Privacy policy

Last updated: 12 November 2026

1. Who we are
EveryExtra is a service run by Selfie Star Events Limited, a company registered in England and Wales ("we", "us"). It lets couples and event hosts collect photos, videos, voice and written messages from their guests, and run a wedding website with invitations, RSVPs, seating and song suggestions. You can contact us about anything in this policy at hello@everyextra.co.uk.

For the details of people who create an EveryExtra account (hosts), we are the data controller. For the content and details that guests share in a host's gallery or website, we process that information on the host's behalf so that we can provide the service to them.

2. What we collect
From hosts: your name, email address and password (stored only as a secure hash); your event details such as names, date, venue and website content; the guest list you add, including guests' names, email addresses, invitation type, RSVP replies, meal choices, dietary notes, plus ones and table plans; song lists and settings; and records of what you have bought. Payments are taken by Stripe. We never see or store your full card details.

From guests: the name you type when you add something; the photos, videos, voice and video messages and written messages you choose to share; likes and comments; song suggestions; your RSVP reply, meal choice and any dietary or allergy information you choose to give the couple; and your email address only if you choose to give it.

Automatically: basic technical information needed to run and protect the service, such as your IP address, browser type and the time of each request, kept in short-lived server logs.

On your device: to make the guest app work we keep small pieces of information in your browser — the name you typed, a random guest code that lets the app recognise what you have added (for example to tick off photo challenges), which photos you have liked, and uploads waiting to send if you lose signal. We use only cookies that are needed for the service to work: keeping hosts signed in, remembering a gallery PIN or website password, and remembering your personal invitation. We do not use advertising or tracking cookies, and we do not sell personal information.

3. How we use it and why
We use this information to provide the service you or your host have asked for (performance of a contract); to send service emails such as account messages, invitations, RSVP reminders and gallery notifications (contract and legitimate interests); to take payments (contract); to keep the service secure, prevent abuse and fix problems (legitimate interests); and to keep records we must keep by law, such as for tax (legal obligation). If you give us your email address as a guest, we use it only for messages about that event, and you can ask us to stop at any time.

4. Google user data (Copy to Google Drive)
Hosts can choose to copy their gallery to their own Google Drive. If you connect Google Drive, we ask Google only for the "drive.file" permission, which lets EveryExtra create and manage the files and folder it makes in your Drive. It does not let us see, read or change any other files in your Drive.

We use this access only to create an EveryExtra folder in your Drive and upload your gallery's photos, videos and messages into it, when you ask us to. We store the access token Google gives us securely on our servers so the copy can finish in the background, and we delete it when you disconnect Google Drive in your dashboard. You can also remove our access at any time at https://myaccount.google.com/permissions.

We do not use Google user data for advertising, we do not sell it, we do not use it to build profiles or train AI models, and we do not share it with anyone except as needed to provide this feature, to comply with the law, or to keep the service secure. People at EveryExtra do not read your Drive data unless you ask us to help with a problem and give permission, or the law requires it.

EveryExtra's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Maps and venue search
When a host searches for their venue, the search text is sent to Google Places, or to OpenStreetMap's Photon search if Google is not available. Maps on wedding websites are shown by Google Maps or OpenStreetMap, and the "Get directions" buttons open Google Maps, Apple Maps or Waze. When a map loads or you use those buttons, that provider receives the information it needs to show it, under its own privacy policy.

6. Who we share information with
We use trusted service providers to run EveryExtra, and they process information only on our instructions: 20i (website hosting and email, UK), Cloudflare (file storage, with files kept in Western Europe), Stripe (payments), and Google (maps, venue search, and Google Drive when a host connects it). Some of these providers are based in, or may access data from, the United States; where personal information leaves the UK we rely on the safeguards the law requires, such as the UK International Data Transfer Agreement or adequacy regulations.

Content a guest shares in a gallery can be seen by the host and by anyone the host gives the gallery link to (and PIN, if one is set). Hosts can approve content before it is shown, download it, and copy it to their own Google Drive. We may share information if the law requires it or to protect people's safety.

7. How long we keep it
Gallery files are kept for the periods shown in each package: full-resolution files until the end of the full-resolution period, then viewing-quality copies until the end of the hosting period, after which the gallery and its files are deleted. Items deleted by a host are kept in "recently deleted" for 30 days and then removed. Backups of our database are kept for 14 days. Host accounts are kept until the host asks us to delete them. Payment and invoice records are kept for as long as tax law requires (normally six years).

8. Your rights
Under UK data protection law you have the right to ask for a copy of your information, to have it corrected or deleted, to object to or restrict how we use it, and to receive it in a portable format. Guests who want something removed from a gallery can ask the host or contact us. To use any of these rights, email hello@everyextra.co.uk and we will reply within one month.

If you are unhappy with how we have handled your information, please tell us first. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

9. Children
EveryExtra is not designed for children to sign up to. Guests of any age may appear in photos shared at an event; hosts are responsible for making sure they and their guests are happy with photos being shared in the gallery, and can remove anything at any time.

10. Keeping information safe
We use encrypted connections (HTTPS), store passwords only as secure hashes, limit who on our team can access information, and keep files in private storage that can only be reached through time-limited links.

11. Changes to this policy
If we make important changes we will update the date at the top and, where appropriate, let hosts know by email.

Guest contact details: if a host switches on guest contact details, their guests are asked for their name and email address (and, if the host chooses, their company and phone number), with an optional box, never ticked in advance, to agree to hear from the host. The host is the data controller for that list; we store it on their behalf as their processor and never use it for our own marketing. We record the wording each guest agreed to and when. Hosts can download or delete the list at any time, and it is deleted with their gallery. To have your details removed, contact the host, or contact us and we will pass your request on.

Sign-in and activity records: to keep accounts secure, we record each sign-in attempt (successful or not) with its IP address and the type of device and browser. We also keep an activity log of changes made to accounts and galleries — for example a package changed or a gallery deleted — with the account that made the change and its IP address. If your account is with one of our partners, they can see this activity for their own clients. We use these records to protect accounts, investigate problems and resolve disputes. Sign-in records are deleted after two years, and IP addresses are removed from the activity log after two years.

Free trials: if you start a free trial, your card is stored securely by Stripe — we never see the card number. We keep a code Stripe gives us for the card (not the card number) so each card can only be used for one free trial.

How long we keep galleries: when a gallery’s hosting period ends, it goes offline. We keep its files for a further 90 days so you can bring it back by extending, then everything is permanently deleted. If you cancel a free trial, the gallery is kept for 90 days and then deleted.

Selfie Star Events Limited · hello@everyextra.co.uk