Privacy Policy
Last updated 9 July 2026 · Version 1.0
RSVPji is a WhatsApp-based RSVP service for weddings, operated by 5 Rivers Lab (“we”, “us”). This policy explains what personal data we handle, why, and what you can do about it. It covers two groups of people: the couple or family who buy the service, and the wedding guests we message on their behalf.
The short version. We hold guests' names, phone numbers, RSVP answers and any dietary or accommodation needs they tell us. We use them only to run that one wedding's RSVPs. We do not sell, share or advertise to anyone. Everything is deleted 30 days after the wedding date unless you ask us to keep it.
1. Who is the data controller
For the couple's own account data, RSVPji is the controller.
For the guest list, RSVPji acts as a processor on the couple's instructions — the couple is the controller of their guests' data, because they decided who to invite and chose to use us to contact them. We sign a data processing agreement with the couple as part of our terms.
Contact: [email protected]
Postal address: available on request — email the address above and we'll provide it.
ICO registration: C1953912
2. What we collect
| Who | Data | Where it comes from |
|---|---|---|
| Couple / family | Name, email address, phone number, wedding date(s), venue, billing details | You, when you enquire or sign up |
| Guests | Name, mobile number, relationship to the couple, which events they're invited to | The guest list the couple gives us |
| Guests | RSVP status, plus-one details, dietary requirements, accommodation needs, and the content of their WhatsApp messages to us | The guest's own replies |
| Everyone | Message timestamps, delivery status, and basic server logs | Generated automatically |
A note on dietary requirements
A dietary requirement can reveal something about a person's religion or health — under UK GDPR that makes it special category data. We collect it only because the guest volunteers it in reply to a direct question about catering, we use it for nothing but passing the caterer a headcount, and we delete it with everything else. If a guest would rather not say, they can simply not answer.
3. Why we're allowed to use it
- Couple's data — contract. We need it to provide the service you've bought.
- Guests' data — legitimate interests. Collecting RSVPs for a wedding a guest has been invited to is what a guest would reasonably expect. We've weighed this against their privacy: the messages are expected, relevant, easy to opt out of, and short-lived.
- Dietary and health-adjacent details — explicit consent. Given by the guest when they choose to tell us.
- Billing records — legal obligation. Kept for six years for HMRC.
4. Who we share it with
We do not sell your data or your guests' data. We do not use it to train models. We share it only with:
| Sub-processor | What for | Where |
|---|---|---|
| Meta Platforms Ireland (WhatsApp) | Delivering and receiving the messages themselves | EU / US |
| Groq, Inc. | Generating message text and reading replies for RSVP status | US |
| Your wedding venue and caterer | Final headcount and dietary list, at the couple's instruction | UK |
Transfers outside the UK rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. Message content sent to Groq is processed to generate a reply and is not retained by them for training.
5. How long we keep it
- Guest list, messages and RSVP data: deleted 30 days after the wedding date, automatically, unless the couple asks us in writing to hold it longer.
- Couple's account and correspondence: 12 months after the wedding, then deleted.
- Invoices and payment records: 6 years, as UK tax law requires.
6. Security
Data is stored in an encrypted database on infrastructure we control in the UK, reachable only over authenticated, encrypted connections. Access is limited to the people running your wedding's campaign. WhatsApp messages are encrypted in transit by WhatsApp itself. No system is perfectly secure, and we will notify you and the ICO within 72 hours of becoming aware of a breach that puts anyone at risk.
7. Guests: your rights and how to stop the messages
Reply STOP to any message and we will stop contacting you immediately and
permanently for that wedding. You do not need to give a reason.
Under UK GDPR you also have the right to:
- ask what data we hold about you, and get a copy;
- have it corrected if it's wrong;
- have it erased;
- object to us processing it at all;
- ask us to restrict how we use it;
- withdraw consent for anything you consented to, such as your dietary details;
- receive it in a portable format.
Email [email protected]. We respond within one month. Because the couple is the controller of the guest list, we may need to pass your request to them — we'll tell you if we do.
8. Automated processing
Our replies are written by a large language model, and a second model reads your reply to work out whether you're coming. This is not a decision with legal or similarly significant effects. A human operator can see every conversation, can pause it, and can take over at any point. If a model gets your answer wrong, tell us and we'll correct it.
9. Children
We do not knowingly message anyone under 16. Guest lists occasionally include children as attendees — we hold a name and an event, nothing more, and we message the adult who invited them.
10. Complaints
If you're unhappy with how we've handled your data, please tell us first — but you have the right to complain directly to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or on 0303 123 1113.
11. Changes
If we change this policy in a way that materially affects you, we'll email couples with an active wedding. The version number and date at the top always reflect the current text.