What we keep, and why

• We use your photos to make your visualisations, and for nothing else.
• To make them, we send your photos and details to two AI providers, Google and OpenAI. They don’t use them to train their models, and neither do we.
• Your gallery is private. Nobody sees your images unless you send them a share link, and you can revoke a link at any time.
• We don’t sell your data, show ads or track you across other companies’ apps and websites.
• You can have everything deleted. The delete your data page says how.

Willow’s Wedding is run by VDE Data Solutions Limited, a company registered in England and Wales (company number 16015521), whose registered office is at Onega House, 112 Main Road, Sidcup DA14 6NE, United Kingdom.

We are the controller of your personal data, which means we decide how and why it is used. For anything about your data, write to info@willowswedding.com. A person reads every message.

• Your account. If you sign in: your email address, and your name if you give it. Clerk runs our sign-in, so we never see your password.
• A guest identifier. If you don’t sign in: a random identifier that keeps your credits and gallery with you, held in a cookie on the website or on your phone in the app.
• Your photos. The photo of your venue, the photo of the two of you, and any inspiration images you upload. If you paste a link to an image, our servers fetch the image from that address. We remove the hidden details phone photos carry, such as where and when they were taken, before we store them or send them anywhere.
• The details of your day. Which part of the venue the photo shows, the style you choose or describe in your own words, your budget, the number of guests, the country and the ceremony tradition, with your notes if you describe your own.
• What you ask for. The changes you type when you fine-tune an image.
• What Willow makes. Your visualisations and fine-tunes, including any image our checks held back, and the share links you create, with how many times each has been viewed.
• Credits and purchases. Your credit balance and its history, what you bought, how much you paid and the payment reference, and the gift cards you buy or redeem, on the website or in the app, with whether each code has been used. Purchases in the app go through Apple, and card payments on the website go straight to Stripe, so we never see your card details.
• The newsletter. Your email address and when you signed up, if you join.
• Messages. What you write to us.
• How Willow is used. The pages and screens you view, the steps you take (including the style, country and ceremony tradition chosen for each visualisation), errors, your device and browser type, and an approximate location worked out from your IP address. If you are signed in, this is linked to your account identifier, but never to your email address.
• Security checks. On the website, our human check, Cloudflare Turnstile, looks at technical signals from your browser to tell people from bots. On an iPhone, the app uses Apple’s App Attest instead, which proves to us that a request comes from the genuine app on a genuine iPhone: it uses a key made on your phone that isn’t linked to you or your account, and we keep its public half. Where App Attest can’t be used, the app shows Turnstile instead. Our servers use your IP address to limit abuse, but we don’t keep it in our database.
• Notifications. If you ask the app to tell you when a visualisation is ready, your phone’s push token (an address for notifications to this installation of the app), linked to your account or guest identifier, with the app’s version.
• Reports. If you report an image: which image, the reason you chose and any words you add. If you report one of your own images, we record your account or guest identifier with it; if you report an image on a share link, we record which link, but not who you are.
• Your consent. That you agreed to how your photos are used and that the people pictured are 18 or over, on the app’s consent screen or by creating a visualisation on the website: when you agreed, and to which version of the wording.

Two things you share can say more than they seem to. The ceremony tradition you choose, such as Christian, Jewish, Muslim or South Asian, can reveal your religion or beliefs. The photo of the two of you can show whether you are a bride and groom, two brides or two grooms, which can reveal your sexual orientation. The law calls this special category data and protects it more strictly.

We use these details to make your images only with your agreement, given as follows:

• In the app, on the consent screen you see before you add the photo of you both. It asks you to agree to your photos and the details you give us being sent to Google and OpenAI to make your images. That is your explicit consent. The app keeps a record of it on your phone, and our servers keep one too, saying when you agreed and to which version of the wording, until your data is deleted.
• On the website, a short note is shown where you add your photos. By adding your photos and creating a visualisation, you agree to the processing this policy describes. Our servers record when you did, and to which version of the note.

Our analytics also record which tradition each visualisation used, linked to your guest or account identifier. That lets us look into an error that affected your visualisations, and see whether some ceremonies come out less well than others, so we can improve them. You don’t have to name a faith: “Non-Religious / Unspecified” is one of the choices.

You can withdraw your agreement at any time by having your data deleted, but we can’t make new visualisations of the two of you without it.

The law only lets us use personal data for a good reason, which it calls a lawful basis. Ours are:

• To provide Willow. Making your visualisations and fine-tunes, keeping your gallery, credits, gift cards and share links, running your account, taking payment and sending the notifications you asked for, because that is the service you asked us for (our contract with you).
• The sensitive details above. In the app, your explicit consent, given on its consent screen. On the website, your agreement, given when you add your photos and create a visualisation, with the short note shown where you add them (see sensitive details).
• Records of purchases. Because tax law requires us to keep them.
• Keeping Willow safe. The human check and App Attest, limits on how often requests can be made, error tracking, and reviewing the images people report, because we have a legitimate interest in a secure service that works and isn’t misused.
• Understanding how Willow is used. So we can make it better, a legitimate interest you can object to (see your rights).
• The newsletter. Your consent, which you can withdraw with the unsubscribe link in any letter.
• Answering you. When you write to us, so we can help.

We don’t make decisions about you by automated means that have legal or similarly significant effects.

Willow’s images are made by AI models from two providers, who work for us under contract:

• Google (the Gemini API) receives the photo of you both, the venue photo, any inspiration images and the details of your day, including the ceremony tradition. Gemini places the two of you in the dressed venue, checks each image against your venue photo, reads inspiration images for their style and makes your fine-tunes.
• OpenAI receives the venue photo and a written decor brief built from your details, including the ceremony tradition, and dresses the venue before the two of you are added. OpenAI does not receive the photo of you both.

They process what we send only to return images and answers to us. Under their terms for businesses, neither uses it to train their models; they may keep it for a short time to detect abuse, then delete it. We never use your photos to train AI models ourselves. If we change which provider does what, we will update this policy.

These companies handle personal data so that Willow can work. They act on our instructions and may not use it for anything else, except that Apple also handles payment data under its own privacy policy, as payment providers must, and decides refunds of purchases made in the app. Stripe, which takes card payments on the website, does the same.

We don’t sell your data, show ads, or track you across other companies’ apps and websites. We would only share data beyond these providers if the law required it, to protect someone’s safety, or with a buyer if Willow’s Wedding were ever sold, in which case this policy would keep applying to your data.

Our database is in London and our analytics are in the European Union. Some of the providers above, including Google, OpenAI, Cloudflare, Clerk, Stripe, RevenueCat and Expo, may process data in the United States or other countries. When your data leaves the UK, it is protected by the safeguards UK law requires: the UK–US data bridge for providers certified under it, or the UK International Data Transfer Addendum to the standard contractual clauses in our agreements with them.

Your gallery is private to your account or guest session: only you can list it. Photos and images are kept in private storage, and the links we give you to see them stop working after an hour. Everything travels over encrypted connections.

One thing to know: each photo you upload gets a long, random identifier, and our servers will hand a fresh link to that photo to anyone who presents its identifier, without asking them to sign in, because that is how web pages load images. The identifiers can’t be guessed and we only ever give them to you, but they are not password-protected, so please don’t post one publicly.

Share links work the same way on purpose: anyone who has one can see the images it shows, until you revoke it, or until it runs out if you chose 30 days. Revoking stops the link working at once, and the image links it has already handed out stop working within the hour, but we can’t recall a copy someone has already saved.

Anyone who opens a share link can report one of its images, and you can report your own. A reported image is taken off every share link at once, while a person at Willow’s Wedding reviews the report. It stays in your own gallery, and it comes back on your links if the report is dismissed.

No system is perfectly secure. If a breach put your data at risk, we would tell you, and the Information Commissioner’s Office, as the law requires.

• Photos, details, visualisations and share links: for as long as you keep your account or guest session, so your gallery keeps working. You can have them deleted at any time.
• Your account: until you delete it.
• A guest session: until it has gone 12 months without being used. Then we delete it, with its photos, details, visualisations and share links, and keep only what we would keep if you had asked us to delete it (see what we keep). We don’t delete a guest session that still holds credits or an unused gift card it bought. Sign in to keep your gallery for longer.
• Records of purchases and the credit history: six years from the end of the financial year of the purchase, because tax law requires it. If you delete your account, we keep these records without your name or email address, and the gift cards you bought keep working for whoever has them.
• The record of your consent: until your data is deleted.
• Push tokens: while they belong to your account or guest session. Signing out in the app removes the phone’s token from your account, deleting your account deletes them all, and we stop using a token once Expo tells us the phone no longer takes notifications from the app.
• Reports of images: two years from the report, as our record of how we handled it, then we delete it. If you delete your account before then, the reports you made stay without your identifier until they are deleted.
• The newsletter: until you unsubscribe or ask us to remove you.
• Usage and error data: for as long as it helps us understand and fix Willow. When you have your data deleted, we delete your profile in our analytics, but the records of what was done are kept for that time.
• Messages to us: for as long as we need them to help you, and no longer than two years after the conversation ends.

You have the right to:

• see the data we hold about you, and have a copy of it;
• have it corrected if it is wrong;
• have it deleted;
• ask us to limit how we use it, or object to our using it, including for analytics;
• have it in a form you can take to another service;
• withdraw your consent at any time, for whatever it covers.

To use any of them, write to info@willowswedding.com. To have your data deleted, write to support@willowswedding.com instead, as the delete your data page explains. It is free, and we will answer within one month. If you are unhappy with how we have handled your data, please tell us first, so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

You can have your account, photos and visualisations deleted, whether you signed in or used Willow as a guest. The delete your data page explains how, in the app, on the website and by email, and what we keep afterwards. To ask by email, write to support@willowswedding.com with the subject “Delete my data”.

The website sets as few cookies as it can, and none for advertising:

The guest cookie is essential: without it, we can’t keep a guest’s credits. You can turn it off from the notice on your first visit, but then buying credits and redeeming gift codes need you to sign in. Clerk’s sign-in sets its own cookies under its own policy, and so does Stripe’s checkout page.

The website also keeps these in your browser’s own storage:

The app doesn’t use cookies. It keeps your guest identifier, its App Attest key’s identifier and the result of your last human check in your iPhone’s Keychain, and keeps your preferences, your consent, a copy of your gallery so it opens without a connection, and any visualisation you haven’t finished on the phone. It sends usage and error data to PostHog as the website does, linked to your account identifier if you are signed in, but never your email address. Each time it opens, it asks Expo whether there is an update, which shows Expo your IP address, the app’s version and a random identifier for this installation of the app.

The app asks to send you notifications only when you tap “Notify me when it’s ready” while a visualisation is being made, and you can turn them off at any time in your iPhone’s Settings. If you allow them, it sends us your phone’s push token, and when a visualisation or fine-tune is ready, or couldn’t be made, our servers send the notification through Expo’s push service, which passes it to Apple to deliver. A notification says only whether your visualisation or fine-tune is ready, never shows the image, and carries the identifiers the app needs to open it.

Credit packs and gift cards bought in the app are paid to Apple, and RevenueCat confirms each purchase to us. Refunds of them are Apple’s to give (see our terms). Gift codes can be redeemed in the app or on the website. You can delete your account in the app, from the Account tab (see delete your data).

Willow’s Wedding is for adults. You must be 18 or over to use it, and every person in a photo you add must be 18 or over too. We don’t knowingly collect data about anyone younger; if we learn that we have, we delete it.

When this policy changes, we update the date at the top. If a change matters to how your data is used, we will tell you on the website or in the app before it takes effect. Our terms of use cover the rest of how Willow works.