a couple.
• It is never sent a guest's message or a household's contact details, and never a file.
• A call lasts at most ten minutes. The microphone is switched off when the call ends, when the panel closes and while the page is hidden.
• When the natural voice is not available, the second speech service also reads her briefing aloud when she presses Read aloud. It is sent the briefing's opening summary and nothing else: her first name, couples' names, the titles of tasks and appointments, and dates and times. The sound goes straight back to her page and we keep no copy of it.
• She chooses the voice that reads her briefing and holds the call in her settings. The name of the voice she chose is saved on her account, and is used for Read aloud and Talk through my day.
• We keep no recording and no transcript of the call: the conversation on her screen is gone when the panel closes. We keep one record that a call took place and how long it lasted, as we do for every use of these features.
• Both process the call in the United States. The natural voice service is set to keep no recording and no transcript of it. The second speech service keeps what it receives for up to 30 days to check for abuse and does not use it to train its models, as the list of the services we use sets out.

• Contract (Article 6(1)(b)): providing the service a planner signed up for, including their account, and processing their clients' data on their instructions.
• Legitimate interests (Article 6(1)(f)): keeping the service secure, preventing abuse, and emailing planners about changes to the service. You can object at any time.
• Consent (Article 6(1)(a)): occasional news about I Said Yes, only to people who ticked the box when they looked round the demo; see when you look round the demo. You can withdraw it at any time.
• Consent (Article 6(1)(a)): roadmap updates by email, which you ask for on the roadmap page and confirm from the email we send. You can withdraw it at any time with the link in every email.
• Legal obligation (Article 6(1)(c)): keeping invoicing records for HMRC and responding to lawful requests.

For dietary and accessibility details, the planner relies on the couple's and guests' explicit consent, given when they tell the planner or fill in an RSVP. We process them only as the planner's processor.

We do not use the data held in I Said Yes (planners', couples' or guests') for advertising, profiling or automated decisions, and we do not sell it. Advertising cookies on our public pages are a separate, optional matter, set only with your consent: see below.

The database and uploaded files live in Ireland, with our database and file storage provider, inside the European Economic Area. The UK government recognises the EEA as providing an adequate level of protection, so no additional transfer safeguard is needed for personal data to sit there. I Said Yes runs on our hosting provider's network, whose servers may briefly process requests elsewhere; no data is stored there. Transactional email is sent by the service that delivers our emails.

A backup of the database and every uploaded file is made every night by our nightly backup service in the United States. Each backup is encrypted before it is stored, with a key only we hold. The database copy is kept for 30 days and then deleted, and an encrypted off-site copy is kept for the last 30 nights by our off-site backup store, which cannot read it.

Where a sub-processor is outside the UK, transfers rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and on each provider's security certifications.

We use the services below to run I Said Yes, and we do not share personal data with anyone else, except where the law requires it. They are described here by what they do, what they receive and where they are. One company can appear in more than one row when we use it for more than one thing.

Planners using I Said Yes can see the name of each company once signed in, under Settings > Who handles your data. Anyone else can ask us for the list at planner@isaidyes.ai.

Some services are asked only for public information. They receive a postcode or a place and nothing that names a person, and they are listed because a postcode a guest types is still something a guest typed:

• A postcode lookup service: A postcode, to find where it is: a venue's, a planner's, and one a guest types on a wedding's address page.
• A weather forecast service: The latitude and longitude of a venue, for its weather forecast.
• A route planning service: The coordinates of a planner's address and a venue, for the drive between them.

We will email every workspace owner at least 30 days before adding or changing a sub-processor, so they can object.

• While a workspace is active, everything in it is kept so the planner can use it.
• When a planner deletes a guest, a wedding or a whole workspace, it is hidden at once and kept for 30 days so a mistake can be undone. After 30 days it is deleted for good, uploaded files included. Encrypted nightly database backups, kept by our nightly backup service, expire within a further 30 days.
• A client (a couple or family member) can have their account deleted by their planner. Their sign-in details are erased straight away; their name is removed from the account record.
• If a planner's trial or subscription lapses, the workspace becomes read-only and everything in it is kept for 12 months, so it is all still there if they come back. Nothing is deleted for non-payment. At the end of those 12 months we email the workspace owner a deletion warning, at the address on the account, at least 30 days before anything goes. Reactivating at any point during those 12 months, or before the 30 days are up, stops the deletion. If nobody reactivates, the whole workspace is deleted for good, uploaded files included, and encrypted nightly database backups kept by our nightly backup service expire within a further 30 days.
• Account and billing records for the planner are kept for six years after the subscription ends, because HMRC requires it. These are the invoices and the business details on them, not the wedding data, which goes on the schedule above.
• Support emails are kept for two years.
• A roadmap updates address is kept while you want the emails. An address that never confirms is never emailed again; when you stop the emails, your name and what you agreed to are deleted at once, and you can ask us to delete the address as well.
• Files a planner sends us to move her weddings in are deleted within 30 days of her confirming the move, sooner if she asks, or 90 days after the last one arrived if the move is never finished, with a warning at 60 days.
• Demo visitors' records are kept for 12 months from their last visit, unless they start a free trial with the same address; an address whose code was never typed is deleted after a day (when you look round the demo).

For every workspace owner, and as required by Article 28 UK GDPR, we:

• process personal data only on your documented instructions, given through the service;
• make sure everyone with access to it is bound by confidentiality;
• keep it secure: encryption in transit and at rest, row-level access control in the database so one workspace can never read another, hashed passwords, signed single-use links;
• use only the sub-processors described above, whose names every planner can see once signed in, and tell you before that changes;
• help you answer requests from the people whose data you hold: every workspace can be exported as JSON and CSV from Settings, and any guest or client can be erased;
• tell you without undue delay, and in any case within 48 hours, if we become aware of a personal data breach affecting your workspace;
• delete or return everything at the end of the service, as described in section 10;
• give you the information you need to show you have met your own obligations.

All traffic is encrypted with TLS. Data is encrypted at rest. Every table in the database carries the workspace it belongs to and the database itself enforces that a signed-in person only ever sees their own workspace or their own wedding. Passwords are stored as salted hashes. Invitation, sign-in, export and restore links are signed and expire. Cron jobs and internal routes need a secret. No one at I Said Yes looks at a workspace unless the owner asks us to for support, or asks us to move her weddings in under the migration agreement.

Under UK GDPR you can ask to:

• see the personal data held about you (access);
• have mistakes corrected (rectification);
• have it deleted (erasure);
• restrict or object to how it is used;
• receive a copy in a portable format;
• withdraw consent where consent is the basis.

Planners: everything above is available from Settings (export, delete workspace) and from each wedding (delete a guest for good, delete a client's account). For anything else email planner@isaidyes.ai.

Couples and guests: your planner is the controller, so start with them. If you contact us directly we will pass the request on and make sure it is dealt with within one month.

You also have the right to complain to the UK regulator. We would rather hear from you first, but you can contact them at any time:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Telephone 0303 123 1113. ico.org.uk/make-a-complaint.

Guest lists include children. Planners record only what is needed to feed and seat them: a name, that they are a child, sometimes an age and a meal. Children never sign in to I Said Yes. The service itself is for adults running a business.

Before the demo opens we ask for your email address, and we send a one-time code to it to check the address is yours. When you type the code, we keep:

• your email address;
• whether you ticked “Send me occasional news about I Said Yes”, and when (the box is never ticked for you);
• when you first and last looked round, and how many times;
• the page of our website you came from, when your browser tells us, and the kind of browser and device, such as “Safari on iPhone”, and nothing more precise;
• if you later start a free trial with the same address, a note that you did.

We also set one cookie, isy_demo, so this browser is not asked again (see our cookies page). It holds a random number, not your email address.

Why. Sending the code, the link back to the demo in that email, and keeping a record of who has looked round and keeping the demo free of abuse rely on our legitimate interests (Article 6(1)(f)). News about I Said Yes goes only to people who ticked the box, on their consent (Article 6(1)(a)), which you can withdraw at any time by emailing planner@isaidyes.ai.

How long. Until the code is typed we hold only the address, your choice about news and a scrambled copy of the code (never the code itself), and we delete them after a day. Once the code is typed, we keep the record for 12 months from your last visit and then delete it, unless you start a free trial with the same address, when it stays with your account’s records.

Only our own team sees it, and the code email is sent by the service that delivers our emails. To have your record deleted sooner, email planner@isaidyes.ai.

We advertise I Said Yes on Facebook and Instagram. If you accept advertising cookies on our public pages or the sign-up page, Meta's measuring tool (the Meta Pixel) tells Meta Platforms Ireland Ltd which of those pages you visited, and that you started a trial or created an account. We use this to see which ads work and to show them to people likely to find I Said Yes useful. Meta may link it to a Facebook or Instagram account you have. We never send Meta your name, your email address or anything you type, and it is never loaded on the pages you sign in to, on a couple's portal, or on anything a wedding guest opens.

The lawful basis is your consent (Article 6(1)(a), and regulation 6 of PECR for the cookies). For collecting and passing on these visits, we and Meta are joint controllers; Meta decides how it uses them afterwards, under its own privacy policy at facebook.com/privacy/policy. You can withdraw consent at any time with Cookie settings at the foot of every public page; our cookies page lists the cookies.

When this policy changes in a way that matters, we email every workspace owner and update the date at the top. Earlier versions are available on request.

Email planner@isaidyes.ai, or write to Gary Nunn, 7 Little Holbury, Whitminster, Gloucester GL2 7NW.