Who we are
Merrifold Ltd, a company registered in England and Wales (company number 17335652). Registered office: Westgate House, 1 Westgate Avenue, Bolton, Greater Manchester, BL1 4RF, England. Merrifold Ltd operates Merrifold at merrifold.com. We are the data controllerfor personal data described in this notice, except where we process data strictly on a host's instructions (for example, guest RSVP details the host can see) — in those cases the host is also a controller for how they use that information at their event.
Contact us about privacy: privacy@merrifold.com.
What we collect
We collect only what we need to run the service. Depending on how you use Merrifold, this may include:
Host accounts
- Email address (and name if you provide one) when you sign in;
- Profile and event content you create — titles, dates, locations, descriptions, images, gift lists, RSVP settings;
- Technical logs (IP address, browser type, device identifiers) for security and debugging.
Guest RSVPs and event participation
- Name, email address, and optional phone number;
- RSVP response (yes, maybe, no, waitlist), party size, meal preferences, dietary notes, and optional message to the host;
- A private guest token or link so you can change your RSVP without an account.
Guests do not need an account to RSVP. Email is required when you say you are attending or might attend, so we can send updates about the event.
Gift reservations
- Which item you reserved and when;
- An optional name if you choose to tell the host the gift is from you;
- A private budget band you select in the interface — this is used only to size your gift and is never shown to the host.
Media uploads
- Photos and invitation artwork hosts upload to their events;
- Gallery contributions where the host enables them.
Cookies and similar technologies
We use essential cookies for sign-in, security, and remembering your cookie choices. Analytics and marketing cookies are off until you opt in — see our cookie banner. More detail is in the Cookies section below.
Why we use your data (lawful bases)
Under UK GDPR we rely on:
- Contract — to provide the service you ask for (hosting your event, processing your RSVP, sending reminders you have signed up for);
- Legitimate interests — to keep the platform secure, prevent abuse, improve features, and operate affiliate links transparently (balanced against your rights);
- Consent — for non-essential cookies, marketing emails where required, and any optional processing we ask for separately;
- Legal obligation — where we must keep records or respond to lawful requests.
Who we share data with
We use trusted processors who handle data only on our instructions:
- Supabase — database, authentication, and file storage (EU/US infrastructure with appropriate safeguards);
- Vercel — hosting and delivery of the Merrifold website;
- Resend — transactional email (magic links, RSVP confirmations, reminders);
- Stripe — payment processing when premium features go live (card details go directly to Stripe; we receive only tokens and billing metadata).
We may also share data with event hosts (for example, your RSVP name and dietary notes), other guests only where the host has chosen a visible guest list, affiliates when you click a labelled gift link, and authorities when required by law.
We do not sell your personal data.
International transfers
Some processors store or process data outside the UK. Where they do, we use appropriate safeguards — such as UK adequacy decisions, Standard Contractual Clauses, or equivalent mechanisms — so your data stays protected to UK GDPR standards.
How long we keep data
- Host account data — while your account is active, then deleted or anonymised within a reasonable period after closure;
- Event and RSVP data — for the life of the event and a period afterwards so hosts can follow up (typically up to 24 months unless you ask us to delete sooner);
- Gift reservation records — long enough for hosts to coordinate gifts, then anonymised where possible;
- Consent records — kept as proof of your choices;
- Server logs — rotated on a short rolling basis unless needed for security investigations.
We may keep anonymised statistics indefinitely.
Your rights
Under UK GDPR you have the right to:
- access a copy of your personal data;
- correct inaccurate data;
- delete your data in certain circumstances;
- restrict or object to some processing;
- data portability where processing is automated and based on contract or consent;
- withdraw consent at any time (for example, via Cookie preferences);
- complain to the Information Commissioner's Office (ico.org.uk).
You can download a JSON copy of your data or request account deletion from your account settings. Account deletion signs you out immediately and archives your events. You can restore your account by signing in within 30 days; after that, your remaining personal account data is permanently removed — though you’re always welcome to start fresh with the same email later. You can also email privacy@merrifold.com and we will respond within one month.
Children
Guests of all ages may be invited to events, including children. We collect only what is needed for the RSVP (typically a name and, for attendees, contact details a parent or guardian provides). We do not knowingly profile children for marketing. Hosts should obtain appropriate consent from parents or guardians before submitting a child's details. If you believe we hold a child's data in error, contact us and we will delete it promptly.
Host accounts are not intended for children under 13.
Cookies
Essential cookies let you sign in, protect your session, and remember your cookie choice. They do not require consent.
Analytics cookies (not yet in use) would help us understand how people use Merrifold in aggregate. Marketing cookies (not yet in use) would support measured outreach. You can accept or decline these categories in the cookie banner or reopen Cookie preferences from the site footer at any time.
Changes
We may update this notice when our practices change. We will post the new version here and update the “Last updated” date. Significant changes may also be highlighted in the product or by email where appropriate.
Contact
Data protection enquiries: privacy@merrifold.com.