Privacy Notice for Hosts
This notice explains how English Street Ventures Pty Ltd, trading as Cire (“Cire”, “we”), handles personal information across the Cire service — this marketing site, the invitation site your guests use, the organiser portal, and the vendor portal. Wedding suppliers have their own notice, for vendors.
Two kinds of people use Cire
- Organisers (couples and their helpers) create an account with us. For your account and purchase information, we decide how it is handled, as described here.
- Guests don’t create accounts. Your couple uploads your details to manage their wedding, and we process them on the couple’s behalf and instructions. Three things are ours to decide rather than theirs, and we decide them the same way for every wedding: how long guest information survives the event, how the service is secured, and what technical telemetry it produces. If you are a guest with questions about why your details are in Cire, your couple is the first port of call — but you can always contact us directly too.
What we collect
- Organiser accounts — your name, email address and passkey credentials (public key only — no passwords), and the weddings you manage.
- Which organiser changed a guest’s reply — when you record or change a guest’s RSVP in the organiser portal, we note your account identifier against that reply, and each time you change only its status we also keep a dated record naming you. This lets a couple with several organisers tell who changed what.
- What your wedding team sees of you — everyone on a wedding (its owners and co-hosts) sees the others’ musubi name, handle and profile photo, and which checklist tasks each of you holds. Your photo is shown only from musubi’s own servers, and we do not store it.
- Wedding content — invitation wording, images, event schedules, checklists, budgets and seating charts you create.
- Guest information uploaded by organisers — guest names, household groupings, RSVP responses, dietary needs, which table each guest sits at, guests’ email addresses, and similar details the couple chooses to record.
- Your confirmation for a guest’s email address — when you add or change a guest’s email address, you confirm that the guest agreed to get emails about the wedding, and we record your account identifier, the time and the wording you confirmed. Because the address did not come from the guest, you also agree to pass our guest privacy notice on to them. A guest can see, change or remove an address you added on their invitation, and once they remove or replace it, we do not email it about the wedding again, even if it is added back. You cannot change an address a guest added themselves, only remove it.
- Vendor enquiries — the enquiry threads between a couple and the vendors they contact. An enquiry sends the couple’s wedding name and message to the vendor they chose.
- Purchases — handled by our merchant of record, {{MERCHANT_OF_RECORD}}. We receive order confirmation (what was bought, for which wedding) but never see your card details.
- Site usage — the technical logs needed to keep the service secure. We run no third-party analytics or advertising trackers.
Why we collect it
- To provide the service — hosting invitations, collecting RSVPs, powering the planning tools.
- To process purchases and unlock paid add-ons.
- To send transactional email (sign-in codes, security notices) — never marketing without consent.
- To keep the service secure and improve it.
- To keep an accurate record of who changed a guest’s reply when several people manage one wedding — our legitimate interest in a shared record the couple can rely on.
- To keep a record of who confirmed each guest’s agreement to be emailed — our legitimate interest, and the couple’s, in being able to show the consent each address rests on.
- To show the people running a wedding together who else is on it and who is looking after each task — our legitimate interest in a team that can see its own members.
We do not sell personal information, and we do not use it for third-party advertising.
Who we share it with
We use a small set of service providers to run Cire:
- Cloudflare — hosting, content delivery and databases (global network).
- {{MERCHANT_OF_RECORD}} — payment processing, as merchant of record for purchases.
- Resend — transactional email delivery, including vendor claim invitations.
- The vendor you enquire with — an enquiry is sent to that supplier, who then holds it under their own responsibility.
- Upstash — infrastructure supporting security features such as rate limiting.
- Grafana Cloud — service telemetry (metrics and traces; pseudonymised identifiers only, never guest content).
- Google Fonts — our pages currently load fonts from Google’s CDN, which sees your IP address when they load. We plan to self-host these fonts.
We also disclose information where the law requires it. Our primary region is Australia; the infrastructure supporting the service’s security is pinned to Sydney, and some technical records — email delivery, service telemetry, payment processing — are handled by providers outside it. If you are in the EEA or the UK, that means your information is transferred out of that area to Australia and elsewhere; ask us and we will tell you what protections apply to that transfer.
How long we keep it
Only as long as needed for the purposes above. Guest information (guest lists, RSVPs, dietary needs, email addresses and the record of who added them) is automatically deleted one year after the wedding’s final event, now and then up to 30 days later while the couple’s record of their gifts is written. That window is set by us and applies to every wedding — an organiser cannot extend it. When it is deleted, the couple keep a record of their gifts with no guest names in it — how many were reserved and bought from their list, and the amount, currency and day of each money gift — until they delete their wedding. Other wedding and account data is kept while your account is active and removed when you ask us to. The dated record of a status change naming the organiser who made it is deleted after 90 days; the note of who last changed a reply goes with the reply. Specific periods for account data: {{RETENTION}}.
Security
Traffic is encrypted in transit, organiser sign-in uses passkeys rather than passwords, and session credentials are stored hashed. No system is perfectly secure, but we design for security first.
Your rights
You may have rights to access, correct, delete or port your information, and to object to certain uses — under the Australian Privacy Act, and for people in the EEA or UK, the GDPR and UK GDPR. To exercise them, contact us at [email protected]. You can also complain to a regulator — in Australia, the Office of the Australian Information Commissioner (OAIC), or your local data protection authority.
Cookies
We use only the cookies the service needs to work (such as session cookies for signed-in organisers and guests). No advertising or cross-site tracking cookies.
Contact
English Street Ventures Pty Ltd (trading as Cire), {{POSTAL_ADDRESS}} — [email protected].