Privacy Policy | We Chose Forever

Who we are

We Chose Forever builds and hosts wedding websites, and runs a planner and vendor marketplace alongside them. Under the Protection of Personal Information Act 4 of 2013 ("POPIA") we are the responsible party for the information described below, except where this policy says otherwise.

Trading name: We Chose Forever
Registered name: QA Culture (Pty) Ltd
Registration number: 2022/315022/07
Information Officer: Gehart Kalmeir
Privacy contact: privacy@wechoseforever.co.za

Kept out of the page so they are not collected automatically. One click shows them, and nothing is asked of you in return.

Who this policy is for

Three different groups of people appear in this policy, and they are not treated the same way:

Couples: people who create an account and build a wedding site.
Vendors: businesses who list themselves in the marketplace.
Guests: people who reply on a couple's published wedding page. Guests never create an account with us, and most of what follows about accounts does not apply to them. The short version for guests is in the section called "If you are a wedding guest".

What we collect

From a couple, when you sign up and use the planner:

Your email address and a password, which is stored only as a cryptographic hash. We never see or hold the password itself.
Both of your first names, your wedding date, and where the wedding is.
The web address (slug) you chose for your site.
Optionally, your total wedding budget and a rough guest count.
Photographs you upload, up to five.
The vendors you shortlist or book, and the categories you mark as already arranged.
Anything you type into your site's own text, or into notes on your guest list.

From a vendor, when you set up a listing:

Your email address and a hashed password.
Your business name, category, service area, price and pricing basis, and your description.
Your answers to the standard questions in your category, the tick boxes on your listing. They are optional and they are shown to couples exactly as you set them.
Portfolio photographs you upload.
Your listing tier.

From a vendor, to confirm who is behind a listing. We do this before a listing is shown to any couple, and there are two paths:

If your business is registered: your company registration number. We check it against the CIPC register, and we keep it, because we re-check the register once a year and because a registration number is public information about a business. It is never shown to couples.
If you trade in your own name: your South African ID number. We use it once to confirm your identity, and then we delete it. It is never stored against your listing, never shown to a couple, and never re-checked, an identity does not lapse. What survives the check is the fact that it passed, the date, and a one-way hash we cannot read the number back out of.
Either way, we record which path you took and when the check was done, so your listing can show a couple what was confirmed and when.

The check confirms identity and nothing else. It is not an assessment of a vendor's work, insurance, pricing or conduct, and we do not present it to couples as one.

From a wedding guest, when you RSVP on a couple's page. If the couple sent you your own personal link, your reply goes onto the invitation they made for you, and if you reply again through it the page remembers what you said last time, who is in your party, and whether you gave a dietary note (never the note itself), so you only change what has changed. Anybody you pass that link to can see and change the same, so keep it to yourself. If you reply from the page's general address, your reply reaches the couple as it is, and they match it to their own list themselves; we do not compare your name to it. Either way the page thanks you in the same words, and the form never tells anybody whether a particular person was invited.

Your name, whether you are attending, and how many are coming.
The names of anyone coming with you, if you give them. They are optional, and they are how the couple knows who is sitting where.
Your email address, if you give one. It is optional.
Allergies and dietary needs, if you choose to give them and tick the box that allows us to keep them. See “Health and dietary information” below.
Anything you write in the free-text note.
The version of this policy that was in force when you replied, and the moment you agreed to it, so that we can tell what you actually agreed to.
Whether you agreed that the couple may email you about the wedding. This is off unless you tick it.

If you buy a plan or a pack of credits:

What you bought, what it cost, the currency, and whether the payment succeeded or failed.
A reference that lets us match your payment to your account, and the reference our payment gateway gives it.
If a purchase moved you from one plan to another part-way through, the credit we applied for the time you had not used.
We never see or store your card number, expiry date or security code. Those are typed on our payment gateway's own page and stay with them.
If you cancel a plan and we owe you money back: the amount, how it was worked out, the date the plan ends, and whether the refund has been sent.
Your credit balance, and a line for every credit bought, held and spent, so that both of us can see where a credit went.

Automatically, from everyone who uses the site:

Your IP address, which our server sees on every request. Where we keep it to stop automated abuse of the sign-up and RSVP forms, we store it in a one-way hashed form, so we cannot recover the address itself.
When you sign in, ask for a password reset or create an account, we count the attempt so that repeated guessing can be slowed down. The count is kept against a one-way hashed form of your IP address and of the email address typed, never the addresses themselves.
When you accept these terms or this policy, we record which document it was, which version, the moment you agreed, and, as the evidence of the agreement itself, your IP address and your browser's description of itself. That copy is not hashed, because a record of an agreement is only worth keeping if it can still be read.
When you sign in, we record that you did, so that we can tell an account that is still in use from one that has been abandoned. That is the record the deletion rule below runs on.
Standard server logs kept by our hosting provider.
The cookies described below.
When a signed-in couple opens a vendor's profile, we record that a view happened, which vendor it was, and which site it came from.

Why we process it, and on what basis

We process personal information because it is necessary to perform the contract we have with you (POPIA s11(1)(b)), because you have consented (s11(1)(a)), or because it is necessary for our legitimate interests in running and protecting the service (s11(1)(f)). Specifically:

Your account: Necessary for the contract. We cannot give you a site without one.
Your wedding site: Necessary for the contract. You choose what goes on it. It is published on the address you picked as soon as you finish signing up, so it can be opened by anyone with the link and found by search engines, and you can ask search engines to leave it out, or unpublish it entirely, from the editor whenever you like.
Budget and guest count: Necessary for the planner features you asked for. Never disclosed to anyone else.
Showing your name and date to a vendor you favourite: Your consent: see below. You can withdraw it at any time, and a vendor you have only favourited goes back to seeing an anonymous couple.
Showing your name and date to a vendor you write to: Necessary to provide what you asked for. You chose to contact them, and nobody can answer a wedding enquiry without knowing the date and the place, so this is not a consent you switch on, it is what sending the message does. Nothing is shown to anyone until you write.
Guest RSVPs: Necessary to provide the couple with the guest list they asked for.
Hashed IP addresses: Our legitimate interest in stopping automated abuse of the sign-up and RSVP forms.
Counting sign-in, password-reset and sign-up attempts: Our legitimate interest in keeping accounts safe from password guessing and the sign-in form open for everybody.
Payments, refunds and credits: Necessary for the contract, we cannot sell you a plan without taking payment for it, and, for keeping the records afterwards, a legal obligation: tax law requires us to keep them for a set period whatever either of us would prefer.
The record of what you agreed to: Our legitimate interest in being able to show, later, which version of these documents you accepted and when. It is also what lets us tell whether a change needs your agreement again rather than assuming it.
When you last signed in: Our legitimate interest in not keeping data for accounts nobody uses, and yours in not having your site deleted while you are still using it. It is the only thing the deletion rule below looks at.
Vendor profile views: Our legitimate interest, and the vendor's, in knowing whether their listing works.
Confirming a vendor's identity: Necessary for the contract with the vendor, a listing is not shown to couples until it is done, and our legitimate interest, and every couple's, in knowing that a business on this marketplace is a real one.

Your budget is never shared with anyone

Nobody but you sees what you can spend. Not a vendor you shortlist, not a vendor you book, not one you have already paid, a vendor has no way to read it at all, which is enforced in the database and not just in our code. We use it for two things, both of them inside your own account: your budget tracker, which counts what you have committed against what you set; and, if you switch it on, a marketplace filter that hides vendors priced above what you have left. That filter is off unless you turn it on. Either way the figure never leaves your account.

This is enforced in the database, not merely omitted from the pages we build. A vendor's account has no read access to the field at all, so the figure cannot be reached even by someone deliberately looking for it. We mention the mechanism because a privacy promise that depends on us remembering to hide something is a weaker promise than one the system cannot break.

What a vendor does see

If you favourite or book a vendor, and you have agreed to it, that vendor can see your first names, your wedding date and where the wedding is, enough to answer you properly. Nothing about money.

We ask you to choose that explicitly when you sign up rather than burying it here, and you can change it whenever you like on your dashboard. If you decline, vendors you favourite see only that an anonymous couple has favourited them.

A vendor only ever sees a couple who has actively chosen them. Browsing a listing does not expose you. Vendors cannot search for couples, cannot see couples who have not picked them, and cannot see your guest list, your photographs or your site content at any point.

Messages are different, and they only go in one direction to begin with: you write to a vendor from their listing, and they may answer you. A vendor can never open a conversation with you. When you do write, that vendor sees your first names, your wedding date, your town and your province, a venue or a caterer also sees roughly how many guests you expect, because none of them can answer you without it. That is not the setting above: choosing to send the message is the choice. You each have five messages in one conversation, they are kept so both of you can read them back, and neither of you can delete the other's.

We cannot un-tell a vendor you have already written to. Turning the setting above off stops everything from that point on, but a vendor you have messaged keeps your first names, your date and your town for that conversation. Under our vendor terms they may use them only to answer you.

You may also ask us to send those messages to your email address, and to accept your emailed replies back into the conversation. It is off unless you switch it on, and it does nothing unless the vendor has switched the same thing on. Your email address is never given to the vendor and theirs is never given to you: mail goes out from a We Chose Forever address in both directions, and a reply comes back to us.

Once a vendor receives your details they become a responsible party in their own right for what they then do with them. Our vendor terms require them to use those details only to respond to your enquiry.

Your planner and how suggestions are made

To suggest vendors and budgets, we process the details you enter, your date, location, budget and the categories you are still filling. This happens to provide the service you asked for. Your budget is never disclosed to any vendor. You can see and delete everything we hold from the Account page in your dashboard.

Nothing here is generated by artificial intelligence, and nothing you enter is sent to any AI service or used to train anybody's model. The ordering you see is worked out on our own servers from the details above.

Nothing about this leaves your account. The province you filter on, the budget you set and the categories you have ticked off are read to decide what to put in front of you and in what order, and none of it is sent to a vendor, a vendor learns you exist only when you write to them or favourite them, and then only what the section above describes.

Who else receives personal information

We do not sell personal information, and we do not share it for advertising. We use a small number of service providers, who process it only on our instructions as operators under POPIA s20:

Supabase: Database, authentication and photo storage. Your account and everything you create with it. This is where the service lives. Hosted in: United Kingdom (eu-west-2).
Paystack: Taking card payments and sending refunds. What you pay and what it was for, plus the card details you enter on their own page. Your card number never reaches us. Hosted in: Nigeria.
Resend: Sending our emails. Your email address and the emails we send you, including anything attached to one, a keepsake copy of your page, for instance. Hosted in: United States.
Cloudflare: Receiving emailed replies to an enquiry. A reply you send by email passes through them on its way to us. Nothing stays there. Hosted in: United States.
Render: Application hosting and server logs. The pages you open, as they are served, and a log of which addresses were requested and when. Hosted in: Germany (Frankfurt).

We may also disclose information where the law requires it, or where it is necessary to establish, exercise or defend a legal claim.

Information sent outside South Africa

None of it is hosted in South Africa, and not all in one country: database, authentication and photo storage in the United Kingdom (eu-west-2); taking card payments and sending refunds in Nigeria; sending our emails in the United States; receiving emailed replies to an enquiry in the United States; application hosting and server logs in Germany (Frankfurt). Your personal information therefore leaves the country. POPIA s72 permits this where the recipient is bound by an agreement that upholds principles substantially similar to POPIA, and we have a written data processing agreement in place with each provider for exactly that purpose.

If you are a wedding guest

When you reply on a couple's wedding page, the couple is the person deciding to collect your reply, under POPIA they are the responsible party for their guest list. We only store it for them, as their operator. Your reply goes to that couple and to nobody else.

Your reply is never readable from the public internet. There is no way to read a guest list without signing in to the account that owns it, and there is no public search of guests. If you want your reply corrected or removed, ask the couple. They can delete it directly. You can also write to us at the privacy address below and we will pass it on.

Health and dietary information

Information about allergies or dietary needs is health information, which POPIA treats as special personal information and restricts more tightly. The RSVP asks for it in its own step, and it is stored only if you tick the box beside it. That tick is the explicit consent POPIA s27(1)(a) requires, and it names the purpose: so the couple can cater for you at their wedding. Leave the field blank, or leave the box unticked, and nothing is kept. The one exception is a second reply through your own personal link: a note you gave the first time stays, the form tells you it is there, until you tick the box to remove it, or reply that you cannot come. The couple sees it on their guest list and cannot edit it. It is never used for anything else, and it is deleted with the rest of the reply.

Children

Our service is not directed at children and we do not knowingly create accounts for anyone under 18. A guest list may name children who are attending a wedding. Where it does, the couple is responsible for having the consent of a competent person, as POPIA s34 requires. If you believe a child's information is held here without that consent, write to us and we will remove it.

Cookies

We use a small number of cookies, all of them necessary for the site to work. We do not use advertising cookies and we do not run third-party analytics.

Authentication: Set by our authentication provider when you sign in.
fa_device: Records whether you are on a phone or tablet, so we can serve the app layout instead of the desktop one before the page paints.
fa_device_pin: Set only if you use the ?device= override.
fa_vendor_theme: Vendors only.
fa_season: Couples only.
fa_rail: Signed-in accounts only.

Full detail is on our cookie page.

The help bot

When the help bot cannot answer something, we keep the individual words it did not recognise, with names and numbers removed, for 90 days, so we can work out what to write next. We do not keep the question you typed, who asked it, or anything that identifies you. No address, no account, no device.

If you send us feedback through the help bot, we keep what you wrote, together with the answer that was on screen and the question you had just asked, for 180 days. The form tells you that before you type, and asks you not to include personal details. We do not keep your address, your account or your device with it.

If you report someone

Either side of a conversation between a couple and a vendor can report the other from that conversation. When you do, we keep what you wrote, a copy of the conversation as it stood at that moment, and which accounts were on each side of it. The dialog tells you the conversation is attached before you send it.

We do this on the basis of our legitimate interest in keeping the service safe for the people using it, and in some cases our legal obligations, section 11(1)(d) and (f) of POPIA. It is not consent, and you cannot withdraw a report that has already been sent, because a copy of what happened is the only record of it.

A report reaches us and nothing else. Nobody is suspended, blocked or notified automatically, and we do not tell the person reported who reported them. If we write to either of you about it, that letter goes through us, neither party is given the other's email address at any point.

If you write to us

There is a form at /contact for writing to us about your wedding page, your billing, your personal information or a copyright complaint. When you use it we keep what you typed, the name and email address you gave us, which of the four subjects you chose, and the time it arrived. If you were signed in we also record which account it came from, so we can find your details without asking you for them again.

We do this to answer you: section 11(1)(b) of POPIA where your message is about an agreement between us, and our legitimate interest in running the service under section 11(1)(f) otherwise. We use what you send only to deal with what you asked about.

The form does not send you a confirmation email, and nothing about your message is published or shared with anyone outside the company. If your message is a formal notice you would rather send directly, our email address is on the legal details page.

How long we keep it

Your account and site: for as long as your account is open. Delete your account and your site, your photographs, your guest list and your vendor choices go with it. Everything except the records named below that we are required to keep.
Free accounts that nobody uses: an account nobody has signed in to for 90 days is deleted, together with everything in it, a couple's site, photographs and guest list, or a vendor's listing and its enquiries. We write first, and nothing is deleted without that letter having gone.
A vendor's company registration number: for as long as the listing exists, because we re-check the register once a year. A vendor's ID number is not on this list. It is deleted as soon as the check finishes, whether it passed or failed.
Guest replies: for as long as the couple's account exists, or until the couple deletes them.
Payments, refunds and credit history: five years from the end of the tax year they fall in, which is the period South African tax law requires. These survive an account being deleted, because keeping them is a legal obligation rather than our choice.
The record of what you agreed to, including the IP address on it: for as long as the agreement could still matter, while you have an account, and afterwards for as long as a claim under it could still be brought.
When you last signed in: for as long as the account exists. It is deleted with it.
Hashed IP addresses used for abuse prevention: 30 days, and they are cleared whenever we deploy.
The hashed count of sign-in, password-reset and sign-up attempts: one day, then deleted.
Help bot keyword fingerprints: 90 days, then deleted automatically.
Help bot feedback you send us: 180 days, then deleted automatically.
Abuse reports, and the copy of the conversation attached to one: for as long as we may need them to act on the matter or to answer a complaint about how we handled it. A report outlives the conversation it is about, and it outlives an account that is deleted, with the account's identity removed from it.
Messages you send us through the contact form: 24 months from the date you sent them, so we can look back at what was asked and what we answered.
Records we are required by law to keep, such as tax records: for the period the law requires.

How we protect it

All traffic is encrypted in transit over HTTPS.
Passwords are stored only as hashes, never in a readable form.
Access to every record is enforced in the database itself with row-level security, not only in the application, so a mistake in our code cannot expose another user's data.
Guest lists have no public read path at all.
Only staff who need access to operate the service have it.

If a security compromise occurs that affects your personal information, POPIA s22 requires us to notify the Information Regulator and you. We will do so as soon as reasonably possible, and tell you what happened and what to do about it.

Your rights

Under POPIA you may:

Ask what personal information we hold about you, and get a copy of it.
Ask us to correct anything inaccurate, or complete anything missing.
Ask us to delete information we no longer have a reason to keep.
Object to processing we do on the basis of legitimate interest.
Withdraw a consent you gave, including consent to show your name and date to vendors you favourite. Withdrawing stops anything further; it does not reach a conversation you have already started, because we cannot un-tell the vendor you wrote to.
Complain to the Information Regulator.

Most of this you can do yourself and immediately: your dashboard lets you edit your details, delete your photographs and guests, change the vendor-sharing setting, download a copy of the data we hold, your site details, guest list, vendor choices and links to your photographs, and also your messages to vendors, your payments and refunds, your credit history, what you have agreed to and when, and your sign-in history, and delete your account outright. For anything else, write to privacy@wechoseforever.co.za and we will answer within a reasonable time and at no charge.

Complaints

If you think we have handled your personal information unlawfully, please tell us first. We would rather fix it. You are entitled to complain to the Information Regulator regardless:

Regulator: Information Regulator (South Africa)
Complaints: complaints.IR@inforegulator.org.za
General enquiries: inforeg@inforegulator.org.za
Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Website: https://inforegulator.org.za

Marketing

We will not send you marketing by email unless you are already a customer or you have asked us to. Every marketing message we send will identify us and carry a one-click way to stop receiving them. Service messages about your own account: a password reset, or a warning that an unused account is about to be deleted, are not marketing and you cannot unsubscribe from those while you have an account.

Changes to this policy

We version this policy. If we change it in a way that affects what you agreed to, we will tell you and ask you to accept the new version rather than assuming your old agreement still covers it. The version number and date are at the top of this page.

Contact us

Privacy and data requests: privacy@wechoseforever.co.za
Everything else: hello@wechoseforever.co.za
Information Officer: Gehart Kalmeir

Kept out of the page so they are not collected automatically. One click shows them, and nothing is asked of you in return.

One moment

Who we are

Trading name: We Chose Forever
Registered name: QA Culture (Pty) Ltd
Registration number: 2022/315022/07
Information Officer: Gehart Kalmeir
Privacy contact: privacy@wechoseforever.co.za

Kept out of the page so they are not collected automatically. One click shows them, and nothing is asked of you in return.

Who this policy is for

Three different groups of people appear in this policy, and they are not treated the same way:

Couples: people who create an account and build a wedding site.
Vendors: businesses who list themselves in the marketplace.
Guests: people who reply on a couple's published wedding page. Guests never create an account with us, and most of what follows about accounts does not apply to them. The short version for guests is in the section called "If you are a wedding guest".

What we collect

From a couple, when you sign up and use the planner:

Your email address and a password, which is stored only as a cryptographic hash. We never see or hold the password itself.
Both of your first names, your wedding date, and where the wedding is.
The web address (slug) you chose for your site.
Optionally, your total wedding budget and a rough guest count.
Photographs you upload, up to five.
The vendors you shortlist or book, and the categories you mark as already arranged.
Anything you type into your site's own text, or into notes on your guest list.

From a vendor, when you set up a listing:

Your email address and a hashed password.
Your business name, category, service area, price and pricing basis, and your description.
Your answers to the standard questions in your category, the tick boxes on your listing. They are optional and they are shown to couples exactly as you set them.
Portfolio photographs you upload.
Your listing tier.

From a vendor, to confirm who is behind a listing. We do this before a listing is shown to any couple, and there are two paths:

If your business is registered: your company registration number. We check it against the CIPC register, and we keep it, because we re-check the register once a year and because a registration number is public information about a business. It is never shown to couples.
If you trade in your own name: your South African ID number. We use it once to confirm your identity, and then we delete it. It is never stored against your listing, never shown to a couple, and never re-checked, an identity does not lapse. What survives the check is the fact that it passed, the date, and a one-way hash we cannot read the number back out of.
Either way, we record which path you took and when the check was done, so your listing can show a couple what was confirmed and when.

The check confirms identity and nothing else. It is not an assessment of a vendor's work, insurance, pricing or conduct, and we do not present it to couples as one.

Your name, whether you are attending, and how many are coming.
The names of anyone coming with you, if you give them. They are optional, and they are how the couple knows who is sitting where.
Your email address, if you give one. It is optional.
Allergies and dietary needs, if you choose to give them and tick the box that allows us to keep them. See “Health and dietary information” below.
Anything you write in the free-text note.
The version of this policy that was in force when you replied, and the moment you agreed to it, so that we can tell what you actually agreed to.
Whether you agreed that the couple may email you about the wedding. This is off unless you tick it.

If you buy a plan or a pack of credits:

What you bought, what it cost, the currency, and whether the payment succeeded or failed.
A reference that lets us match your payment to your account, and the reference our payment gateway gives it.
If a purchase moved you from one plan to another part-way through, the credit we applied for the time you had not used.
We never see or store your card number, expiry date or security code. Those are typed on our payment gateway's own page and stay with them.
If you cancel a plan and we owe you money back: the amount, how it was worked out, the date the plan ends, and whether the refund has been sent.
Your credit balance, and a line for every credit bought, held and spent, so that both of us can see where a credit went.

Automatically, from everyone who uses the site:

Your IP address, which our server sees on every request. Where we keep it to stop automated abuse of the sign-up and RSVP forms, we store it in a one-way hashed form, so we cannot recover the address itself.
When you sign in, ask for a password reset or create an account, we count the attempt so that repeated guessing can be slowed down. The count is kept against a one-way hashed form of your IP address and of the email address typed, never the addresses themselves.
When you accept these terms or this policy, we record which document it was, which version, the moment you agreed, and, as the evidence of the agreement itself, your IP address and your browser's description of itself. That copy is not hashed, because a record of an agreement is only worth keeping if it can still be read.
When you sign in, we record that you did, so that we can tell an account that is still in use from one that has been abandoned. That is the record the deletion rule below runs on.
Standard server logs kept by our hosting provider.
The cookies described below.
When a signed-in couple opens a vendor's profile, we record that a view happened, which vendor it was, and which site it came from.

Why we process it, and on what basis

Your account: Necessary for the contract. We cannot give you a site without one.
Your wedding site: Necessary for the contract. You choose what goes on it. It is published on the address you picked as soon as you finish signing up, so it can be opened by anyone with the link and found by search engines, and you can ask search engines to leave it out, or unpublish it entirely, from the editor whenever you like.
Budget and guest count: Necessary for the planner features you asked for. Never disclosed to anyone else.
Showing your name and date to a vendor you favourite: Your consent: see below. You can withdraw it at any time, and a vendor you have only favourited goes back to seeing an anonymous couple.
Showing your name and date to a vendor you write to: Necessary to provide what you asked for. You chose to contact them, and nobody can answer a wedding enquiry without knowing the date and the place, so this is not a consent you switch on, it is what sending the message does. Nothing is shown to anyone until you write.
Guest RSVPs: Necessary to provide the couple with the guest list they asked for.
Hashed IP addresses: Our legitimate interest in stopping automated abuse of the sign-up and RSVP forms.
Counting sign-in, password-reset and sign-up attempts: Our legitimate interest in keeping accounts safe from password guessing and the sign-in form open for everybody.
Payments, refunds and credits: Necessary for the contract, we cannot sell you a plan without taking payment for it, and, for keeping the records afterwards, a legal obligation: tax law requires us to keep them for a set period whatever either of us would prefer.
The record of what you agreed to: Our legitimate interest in being able to show, later, which version of these documents you accepted and when. It is also what lets us tell whether a change needs your agreement again rather than assuming it.
When you last signed in: Our legitimate interest in not keeping data for accounts nobody uses, and yours in not having your site deleted while you are still using it. It is the only thing the deletion rule below looks at.
Vendor profile views: Our legitimate interest, and the vendor's, in knowing whether their listing works.
Confirming a vendor's identity: Necessary for the contract with the vendor, a listing is not shown to couples until it is done, and our legitimate interest, and every couple's, in knowing that a business on this marketplace is a real one.

Your budget is never shared with anyone

What a vendor does see

If you favourite or book a vendor, and you have agreed to it, that vendor can see your first names, your wedding date and where the wedding is, enough to answer you properly. Nothing about money.

Your planner and how suggestions are made

Who else receives personal information

We do not sell personal information, and we do not share it for advertising. We use a small number of service providers, who process it only on our instructions as operators under POPIA s20:

Supabase: Database, authentication and photo storage. Your account and everything you create with it. This is where the service lives. Hosted in: United Kingdom (eu-west-2).
Paystack: Taking card payments and sending refunds. What you pay and what it was for, plus the card details you enter on their own page. Your card number never reaches us. Hosted in: Nigeria.
Resend: Sending our emails. Your email address and the emails we send you, including anything attached to one, a keepsake copy of your page, for instance. Hosted in: United States.
Cloudflare: Receiving emailed replies to an enquiry. A reply you send by email passes through them on its way to us. Nothing stays there. Hosted in: United States.
Render: Application hosting and server logs. The pages you open, as they are served, and a log of which addresses were requested and when. Hosted in: Germany (Frankfurt).

We may also disclose information where the law requires it, or where it is necessary to establish, exercise or defend a legal claim.

Information sent outside South Africa

If you are a wedding guest

Health and dietary information

Children

Cookies

We use a small number of cookies, all of them necessary for the site to work. We do not use advertising cookies and we do not run third-party analytics.

Authentication: Set by our authentication provider when you sign in.
fa_device: Records whether you are on a phone or tablet, so we can serve the app layout instead of the desktop one before the page paints.
fa_device_pin: Set only if you use the ?device= override.
fa_vendor_theme: Vendors only.
fa_season: Couples only.
fa_rail: Signed-in accounts only.

Full detail is on our cookie page.

The help bot

If you report someone

If you write to us

How long we keep it

Your account and site: for as long as your account is open. Delete your account and your site, your photographs, your guest list and your vendor choices go with it. Everything except the records named below that we are required to keep.
Free accounts that nobody uses: an account nobody has signed in to for 90 days is deleted, together with everything in it, a couple's site, photographs and guest list, or a vendor's listing and its enquiries. We write first, and nothing is deleted without that letter having gone.
A vendor's company registration number: for as long as the listing exists, because we re-check the register once a year. A vendor's ID number is not on this list. It is deleted as soon as the check finishes, whether it passed or failed.
Guest replies: for as long as the couple's account exists, or until the couple deletes them.
Payments, refunds and credit history: five years from the end of the tax year they fall in, which is the period South African tax law requires. These survive an account being deleted, because keeping them is a legal obligation rather than our choice.
The record of what you agreed to, including the IP address on it: for as long as the agreement could still matter, while you have an account, and afterwards for as long as a claim under it could still be brought.
When you last signed in: for as long as the account exists. It is deleted with it.
Hashed IP addresses used for abuse prevention: 30 days, and they are cleared whenever we deploy.
The hashed count of sign-in, password-reset and sign-up attempts: one day, then deleted.
Help bot keyword fingerprints: 90 days, then deleted automatically.
Help bot feedback you send us: 180 days, then deleted automatically.
Abuse reports, and the copy of the conversation attached to one: for as long as we may need them to act on the matter or to answer a complaint about how we handled it. A report outlives the conversation it is about, and it outlives an account that is deleted, with the account's identity removed from it.
Messages you send us through the contact form: 24 months from the date you sent them, so we can look back at what was asked and what we answered.
Records we are required by law to keep, such as tax records: for the period the law requires.

How we protect it

All traffic is encrypted in transit over HTTPS.
Passwords are stored only as hashes, never in a readable form.
Access to every record is enforced in the database itself with row-level security, not only in the application, so a mistake in our code cannot expose another user's data.
Guest lists have no public read path at all.
Only staff who need access to operate the service have it.

Your rights

Under POPIA you may:

Ask what personal information we hold about you, and get a copy of it.
Ask us to correct anything inaccurate, or complete anything missing.
Ask us to delete information we no longer have a reason to keep.
Object to processing we do on the basis of legitimate interest.
Withdraw a consent you gave, including consent to show your name and date to vendors you favourite. Withdrawing stops anything further; it does not reach a conversation you have already started, because we cannot un-tell the vendor you wrote to.
Complain to the Information Regulator.

Complaints

If you think we have handled your personal information unlawfully, please tell us first. We would rather fix it. You are entitled to complain to the Information Regulator regardless:

Regulator: Information Regulator (South Africa)
Complaints: complaints.IR@inforegulator.org.za
General enquiries: inforeg@inforegulator.org.za
Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Website: https://inforegulator.org.za

Marketing

Changes to this policy

Contact us

Privacy and data requests: privacy@wechoseforever.co.za
Everything else: hello@wechoseforever.co.za
Information Officer: Gehart Kalmeir

Kept out of the page so they are not collected automatically. One click shows them, and nothing is asked of you in return.