Privacy Policy

PlanYourDIYWedding.com · Effective November 13, 2026 · Last updated November 13, 2026

1. Who we are and what this policy covers

This policy explains what personal information we collect when you buy and use the First-Three Framework web app, why we collect it, who sees it, how long we keep it, and what rights you have.

We are PlanYourDIYWedding.com ("we", "us"), of 6D - 7398 Yonge St #745, Thornhill, Ontario, L4J 8J2, Canada. For any privacy question or request, write to [email protected].

This policy covers:

the First-Three Framework web app at app.planyourdiywedding.com ("the app"), and

our website and checkout pages at planyourdiywedding.com ("the website").

The short version

We store your wedding plan so that you and your partner can use it from any device.

What you type into your plan (names, guest lists, venues, budget figures) can be seen only by you and the partner you invite. We do not sell it, we do not use it for advertising, and we do not send it to our email or marketing tools.

If your purchase is refunded, your access ends, and we permanently delete your plan 90 days later, after warning you by email.

You can ask for a copy of your information, or for it to be deleted, at any time.

2. What we collect

Purchase and contact details

What we collect: Your email address, your name, order number, product bought, payment status and dates (paid, refunded, disputed), and an internal customer reference from our customer system

Why: To create your account, give you access, handle refunds and support, and keep accounting records

Where it comes from: You, at checkout

Payment details

What we collect: Card or wallet details are entered with, and held by, our payment processor. We do not see or store your full card number

Why: To take payment

Where it comes from: You, at checkout

Sign-in information

What we collect: Your email address, one-time sign-in codes (sent by email and valid for 30 minutes), a sign-in token kept in your browser, and the time you last signed in

Why: To let you in securely without a password

Where it comes from: You, when you sign in

Your plan

What we collect: What you and your partner enter: first names, budget figures, money that is off-limits, spending priorities, contributors (names, amounts and conditions), guest names with side, plus-one and children counts, venue shortlist (names, addresses, emails, phone numbers, notes and tour notes), dates and other planning notes

Why: To provide the app and keep your plan saved

Where it comes from: You and your partner

Partner invitation

What we collect: Your partner's email address, and whether the invitation was accepted

Why: To let you share one plan with your partner

Where it comes from: You

Messages to us

What we collect: The content of emails you send to support

Why: To answer you and keep a record

Where it comes from: You

Technical information

What we collect: IP address, browser type, device type, and time and result of requests

Why: To deliver the app, keep it secure, stop abuse and fix errors

Where it comes from: Collected automatically by our hosting, security, database and email providers

Bot check

What we collect: When you sign in, a Cloudflare Turnstile check reads limited browser and device signals to tell

people from automated programs

Why: To protect sign-in from abuse

Where it comes from: Collected automatically

Email delivery records

What we collect: Whether a sign-in, purchase or invitation email was delivered or bounced

Why: To make sure our emails reach you

Where it comes from: Our email providers

Website visits

What we collect: On our website and checkout pages (not in the app), Meta Pixel and Google Analytics record the

pages you view, what you click, your device and browser, your approximate location, your IP address, where you came from, and whether you start or complete a purchase. They use cookies and similar identifiers.

Why: To measure and improve our pages and our advertising, and to show our ads to people who may be interested

Where it comes from: Collected automatically

Information about other people. Your plan may include information about your guests, family, vendors and contributors. You decide what to enter. Please enter only what you need, and do not enter sensitive details about other people, such as health or religious information.

3. How we use it, and what we never do

We use your information to:

create your account and give you access to the app, and keep your plan saved and in sync for you and your partner;

send service emails: your sign-in codes, your purchase confirmation, an invitation to your partner when you ask us to send one, and notices about your account, such as a warning before your plan is deleted;

process refunds and chargebacks, answer support requests, and keep the accounting records the law requires;

keep the app secure, prevent abuse and fraud, and find and fix technical problems, using technical information rather than the contents of your plan;

meet our legal obligations.

Marketing email. If you have bought from us, we may email you about our own products, offers and updates related to wedding planning. If you have not bought from us, we email you marketing only if you have signed up to receive it. Every marketing email has an unsubscribe link, and you can also write to us to stop it. Service emails (such as sign-in codes) are not marketing and continue while you have an account.

What we never do

We do not sell your personal information.

We do not use the contents of your plan for advertising, we do not share them with advertisers, and we do not put advertising or analytics tools inside the app.

We do not send the contents of your plan to our email, customer-management or marketing tools. They receive only your email address, order details and the partner-invitation email addresses.

We do not use your plan to train artificial intelligence models.

We do not read the contents of your plan, except to fix a problem you have asked us to help with, to keep the service safe, or where the law requires it.

Our legal bases (for people in the EU and UK). We handle your information to carry out our contract with you (providing the app), for our legitimate interests in security, preventing fraud and improving the service, to meet legal obligations (such as accounting), and, where we ask for it, with your consent (such as optional marketing email).

4. Who we share it with

We use a small number of service providers. Each handles information only to provide its service to us.

Supabase

What it does for us: Hosts the app's database and sign-in system

What it can see: Your account email, order records and the contents of your plan (stored there)

Cloudflare

What it does for us: Delivers the app's web pages, provides network security and the sign-in bot check

What it can see: IP address, browser details and request data. It does not see the contents of your plan

Amazon Web Services (Amazon SES)

What it does for us: Sends your sign-in codes by email

What it can see: Your email address and the sign-in email itself

HighLevel (GoHighLevel)

What it does for us: Our checkout and customer system: purchase confirmation, support, and the partner-invitation and account-notice emails

What it can see: Your email address, name, order details, our customer reference, and the email addresses in a partner invitation. It does not receive the contents of your plan

Stripe

What it does for us: Takes payment and handles refunds

What it can see: Your payment details and order amount

Meta Platforms (Meta Pixel)

What it does for us: Measures and improves our advertising on Facebook and Instagram. On our website only, never inside the app

What it can see: Pages you view and actions you take on our website, your device and browser, IP address and cookie identifiers

Google (Google Analytics)

What it does for us: Helps us understand how people use our website. On our website only, never inside the app

What it can see: Pages you view and actions you take on our website, your device and browser, approximate location, IP address and cookie identifiers

The person you invite. Your partner sees everything in the shared plan. You see their email address in the app.

Others. We may share information with our accountants and lawyers, and where the law requires it or to protect our rights, safety or property. If we sell or reorganise the business, information may pass to the new owner, who must honour this policy.

Links you choose to open. The app shows a map link beside a venue's address. If you click it, Google Maps opens in a new tab and receives that address. Nothing is sent to Google unless you click.

We do not sell personal information. Our website (but not the app) uses Meta Pixel and Google Analytics, and under some privacy laws that can count as "sharing" for advertising. Sections 8 and 9 explain your choices.

5. Where your data is stored

We are based in Canada. Your information is processed in more than one country:

The app's database (your account, order records and plan) is hosted by Supabase in US East (Ohio).

Sign-in emails are sent through Amazon SES in the United States (Ohio).

Our checkout and customer system (HighLevel) and payment processor operate in the United States and other countries:

Cloudflare delivers web pages from locations around the world, close to you.

When your information is moved to another country, it can be accessed by courts, law enforcement and other authorities there under that country's laws. We use contracts with our providers that require them to protect your information, and for people in the EU and UK we rely on.

6. How long we keep it

Your plan: answers, guest list, venues, contributors, and your link to your partner: While your access is active

Your plan after a refund or chargeback: Access ends right away for you and your partner. About 76 days later we email you to say your plan will be deleted. 90 days after the refund or chargeback, we permanently delete the plan. If you buy again before that date, your plan is restored exactly as you left it

A partner's account that exists only because of your plan: Deleted together with the plan

Your account email and order record: As long as accounting and tax laws require. We keep only the email address and order details, not your plan

Sign-in codes: They expire after 30 minutes

Support emails: [HOW LONG, for example 24 months after the issue is resolved]

Technical logs at our providers: For each provider's standard period, [CONFIRM: typically days to weeks]

Encrypted backups: Deleted information can remain in encrypted backups for up to 90 days, until the backups expire.

Want it gone sooner? Write to us and we will delete your plan and your account. We may need to keep the order record that the law requires.

Want a copy before it is deleted? Inside the app, use Save backup file or the Excel downloads. If your access has already ended, write to us before the deletion date and we will send you a copy.

7. How we protect it

Encryption. Information travels between your device and the app over encrypted connections, and our database provider encrypts stored data.

Separate plans. The database enforces rules so that each couple can read only their own plan. Order records and our internal systems cannot be read from a web browser.

No passwords. You sign in with a one-time code sent to your email, and a bot check protects the sign-in page, so there is no password to steal or reuse.

Access control. Only a small number of authorised people can reach our systems, and each uses two-step sign-in.

Locking. When access ends, the plan is locked for you and your partner.

Backups. Our database is backed up automatically.

No system is perfectly secure. If a breach could harm you, we will tell you and the authorities as the law requires.

You can help too: keep your email account secure, and on a shared computer use a private window or clear the site's data from your browser when you finish.

8. Your choices and rights

Everyone can ask us to:

tell you what information we hold about you, and give you a copy;

correct anything that is wrong;

delete your information, or delete it sooner than the periods above;

give you your plan in a portable form (the app's Save backup file and Excel downloads do this too);

stop sending you marketing email, and withdraw any consent you gave.

How to ask. Email [email protected] from the address on your account, so we can confirm it is you. We answer within 30 days, and tell you if the law lets us take longer or if we cannot do what you ask and why. We do not charge for requests.

If you are in Canada. You have the rights above under Canadian privacy law, and you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your provincial regulator.

If you are in the EU or UK. You also have the right to restrict or object to how we handle your information, and to complain to your data protection authority (in the UK, the Information Commissioner's Office).

If you are in California or another US state with a privacy law. You can ask to know, correct and delete your personal information. We do not sell personal information for money. Our website, but not the app, uses Meta Pixel and Google Analytics, and under some state laws that can count as "sharing" personal information for cross-context behavioural advertising. You can opt out of that by email us at [email protected]. We do not treat you differently for using your rights. An authorised agent may make a request for you.

We do not make decisions about you by purely automated means that have legal or similarly significant effects.

9. Cookies and browser storage

The app. The app has no advertising or analytics cookies and does not track you across other sites. It uses your browser's own storage for two things that are needed for it to work:

to keep you signed in, and

to keep a copy of your plan on your device, so you can keep working if your connection drops, and so your changes are not lost.

That copy stays in your browser until you clear the site's data. Signing out hides your plan but does not erase the copy, so on a shared computer use a private window, or clear the site's data when you finish.

The sign-in bot check (Cloudflare Turnstile) may read and store limited browser information to tell people from automated programs.

The website. Our website and checkout pages use cookies and similar tools. Some are needed for the site and checkout to work. Others are for analytics and advertising: Google Analytics helps us understand how people use our pages, and the Meta Pixel helps us measure and improve our advertising on Facebook and Instagram and show our ads to people who may be interested. These are on our website only, never inside the app. You can control these tools: set your browser to block cookies, use Google's opt-out browser add-on for Analytics, and change your ad preferences in your Facebook and Instagram settings.

You can block or delete cookies and site data in your browser settings. Blocking the app's storage will stop sign-in and saving from working.

10. Children, changes and contact

Children. The app is for adults planning a wedding. It is not meant for anyone under 18, and we do not knowingly collect information from them. If you think a child has given us information, write to us and we will delete it.

Changes. We will update this policy when our practices change. The date at the top shows when it last changed. For a change that matters to you, such as a new way of using your information, we will email you before it takes effect.

Contact and complaints.

PlanYourDIYWedding.com
6D - 7398 Yonge St #745, Thornhill, Ontario, L4J 8J2, Canada
Privacy requests and complaints: [email protected]
General support: [email protected]

If we do not resolve your concern, you can contact your regulator (see section 8).