Privacy Policy

1. Information We Collect

We collect information you provide directly and information generated through your use of the Platform:

• Account information: name, email address, phone number, and password (stored as a secure hash — never in plain text), and whether you have verified your email address. You must verify your email (by clicking our verification link, completing a set-up or password-reset link, or signing in with Google) before you can view or manage bookings in your account; if you change your email address you may be asked to verify it again. Officiants may sign in with their phone number or email; phone numbers are never shown publicly.
• Booking information: ceremony date and time, location, service type, special notes, preferred area, messages exchanged through the Platform, and — after the ceremony — the officiant's confirmation of whether the signed marriage license was returned to the issuing office.
• Officiant profile data: bio, services, pricing, languages spoken, profile photo, home country, the U.S. states you serve, and any destinations (such as Caribbean islands) you are willing to travel to.
• Officiant account activity: when you last signed in and last used your officiant dashboard, so our team can support officiants who haven't finished setting up or have gone inactive. Visible only to you and our administrators.
• Officiant credential documents (optional): letters of good standing and state/county officiant registration certificates you may choose to upload. These are stored privately (never shown to clients), encrypted at rest with managed encryption keys, and access-logged; they are retained while your account is active and deleted when you close your account or on request. When you upload a credential image, it may be processed by an AI vision model to help confirm that it is a genuine credential document; the AI's assessment assists a human reviewer and never approves or rejects a credential on its own. We do not collect or store government identity documents — officiant identity is verified by Stripe (see below).
• Officiant attestation: when you join as an officiant, we record your confirmation that you are legally authorized to perform marriages in the areas you serve, along with the date and version of that confirmation.
• Trust & safety scan metadata: for Officiant accounts, we store the results of automated AI content scans of your profile text and profile photo — including a risk classification (clean, low, medium, or high), the date of the scan, a brief description of any flagged content, a cumulative violation count, any account-freeze or warning events, and a record of any content removed from your profile by our team as a result of a confirmed violation (the artifact type, removal date, and reason — not the removed content itself, which is deleted). This metadata is used solely for platform safety enforcement and is not visible to Clients. Profile text is scanned at minimum quarterly; additional randomised scans may occur at any time without prior notice. Scan results are updated each time a scan runs or when you modify your profile.
• Identity verification: performed by Stripe as part of payout setup. Stripe collects and verifies your legal identity information directly; we receive only your verification status, not your identity documents. We also receive Stripe's account-risk status for your connected account and use it, together with automated checks of your email domain and profile text (the same AI text screening described above), to decide whether your profile goes live automatically or is held for human review. The signals we looked at and the reasons for any hold are stored on your account so a reviewer can see them.
• Profile and gallery images: every image you upload for public display (your profile photo, including a Google account picture used at sign-up, and vendor portfolio images) is sent to an AI vision model (Google Gemini, with a Groq-hosted model as fallback) to check it against our image policy: no contact information, QR codes, flyers, logos, or business names on the image, and — for officiant profile photos — that it is a real photograph of you. Published images are re-screened periodically. We store the outcome of each screening (verdict, category, short reason, time) and a record of any removal on your account; the image itself is not retained by the AI provider beyond processing. A photo that fails screening is removed automatically from public view and you are notified by email so you can upload a replacement. You can ask us for a human review of any automated removal (see Section 7).
• Payment information: processed entirely by Stripe — we do not store raw card numbers or banking details.
• Vendor profile data (Vendors only): if you join our vendor program, we collect your business name, contact name, email, city, optional website, tagline, bio, pricing, and category. If you choose to provide your website URL, we fetch its publicly available page content and process it with an AI model to help pre-fill your profile (business name, city, a short description, and starting price); you review and edit the result before it is saved, and we do not store the page content itself. AI-assisted "write" and "polish" tools for your bio send the text you provide to our AI provider to return an improved version. You may also upload portfolio images to showcase your work, which are shown to Clients alongside your listing in package proposals; each image is sent to an AI vision model at upload to detect prohibited content (off-platform contact information, logos, or QR codes), and an image flagged as likely non-compliant is hidden from Clients until you replace it. Portfolio images you delete are removed from our storage. To receive payouts for package bookings, Vendors connect a Stripe Express account; identity verification is performed by Stripe, and we receive only your verification/payout status, not your identity documents. Your website and email are shown only in your own dashboard and are never displayed to Clients.
• Ceremony-builder input: details you provide to our AI vow and ceremony-script tools (such as names, relationship details, and tone or style preferences) so we can generate a draft for you. Free vow drafts and ceremony-script previews are generated before any purchase; the full personalized ceremony script is generated when you unlock it with a self-officiated ("Marry a Friend") package.
• Self-officiated package data: if you purchase a "Marry a Friend" package, we collect the information needed to provide ordination guidance, state-specific legal instructions, your personalized ceremony script, and reminders to return your signed marriage license. This includes your Celebrant's name and email address and whether they have marked themselves ordained.
• Calendar data (Officiants only): if you connect Google Calendar, we store OAuth tokens to sync your availability. We only read/write calendar events you authorize.
• Matching & waitlist preferences: when you search, join the waitlist, or use our AI matching, we collect your event date and location and the preferences you choose to share (ceremony type, language, budget, guest count, and notes) so we can rank and recommend officiants who fit. You can edit these preferences anytime before you book; once you confirm a booking they become part of your booking details. Waitlist visibility: live officiants who serve your state can see your waitlist entry's event date, state, city, ceremony type, language, budget, guest count, and notes — but never your name, email address, or phone number. An officiant may ask us to email you on their behalf to say they are interested; we send that email ourselves and do not share your contact details with them. Waitlist entries are deleted automatically about thirty (30) days after the event date.
• Concierge chat ("Zuma"): when you use our AI booking concierge, we process the messages you type (for example your date, location, tradition, budget, and the kind of ceremony you want) to find and rank officiants, check availability, and prepare a booking draft for you to review. If you are signed in to a customer account, we also save a short concierge memory on your account — the event date, location or destination, city, tradition, ceremony type, language, budget, and any vendor needs you mentioned — so the concierge can pick up where you left off next time. You can ask us to clear it at any time.
• Officiant profile assistant: when an Officiant has turned on the AI assistant on their profile, the questions you type into it are processed by our AI providers to generate an answer from that Officiant's published profile. We keep the text of the 25 most recent questions on that Officiant's account so they can see what couples ask; we filter out contact details and do not attach your name or account to them.
• Shared ceremony materials and co-officiants: ceremony scripts and day-of timelines your Officiant shares with you, and any comments or approvals you send back, are stored with your booking. If your Officiant invites a co-officiant, that Officiant can see your first name, ceremony date, time and location, the service booked, and the shared script and timeline — but not your email address or phone number.
• Booking safety checks: to protect Officiants from payment scams, we automatically look at a few signals on each booking request — the time zone your device reports, whether your account and email are new, repeated similar requests, your phone number's country code, messages that ask to pay outside the Platform, and (by sending the ceremony address to Google Places) whether the location is a known venue or a plain street address. Requests are never blocked or rejected on these signals; if several appear, your Officiant sees a general reminder to take payment only through the Platform, and our team may review the request.
• Ceremony address and card country: the ceremony address you enter when booking (used to calculate any travel fee, see Section 3), and the card billing country you select, which determines whether an international card fee applies. After payment we also record the issuing country of the card as reported by Stripe, to check it against the country you selected.
• AI tool usage (Officiants): to apply monthly fair-use limits, we count how many times you use each officiant AI tool (for example ceremony scripts, contracts, invoices, and message drafts) each month. These counts contain no generated content and are deleted automatically about forty (40) days after the month ends.
• Early-access lists: if you join an early-access list for a location we don't serve yet (for example Canada, Mexico, or a Caribbean island), we collect the name, email, role, location, tradition, and — for officiants — whether you report being authorized to perform legal marriages there. We use this only to contact you about launching in your area, and you can ask us to delete it at any time.
• Referral & channel source: if you arrive at the Platform through a partner referral link (a URL containing a ?ref= parameter) or a first-party channel link such as an officiant's shared booking page or an embedded widget (a URL containing a ?src= parameter), we store that source identifier in your browser's local storage and associate it with any booking you make within 30 days. This is used solely to attribute bookings to the referring partner or channel for program-tracking purposes. Source data does not affect the price or services you receive.
• Agreement records (Officiant business tools): when an Officiant uses our tools to generate a draft agreement and shares it for acknowledgement, we store the draft document text and, if a Client acknowledges it, the acknowledgement details — the typed name, a timestamp, the acknowledger's IP address, and a hash of the document — solely to record that the agreement was reviewed and acknowledged. This is a convenience record only and is not a legally binding electronic signature.
• Reviews you submit: after a completed, paid booking you may submit a star rating and optional written review of your officiant and of any vendor booked in your package. Reviews are displayed publicly on the Platform to help other couples. To keep communication and payment on the Platform, we do not publish contact information in reviews: review text may not contain phone numbers, email addresses, or links, and only your first name is shown (displayed as "Anonymous" where necessary). A vendor's or officiant's displayed rating is the average of these reviews.
• Usage data: pages visited, features used, and general interaction patterns to improve the Platform. First-party analytics: if you accept analytics in our cookie banner, your browser sends us product events (such as a page path, the event type, a timestamp, and a random session identifier that is not linked to your name or email). We also record a small number of de-identified demand events on our servers — for example, that a search for a given state, destination, date, or ceremony type found no available officiant, or the country and role of an early-access sign-up — with no contact details. Analytics events are deleted automatically after 180 days.
• Error diagnostics: when the Platform encounters an error, we collect technical diagnostic data (see "Sentry" in Section 3), including — for errors in your browser — a short session replay of the moments around the error in which all text is masked and images and media are blocked, and a small sample of performance timings.

When you submit a booking request, a customer account is automatically created using your email address. You will receive a one-time link (valid 48 hours) to set your password and activate the account.

2. How We Use Your Information

We use your information to:

• Facilitate bookings between Clients and Officiants;
• Send booking confirmations, status updates, and ceremony reminders via email, and occasional lifecycle messages such as review requests and anniversary / vow-renewal reminders (which may include an AI-personalized opening line referencing your ceremony). You can opt out of these non-essential notification emails at any time using the one-click unsubscribe link they contain;
• Generate AI-assisted vow and ceremony-script drafts you request, and deliver self-officiated ("Marry a Friend") package guidance and materials;
• Process payments and issue refunds through Stripe;
• Scan Officiant profile text and photos using AI to detect content that violates our platform policies — including off-platform contact information, redirect links, QR codes, and social media handles — and to enforce those policies (see Section 8 of our Terms of Service);
• Sync availability with Google Calendar (Officiants who opt in);
• Display Officiant profiles and availability to prospective Clients;
• Track referral attribution for partner referral programs;
• Improve Platform features and resolve technical issues;
• Communicate important updates about your account or the service.

3. Information Sharing

We share your information only in the following ways:

• Between booking parties: when a booking is confirmed, we share the Client's name and ceremony details with the Officiant, and the Officiant's contact information with the Client.
• Stripe: payment and payout processing. Officiants who connect Stripe have a Stripe Express account created on their behalf. Stripe's privacy policy governs their use of that data.
• AWS: database and infrastructure hosting (DynamoDB, Lambda, S3).
• Vercel: frontend hosting and anonymous analytics.
• Sentry: application error and crash monitoring. When the Platform encounters an error, we send Sentry technical diagnostic data (such as the error, the code path, and request context) to help us find and fix bugs. For errors that happen in your browser, Sentry may also receive a short session replay of the moments around the error, recorded with all text masked and all images and media blocked; we do not record replays of sessions without an error. We also send Sentry performance timings for a small sample (about 10%) of page loads. We do not send Sentry your password, payment card, or government identity data.
• Amazon SES (AWS) and Resend: transactional and notification email delivery (booking confirmations, reminders, updates). Amazon SES is our primary email provider; Resend handles a small number of internal notifications. Non-essential notification emails include a one-click unsubscribe link. Both providers report delivery events back to us — including when a message bounces or is marked as spam — which we use to keep our email deliverable and to stop sending to an address that permanently bounces or reports a message as spam (a spam report is treated as an opt-out).
• AI providers — Google (Gemini) and Groq: we use Google's Gemini models as our primary AI provider, with Groq-hosted models as an automatic fallback if Gemini is unavailable. Our booking concierge ("Zuma") works the other way round — Groq first, with Gemini as the fallback — and some automated tasks (such as personalized review-request and anniversary email lines, and officiant profile-text screening) use Groq. Depending on the feature, we send: (a) ceremony-builder input you provide, to generate vow and ceremony-script drafts; (b) officiant profile details (and, when you ask about adding a vendor, connected vendors' business name, category, city, and starting price) together with your matching preferences and the messages you type to the concierge, to rank officiants, explain fit, check availability, prepare booking drafts, and suggest package vendors; (c) booking details (such as names, ceremony date, location, service, price, and messages) when an Officiant asks our tools to draft a contract, invoice, ceremony script, or message reply, and when we write a personalized line for a review-request or anniversary email; (d) officiant profile text and photo/credential content (as image data), to detect policy violations and help confirm credential documents; (e) interface text, officiant bios, and ceremony content, to translate the experience into your chosen language; and (f) for Vendors, the public content of a website URL you provide and any bio text you ask us to write or polish, to pre-fill and improve your vendor profile, and your uploaded portfolio images (as image data), to detect prohibited content. Content processed through the Gemini API and by Groq is not used to train their models or for advertising. Where an Officiant has turned on assistant replies, the most recent messages in a booking's thread and the booking details are also sent to Groq to generate one clearly labeled holding reply when the Officiant has not answered within the time they chose.
• Google (calendar): calendar integration for Officiants who connect Google Calendar (see below).
• Address services — Google Places, U.S. Census Bureau Geocoder, and OpenStreetMap Nominatim: as you type a ceremony address, the text is sent to Google Places to suggest matching addresses. To calculate an Officiant's travel fee, the ceremony address and the Officiant's home city are converted into map coordinates: street addresses by the U.S. Census Bureau Geocoder, and city names (or addresses the Census service can't place) by OpenStreetMap Nominatim. Only the address text is sent, never your name or contact details.
• Referral partners: if a booking is attributed to a referral partner, we share only the fact of the attribution (not your personal details) with that partner for program-tracking purposes.
• Wedding vendors (opt-in only): if you ask us to connect you with local vendors after booking (photographers, DJs, hair & makeup artists, etc.), we share your name, email, phone number, event date, and event location with vendors in the categories you selected. We never share your contact information with vendors unless you explicitly opt in, and you may withdraw consent by contacting us. Vendors pay us a referral fee for these introductions. Separately, if you book a vendor as part of a ceremony package, we share your booking details (such as your name and event date) with that vendor so they can fulfill the service you booked. In all cases vendors are independent businesses and are not employed or endorsed by Book a Ceremony.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

Data obtained through Google APIs is used only to provide the calendar sync feature and is not used for advertising, profiling, or shared with third parties beyond what is necessary to operate that feature, in compliance with Google's API Services User Data Policy.

Book a Ceremony's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When an Officiant connects Google Calendar, we request the https://www.googleapis.com/auth/calendar.events scope, which lets us read and write the calendar events needed to sync availability. We request no other Google scopes and access no other Google data.

4. Data Retention

Account data is retained for as long as your account is active. Booking and payment records are retained for 7 years for financial and legal compliance. If you delete your account, your personal profile information is removed; anonymized booking records may be retained for compliance purposes. You may request deletion of your account by contacting us at bookaceremonyllc+support@gmail.com.

Officiant credential documents (letters of good standing and registration certificates) are retained securely while your account is active, so we can stand behind a credential-review decision or resolve a dispute. They are stored in a private, access-logged bucket and encrypted at rest with managed encryption keys, and are deleted when you delete your account or on request. We practice data minimization: we do not collect or store government identity documents — officiant identity is verified by Stripe.

Trust & safety scan results are stored on your Officiant profile record and are updated each time a scan is run. Scan metadata (classification, date, and flagged reasons) is deleted when your account is deleted. Profile photos that are rejected by the automated photo scan are not saved to permanent storage — they expire from temporary storage within 24 hours via an S3 lifecycle rule.

Vendor portfolio images are stored while they remain in your gallery and are deleted from storage when you remove them. An image flagged by the AI vision scan as likely containing prohibited content is retained but hidden from Clients until you replace it. Uploads that are never confirmed expire from temporary storage within 24 hours via an S3 lifecycle rule.

Referral source data stored in your browser expires after 30 days. Server-side referral attribution on a completed booking is retained as part of the booking record for 7 years.

Other automatic deletion: first-party analytics events are deleted after 180 days; waitlist entries about 30 days after the event date; and officiant AI-usage counts about 40 days after the end of the month they cover. Concierge memory is kept on your customer account until you ask us to clear it or delete your account.

5. Cookies and Local Storage

We use httpOnly session cookies to maintain your login state. These cookies are set server-side, cannot be accessed by JavaScript, and expire when you log out or your session expires. We do not use third-party tracking cookies or advertising cookies. Our anonymous analytics (Vercel Analytics) do not use cookies and do not track individuals across sites.

We use browser local storage to remember your referral source (if you arrived via a partner link) for up to 30 days. This data is not shared with advertisers and is used solely for referral attribution.

Analytics consent. Your choice in our cookie banner is saved in your browser's local storage under bac_consent. Only if you accept, we create a random session identifier in your browser's session storage under bac_sid (cleared when you close the tab) and send the first-party analytics events described in Section 1. If you decline, no first-party analytics events are sent from your browser. You can change your choice by clearing your browser storage for this site.

6. Security

We use industry-standard security practices: HTTPS encryption in transit, encryption at rest for stored documents, PBKDF2 password hashing, time-limited session tokens, and access-controlled AWS infrastructure. Credential documents are held in a private, non-public storage bucket and every access to them is logged. We do not store raw payment card data or government identity documents — payment processing and identity verification are handled by Stripe. No system is 100% secure. Please use a strong, unique password for your account.

7. Your Rights

You have the right to:

• Access the personal information we hold about you;
• Correct inaccurate information through your account dashboard;
• Request deletion of your account and personal data;
• Withdraw Google Calendar authorization at any time through your Google account settings;
• Request a human review of any automated decision applied to your account — including a trust & safety flag, an automatically removed photo, or a profile held from going live — by contacting us at the address below.

To exercise these rights, contact us at bookaceremonyllc+support@gmail.com.

8. Your U.S. State Privacy Rights

This Service is intended primarily for users in the United States, including Puerto Rico. Users outside the United States — for example Clients planning a destination ceremony in the Caribbean, or officiants based in Canada or a Caribbean country who create a profile or join our early-access list — should know that we and our service providers process and store your information in the United States, under this Policy and U.S. law. We do not sell your personal information, and we do not share it for cross-context behavioral (targeted) advertising.

Depending on your state of residence — including California (CCPA/CPRA), Virginia (VCDPA), and Colorado, Connecticut, Texas, and other states with comprehensive privacy laws — you may have the right to: confirm whether we process your personal information and access it; correct inaccuracies; delete it; obtain a portable copy; and opt out of the sale of personal information, targeted advertising, and profiling (none of which we conduct).

California residents. The categories of personal information we collect are described in Section 1 (identifiers and account information, including phone number; booking and transaction information; payment-status information; internet/usage activity, including first-party analytics and error diagnostics; referral source; matching, waitlist, and concierge-chat preferences; questions typed to an Officiant's profile assistant; ceremony address and card billing country; agreement-record metadata; and, for officiants, professional and credential information, home country and service areas, AI-tool usage counts, and trust & safety scan metadata). We collect it for the purposes in Section 2 and disclose it only to the service providers listed in Section 3. We do not knowingly process sensitive personal information beyond what is necessary to provide the service, and we do not use or disclose it in ways that would require a right to limit.

To exercise any of these rights, contact us at bookaceremonyllc+support@gmail.com. We will verify your identity before responding, you may use an authorized agent, and we will not discriminate against you for exercising your rights. You may appeal a decision by replying to our response.

9. EU and UK Users — GDPR / UK GDPR

This Platform is designed for use in the United States. If you are located in the European Union, the United Kingdom, or another jurisdiction with comprehensive data-protection law, the following additional information applies.

Data controller. Book a Ceremony LLC, contactable at bookaceremonyllc+privacy@gmail.com, is the data controller for personal information collected through this Platform.

Legal basis for processing. We process your personal data on the following bases:

• Contract performance (Art. 6(1)(b) GDPR): processing necessary to provide the booking, payment, and ceremony services you request.
• Legitimate interests (Art. 6(1)(f) GDPR): improving the Platform, preventing fraud, enforcing platform policies (including automated content safety scanning), and communicating service updates. Our legitimate interests do not override your rights.
• Legal obligation (Art. 6(1)(c) GDPR): retaining financial records as required by law.
• Consent (Art. 6(1)(a) GDPR): where we rely on consent (e.g., Google Calendar sync), you may withdraw it at any time.

Automated decision-making. We use AI-assisted tools to rank and recommend officiants — and to suggest wedding vendors you can add to your booking as a package — based on your search preferences and what you tell our concierge (Art. 22 GDPR). These suggestions help surface relevant options and are one factor in your decision — they do not produce legal or similarly significant effects, and you are always free to choose any available officiant or vendor, or none, regardless of what is suggested. We also use automated AI tools to scan Officiant profile content and photos for policy violations. Profile text flags are reviewed by a human administrator before any enforcement action is taken. Some decisions are made automatically, without prior human review: a profile or portfolio photo that fails the automated image screening is removed or hidden right away, and a new Officiant profile whose automated go-live checks do not pass is held from going live until a person reviews it. You may contact us to request a human review of any match, recommendation, content-safety flag, photo removal, or profile hold.

International data transfers. We use US-based service providers (Stripe, AWS, Vercel, Resend, Sentry, Google, Groq, the U.S. Census Bureau Geocoder) and OpenStreetMap Nominatim (operated by the OpenStreetMap Foundation). Transfers to the US from the EU or UK are made on the basis of Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms where applicable. Stripe, AWS, and Vercel maintain EU/UK data transfer agreements. Contact us at the address below if you would like more information about the safeguards in place.

Additional rights (EU/UK residents). In addition to the rights in Section 7, you also have the right to: data portability (receive your data in a machine-readable format); restrict processing in certain circumstances; and object to processing based on legitimate interests. You also have the right to lodge a complaint with your local supervisory authority — in the UK, the Information Commissioner's Office (ICO, ico.org.uk); in the EU, your national data protection authority. To exercise your rights, contact us at bookaceremonyllc+privacy@gmail.com. We will respond within 30 days.

10. Children's Privacy

The Platform is intended for users 18 and older. We do not knowingly collect personal information from children under 13, and we do not knowingly sell or share the personal information of minors under 16. If we become aware that we have collected such information, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email or a prominent notice on the Platform prior to the changes taking effect.

12. Contact

Questions about this Privacy Policy? Contact us at bookaceremonyllc+support@gmail.com.