Privacy policy

Who we are

Aisley is an AI wedding planner for couples in the UK, at getaisley.com. It is run by Dominika Szymanska, a sole trader trading as Aisley. We are the controller of your personal data under UK data protection law. Our registration with the Information Commissioner's Office is pending.

We are a small team and have no data protection officer, because the law does not require one of us. Aisley's founders handle data protection themselves. Write to hello@getaisley.com about anything in this policy, and a founder will reply.

The short version

• We use your data to plan your wedding with you, and for nothing that works against you. We never sell it and never use it for advertising.
• Aisley sends email from your Gmail only when you send it or explicitly ask her to. We never read your inbox through Google.
• Your wedding details go to the AI models that power Aisley while she works on them. Those providers do not train their models on it.
• You can delete your account yourself, from Account settings, and everything attached to it goes.

What we collect

Your account. Your email address, your name, and either a hashed password or the Google account you sign in with. If you use Google, Google tells us your name, email address and profile picture. If you add a photo of yourself, we keep it.

Your wedding. What you share with Aisley while planning: the date or timeframe, region, budget, guest count and style, your role in the wedding and your partner's name, your conversations with Aisley, your notes, to-do list and budget, your venue and supplier shortlists, your moodboards and the images and links you add to them, and the attachments that arrive with supplier emails.

Email. If you connect a Gmail to a wedding, we hold the address and a token from Google that lets Aisley send from it. We keep the emails Aisley sends for you and the replies that belong to your venue and supplier conversations, attachments included. The next section explains how forwarded mail is handled.

Payments. If you subscribe or top up, our reseller Polar takes the payment. We receive a record of the plan or top-up, its status and renewal date, and keep a running count of the credit each wedding uses. We never see your card details.

How you use the site. For every visitor, the pages viewed, the clicks made on them, the link you arrived from, your browser, device type and approximate location derived from your IP address, and any errors your browser hits, unless you turn usage analytics off. Once you sign in, the actions you take in the product are linked to your account. If you allow it, we also record your signed-in sessions as replays so we can see what confuses people and what breaks. We never record signed-out visits.

What you send us. Feedback you send from inside Aisley, and any email you send to an address on getaisley.com.

The pre-launch waitlist. If you joined the waitlist before Aisley launched, we still hold your email address and your answer to the question about what you would most like help with.

You do not have to give us anything, but we need an email address to make an account, and Aisley cannot plan around what she has not been told.

Forwarded email

Replies reach Aisley only if you set Gmail to forward incoming mail to your wedding's own address on getaisley.com. Gmail then forwards everything that arrives, so here is exactly what happens to it.

• Mail in a conversation Aisley started, or from a venue or supplier she has already written to, is filed with that conversation and kept.
• Mail from a sender Aisley does not know yet is checked by a screening model. It sees the sender, the subject and the first 2,000 characters of the text, and answers one question: is this a business writing to you about your wedding? If yes, the sender becomes a new supplier conversation and the mail is kept. If no, it is discarded.
• Everything else is discarded when it arrives. We count how many emails were discarded, and nothing else about them is kept.

If you would rather Aisley never saw your other mail, use a Gmail address kept for the wedding.

Information about other people

Planning a wedding involves other people, so Aisley holds some information about people who have not signed up themselves.

• Venues and suppliers: the names, email addresses and other contact details of the people Aisley writes to or finds on their business's website, and the emails they exchange with you, including any personal details they choose to include.
• Your partner and family: names and anything else you tell Aisley about them.
• People you invite to a wedding: their email address, which we use to make the invitation and, if you ask, to email them the link. Once they accept, they have their own account and this policy applies to them directly.
• Guests: Aisley has no guest list yet, but you may mention guests in conversation or in your notes, such as a name, a dietary need or an access need.

Please share only what the planning needs, and only invite someone who has agreed to join. There is a section further down for venues and suppliers who want to know how we handle their information.

Sensitive details

Planning a wedding can involve details the law treats with extra care, such as a religious ceremony, a health condition, or a guest's dietary or access needs. We hold these only because you choose to tell Aisley, and we use them only to plan around them. We rely on your explicit consent, which you give by sharing them for that purpose. You can withdraw it at any time by deleting the detail from your notes and conversations, or by asking us to.

Why we use it, and our legal grounds

UK data protection law asks us to name a legal basis for each use. Where we rely on legitimate interests, we have weighed them against your rights, and you can ask us for that assessment.

We never sell your data, and never share it with anyone for advertising. We do not send marketing email to account holders. We do not use your data to train AI models, ours or anyone else's.

We may turn usage into statistics that identify no one, such as how many weddings use the venue search, and use them to decide what to fix and build.

If we ever want to use your data for a purpose that does not fit the reasons above, we will tell you first, and ask for your consent where the law requires it.

How Aisley uses AI

Aisley runs on Claude models made by Anthropic. When you talk to her, when she drafts an email, reads a reply, searches for venues, describes an image or transcribes an attachment, the text or image she is working on goes to the model, and the answer comes back. Requests pass through Vercel's AI Gateway, which sends each one to Anthropic or to the same Claude models hosted by Amazon Web Services or Google Cloud, depending on which is available. None of them may train their models on what we send, and they keep it only for a short period, for safety and abuse monitoring, under their commercial terms.

The screening of forwarded mail uses Jev, a classification model from TypeSafe AI, through the same gateway. It sees the sender, subject and first 2,000 characters of an email from a new sender, and answers yes or no.

When Aisley searches the web for venues and suppliers, she sends search queries built from your wedding's details, such as region, guest count, budget and style, to Exa, a search provider. Exa also reads venue web pages for her. We never send your name or email address with a search.

Aisley drafts, ranks and suggests, and she explains why. She makes no decision about you that has a legal or similarly significant effect. An email goes out because you sent it or explicitly asked her to, and every venue is shortlisted, contacted or booked by you. The one decision she makes without you is whether a forwarded email from a new sender is about your wedding. If you think she got one wrong, tell us.

Google user data

If you sign in with Google, we receive your name, email address and profile picture, and use them only to create and run your account.

If you connect a Gmail, we ask Google for permission to send email from it and for its address, so we know which address is connected. Aisley cannot read, search or delete anything in that inbox. We use this access only to send the emails you send, or explicitly ask Aisley to send, to venues and suppliers. The emails Aisley sends are kept with your wedding, as described above.

The token Google issues is stored encrypted on our servers. It is never sent to your browser or to any other provider. When you disconnect Gmail, delete the wedding or delete your account, we delete the token and revoke it with Google straight away, unless another wedding on Aisley still sends from the same address. You can also remove Aisley's access at any time under Third-party connections in your Google Account. That stops Aisley sending from the Gmail, but it does not delete what we already hold, such as the emails she sent. Delete the wedding or your account for that.

We share Google user data only to run these features. Convex stores it for us. Your Google name and email address are otherwise handled like the rest of your account details, by the providers listed below for the jobs listed there, such as Resend for sign-up and invite emails and Polar for billing. The Gmail token goes to no one but Google. The connected Gmail address is seen by the people on your wedding, by Aisley's AI models while she works on your emails, by any AI assistant you connect to Aisley yourself, and, as the sender, by the venues and suppliers you write to.

We protect Google user data with encryption in transit and at rest, server-side access checks and restricted staff access, as set out in How we protect your data.

No one at Aisley reads data we receive from Google unless you ask us to, for example to look into a problem you report, it is needed to investigate abuse or a security issue, or the law requires it.

Aisley's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, we use data received from Google APIs only to provide and improve the Gmail sending and sign-in you see in Aisley. We never sell it, never use it for advertising, and never transfer it to anyone except to provide those features, to keep the service secure, to comply with the law, or, with your explicit consent first, as part of a merger or sale of Aisley. We do not use it to create, train or improve any AI or machine learning model, ours or anyone else's.

Who we share it with

We do not run our own servers. These companies process data on our behalf, under contracts or terms that bind them to our instructions and to UK data protection standards.

Some organisations receive data from us and decide for themselves how to use it, under their own privacy policies.

• Polar Software, Inc. is our reseller and the merchant of record for payments. It receives the wedding owner's name and email, what they buy, and the credit each wedding uses, and handles payment details itself. See Polar's privacy policy. It is based in the United States.
• Venues and suppliers receive the emails you send them through Aisley, from your own address.
• If you connect Aisley to another AI assistant, such as Claude or ChatGPT, that assistant receives what it asks Aisley about your wedding. You choose the assistant and grant the access yourself, and can revoke it under Connected apps in your wedding's settings.
• Everyone you invite to a wedding sees everything in it.

When you add a link to a moodboard or Aisley looks up a venue's website, our servers fetch that page the way a browser would. The site sees a request from us, not from you. For a TikTok link, we ask TikTok's public embed service for the video's cover image. When Google's address lookup is unavailable, we look up venue places with OpenStreetMap's Nominatim service. Neither receives anything about you beyond the link or the place name.

Venue and supplier websites you open from Aisley have their own privacy policies. We do not control what they collect, so read theirs before you share anything with them directly.

We may also disclose data:

• when the law requires it, for example to the police, a court or a regulator;
• to protect people's safety or rights, including to bring or defend a legal claim;
• to our professional advisers, such as an accountant, a lawyer or an insurer, when they need it to advise us, under a duty to keep it confidential;
• to a buyer if Aisley is ever sold, in which case this policy would continue to apply to it, and we would share only what the buyer needs to assess the sale before it goes through.

Data leaving the UK

Your account and planning data are stored in the EU, which the UK recognises as giving adequate protection. Some providers above process data in the United States or Canada. Canada has an adequacy decision from the UK. For the United States, we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, and otherwise on the International Data Transfer Addendum to the EU standard contractual clauses, with a transfer risk assessment. Write to us if you would like a copy of the safeguard for a particular provider.

How we protect your data

We treat everything you share with Aisley as sensitive, and the data we receive from Google, your Gmail token above all, most carefully. These security procedures protect its confidentiality.

• Encryption in transit: every connection to Aisley, and from Aisley to Google and the other providers above, is encrypted with TLS.
• Encryption at rest: your account, planning data, files, Google account details, connected Gmail address and Gmail token are stored with Convex, encrypted with 256-bit AES. Convex is independently audited to SOC 2 Type II.
• The narrowest Gmail permission: we ask Google only for permission to send email and for the address it sends from. Aisley cannot read, search or delete anything in your inbox, so there is no inbox data for us to hold or lose.
• The Gmail token stays on our servers: it is never sent to your browser, to the AI models or to any other provider, and it is used for one thing only, sending the emails you send or explicitly ask Aisley to send.
• Access ends when you say so: disconnecting Gmail, deleting the wedding or deleting your account deletes the token and revokes it with Google straight away, unless another wedding on Aisley still sends from the same address.
• Access controls: every request is checked on our servers against your account, so only you and the people you invite to a wedding can see it or send from its Gmail.
• Staff access: no one at Aisley reads data we receive from Google unless you ask us to, for example to look into a problem you report, it is needed to investigate abuse or a security issue, or the law requires it.
• Passwords: we never store your password, only a one-way scrypt hash of it. A password reset link works once and expires after an hour.
• Keys and secrets: the credentials that let Aisley talk to Google and our other providers are kept in our hosting providers' protected settings, never in our code.
• If something goes wrong: no system connected to the internet is completely secure, so we cannot promise a breach will never happen. If one puts your personal data at risk, we will tell the Information Commissioner's Office within 72 hours of finding it and tell you without undue delay where the risk to you is high.

How long we keep it

Where the table gives no fixed period, we keep data only while we need it for the reason we collected it. To decide how long that is, we weigh how sensitive the data is, the harm it could do if it leaked, whether we could do the job with less, and any legal duty to keep it. When we no longer need it, we delete it or strip out anything that identifies you.

Copies in our providers' backups are not used for anything while they wait to expire. We may keep data for longer than the table says only if we need it to bring or defend a legal claim, and only for as long as that takes.

Cookies and similar technologies

Cookies are small files a website stores in your browser so it can recognise you on the next page or the next visit. Browser storage does the same job but stays on your device. We use a handful of both. Most are needed for the site to work. PostHog's are for analytics. Google sets its own when the map on the venue pages is open.

Session replays are only made with your permission. Once you sign in, Aisley asks once whether PostHog may record your sessions: what appears on the page as you use it, and your clicks, scrolls and mouse movements. We watch replays to see what confuses people and what went wrong when something breaks. Passwords and anything typed into a form field are hidden from them. Text already on the page, such as your notes, is not. You can change your answer any time under Session recordings in Account settings. Signed-out visits are never recorded.

Vercel's page view measurement uses no cookies. PostHog's identifier is set when a page first loads, without asking you first. UK law allows that for analytics used only to improve a service, as long as we tell you and let you refuse. To refuse, turn usage analytics off in Analytics settings at the foot of any public page, or in Account settings once you sign in. It is free, works straight away, deletes PostHog's identifier and stays off in that browser. Aisley works the same without it. PostHog does not act on your browser's Do Not Track setting. You can also block or delete cookies and site data for getaisley.com in your browser, or use a tracker blocker. Blocking the sign-in cookies stops you signing in.

Browser settings apply to one browser on one device, so change them on each one you use. The Information Commissioner's Office explains how to see and clear cookies in its guide for the public. When we add or change a cookie, we update this table and the date at the top of the page.

Your rights

You have the right to:

• ask for a copy of the personal data we hold about you;
• have it corrected if it is wrong or incomplete;
• have it deleted, where we have no good reason to keep it;
• ask us to restrict how we use it, for example while we check whether it is accurate;
• receive the data you gave us in a machine-readable form, or have us send it to another service;
• withdraw your consent at any time, where we rely on it, without affecting what we did before.

You also have the right to object, at any time, to our using your data where we rely on legitimate interests, analytics included. We will stop unless we have compelling grounds that override your interests, or need the data for a legal claim. You can turn usage analytics off in Analytics settings at the foot of our public pages or in Account settings, and session recordings off in Account settings. Either takes effect straight away.

You can correct most things yourself in your wedding's settings or by telling Aisley, and delete your account yourself. For anything else, write to hello@getaisley.com. We may need to confirm it is you. We will answer within one month, or tell you within that month if a complex request needs up to two more. There is no charge. If we cannot do all that you ask, we will tell you why, unless the law stops us.

Deleting your account

You can delete your account at any time from Account settings. Doing so deletes every wedding you own, with its conversations, notes, emails, files and Gmail connection, ends its plan, removes you from weddings others own, and asks PostHog to delete your analytics profile ten minutes later. If you own a wedding you have invited others to, delete it or remove them first. You can also delete a single wedding from its settings.

If you set Gmail to forward mail to a wedding, turn the forwarding off as well. We discard anything still forwarded to a deleted wedding, but the rule lives in your Gmail and only you can remove it.

If you joined the pre-launch waitlist and have no account, write to hello@getaisley.com and we will remove your entry.

If you are a venue or supplier

If a couple uses Aisley to plan their wedding, we may hold your name, business contact details, and the emails you exchange with them. Contact details either come from the couple, from your emails, or from your business's public website. Emails reach you from the couple's own address, written with Aisley's help.

We use this only so the couple can plan with you, on the basis of their legitimate interests and ours in running the planning they asked for. It is kept for as long as the couple keeps the wedding on Aisley. You have the same rights as anyone else in this policy, including to object. Write to hello@getaisley.com.

Children

Aisley is for adults. You must be 18 or over to make an account, and we do not knowingly collect data from children. If you think a child has made an account, tell us and we will delete it.

Complaints

If you are unhappy with how we have handled your data, you can complain to us at hello@getaisley.com. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to complain to us first.

Changes to this policy

When this policy changes, we update this page and the date at the top. If a change affects how we use data you have already given us, we will email account holders and show a notice in Aisley before it takes effect. Earlier versions are available on request, and questions are always welcome, at hello@getaisley.com.