Privacy Policy

1. Introduction

UpTune for Weddings ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our wedding music planning platform at weddings.uptune.xyz.

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. By using our service, you consent to the data practices described in this policy.

2. Information We Collect

Personal Information

• Name and email address (when you create an account)
• Wedding details (date, venue, couple names)
• Payment information (processed securely via Stripe)
• Music preferences and playlist data
• Guest information (names and emails for invitations)

Automatically Collected Information

• IP address and device information
• Browser type and operating system
• Pages visited and time spent on our platform
• Referring website addresses
• Cookies and usage data (see our Cookie Policy)

Third-Party Data

• Spotify account information (if you connect your account)
• Song metadata from Spotify's API
• Social authentication data (if you use social login)

3. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contract: To provide our wedding music planning services
• Consent: For marketing communications and analytics cookies
• Legitimate Interests: To improve our service and prevent fraud
• Legal Obligation: To comply with applicable laws and regulations

4. How We Use Your Information

• Provide and maintain our wedding music planning service
• Process payments and send transaction receipts
• Send service-related emails (account confirmation, password reset)
• Enable collaboration between wedding partners and guests
• Generate music recommendations based on your preferences
• Improve our service through analytics and feedback
• Comply with legal obligations
• Send marketing communications (with your consent)

5. Data Sharing and Disclosure

We share your information only in the following circumstances:

Service Providers

• Stripe: Payment processing
• Firebase (Google): Database and authentication
• Vercel: Website hosting
• Spotify: Music data and playlist creation
• Resend: Email delivery
• Google Analytics: Website analytics (with consent)

Other Sharing

• With your wedding co-owner(s) and invited guests (as you direct)
• When required by law or to respond to legal process
• To protect our rights, privacy, safety, or property
• In connection with a business transfer or acquisition

6. Data Retention

We retain your personal data for different periods depending on the type:

• Account data: Until you delete your account
• Wedding data: 2 years after your wedding date
• Payment records: 7 years for tax compliance
• Analytics data: 26 months
• Marketing data: Until you unsubscribe

7. Your Rights

Under UK GDPR, you have the following rights:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Limit how we process your data
• Portability: Receive your data in a portable format
• Object: Object to certain types of processing
• Withdraw consent: Withdraw consent at any time

To exercise these rights, please use our contact form and select "Privacy Concern" as the category. We will respond within 30 days.

8. Data Security

We implement appropriate technical and organisational measures to protect your data:

• Encryption in transit (HTTPS) and at rest
• Regular security assessments and updates
• Access controls and authentication
• Secure payment processing via Stripe
• Regular backups and disaster recovery procedures

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

9. International Transfers

Your data may be transferred to and processed in countries outside the UK/EEA. We ensure appropriate safeguards are in place, including:

• Standard contractual clauses approved by the UK ICO
• Adequacy decisions for certain countries
• Your explicit consent where required

10. Children's Privacy

Our service is not intended for children under 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. For material changes, we will provide additional notice via email.

12. Contact Information

For questions about this Privacy Policy or our data practices, please use our contact form.

13. Supervisory Authority

You have the right to lodge a complaint with the Information Commissioner's Office (ICO):