Create Your Free Wedding Invitation — Start Now

Privacy Policy

We collect the smallest amount of information we can while still designing, printing and delivering your stationery. This page explains exactly what we hold, why we hold it, and how you can ask us to change or remove it.

Last updated: 21 September 2026

Who we are

Dear Delilah is an Australian sole trader trading as "Dear Delilah" (ABN 86 673 034 061). In this policy, "we", "us" and "our" mean Dear Delilah. Our website is https://www.deardelilah.app.

We are bound by the Australian Privacy Principles in the Privacy Act 1988 (Cth), and our goods and services carry the guarantees set out in the Australian Consumer Law.

If you have any question about this policy, or about information we hold, write to us at hello@deardelilah.app. That inbox is monitored by a real person and is the fastest way to reach us.

What we collect

We collect different information depending on how you use the site.

When you browse

Your IP address, browser and device type, the pages you view, and how you move through the site. This is collected through our hosting provider's logs and through Microsoft Clarity analytics, which is described in our Cookies Policy.

When you create an account

Your name, email address and an authentication credential. Account sign in is handled by Clerk. We never see or store your password.

When you order printed stationery

Your name, email address, phone number if you provide one, and the postal address we ship to. We also hold the personalisation details you type into a product form, which usually include the couple's names, the wedding date, the venue name and address, and any wording you ask us to print.

When you buy a digital Canva template

Your name and email address, and a record of which template licence you hold, so we can re-send your template link if you lose it.

When you pay

Card payments are processed entirely by Stripe. Your card number, expiry and security code are entered on Stripe's systems and are never sent to, seen by, or stored by Dear Delilah. We receive only a payment reference, the amount, the currency, the outcome, and the last four digits and card brand for reconciliation and refunds.

When you build a wedding microsite

The content you enter about your wedding: couple names, your wedding date, your story text, milestone dates, venue and afterparty locations including latitude and longitude, parking notes, accommodation suggestions, gift registry links, and any images you upload.

If you use the guest list, seating planner or guest guide tools, this also includes information about your guests: their names, email addresses where you supply them, group labels, dietary requirements, table assignments, private notes you write about them, and any seating constraints you record.

When a guest responds to an invitation

Guests who RSVP through a microsite give their name, email address, whether they are attending, any dietary requirements, and an optional message to the couple.

When you contact us

Your name, email address, your wedding date if you share it, and the content of your message.

Why we collect it and our legal basis

We collect personal information only where it is reasonably necessary for our functions and activities, as required by Australian Privacy Principle 3. In practice we use it to:

  • Take, produce, print and ship your order, and to deliver digital template files.
  • Process payments, issue receipts and handle refunds or chargebacks.
  • Create and secure your account, and keep you signed in.
  • Build and host your wedding microsite and collect RSVPs on your behalf.
  • Answer your enquiries and provide order and template support.
  • Diagnose faults, prevent fraud and abuse, and improve how the site works.
  • Meet our record keeping, tax and consumer law obligations.

Most of what we collect is necessary to perform the contract you have entered into with us, or to comply with Australian law. Analytics and any optional marketing rest on your consent, which you can withdraw at any time. We do not sell personal information, and we do not use guest RSVP data for our own marketing.

Who we share it with

We share personal information only with the service providers we need to run the business. Each is bound by its own terms and privacy obligations, and each receives only what it needs.

  • Stripe for payment processing, fraud checks and refunds.
  • Clerk for account creation, sign in and session management.
  • Vercel for website hosting, request logging and edge delivery.
  • Vercel Blob for storing images you upload, such as hero and proposal photographs.
  • Neon for our PostgreSQL database, which we access through Prisma.
  • Resend for transactional email, including order confirmations, template links and guest guide emails.
  • Microsoft Clarity for analytics, heatmaps and session replay.
  • Google Places API for venue and address lookup when you search for a location. Your search text is sent to Google to return suggestions.
  • Print and delivery partners, who receive the name, address and artwork needed to produce and deliver a physical order.

Some of these providers store or process data on servers outside Australia, including in the United States and the European Union. By using the site you acknowledge that your information may be handled overseas by the providers listed above. We take reasonable steps to ensure they handle it consistently with the Australian Privacy Principles.

We will also disclose information where we are required to by law, by a court, or by a regulator, and where it is necessary to protect our legal rights.

Couples are responsible for their guests' information

If you are a couple using a Dear Delilah wedding microsite, guest list, seating planner or guest guide, you decide what guest information is uploaded and how it is used. You are responsible for that information.

That means you should only upload guest details you are entitled to hold, you should keep private notes about guests appropriate and accurate, and you should be careful about who you share a public microsite link or guest guide link with. Guest guide links are unguessable but are not password protected, so anyone holding a link can open the card.

Dear Delilah acts as a service provider in these circumstances. If a guest asks us directly to access, correct or delete their information, we will normally refer them to the couple and assist the couple in actioning the request.

How long we keep it

  • Order and transaction records are kept for seven years after the order, to meet Australian tax and record keeping requirements.
  • Account details are kept while your account is open, and are deleted within 30 days of you asking us to close it.
  • Wedding microsite content and guest data are kept while your microsite is active. If you ask us to remove a microsite, we delete its content and guest records within 30 days, except where a record forms part of an order or transaction record.
  • RSVP responses are deleted with the microsite they belong to.
  • Support and enquiry emails are kept for two years so we can refer back to earlier conversations.
  • Analytics data is retained according to Microsoft Clarity's own retention schedule, which is currently around 13 months.

When a retention period ends we delete the information or de-identify it so it can no longer be connected to you.

How we protect it

All traffic to and from the site is encrypted in transit using TLS. Data is stored in encrypted databases and object storage operated by Neon and Vercel. Access to production data is limited to the people who need it to run the business, and is protected by multi-factor authentication. Database access is further restricted by row-level security rules so one couple's records cannot be read by another.

No system is completely secure. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

Your rights

Under the Australian Privacy Principles you may:

  • Ask for access to the personal information we hold about you.
  • Ask us to correct information that is inaccurate, out of date, incomplete or misleading.
  • Ask us to delete information we no longer need, subject to our legal record keeping obligations.
  • Withdraw consent to analytics or optional marketing at any time.
  • Ask us how we collected particular information and who we shared it with.
  • Deal with us anonymously or under a pseudonym where it is lawful and practicable, although we cannot ship a printed order without a delivery address.

Send any request to hello@deardelilah.app. We will verify your identity before we act, and we aim to respond within 30 days. Access and correction are free. If we refuse a request, we will tell you why in writing and explain how to complain.

Complaints

If you believe we have mishandled your personal information, please contact us first at hello@deardelilah.app with the subject line "Privacy Complaint". We will acknowledge your complaint within 5 business days and give you a written response within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC). The OAIC can be reached at https://www.oaic.gov.au, by phone on 1300 363 992, or by post at GPO Box 5218, Sydney NSW 2001.

Changes to this policy

We may update this policy as our business or the services we rely on change. The date at the top of this page always shows the current version. If a change materially affects how we handle your information, we will let account holders know by email before it takes effect.

Contact

Dear Delilah, ABN 86 673 034 061.
Email: hello@deardelilah.app
Web: https://www.deardelilah.app