Privacy Policy

Last updated: 18 October 2026.

The short version

• We collect the address you want, a contact email, payment references from Stripe, and the records we need to run the mailbox.
• We do not take your card number. You enter it on Stripe's checkout page. Link is the merchant of record for the payment.
• We do not sell personal information, and we do not run ads or a web analytics product.
• Messages in the mailbox live at our mail host, MXroute. We do not read them in the ordinary course, and we do not use them to train models.
• You can ask us what we hold and ask us to delete the contact email. There is no self-service button for that yet.

Who is responsible

WMAD LLC operates gettingmarried.email and is the controller of the personal data this policy describes (the "business" under the California Consumer Privacy Act, and the equivalent under other US state laws). Privacy requests go to privacy@gettingmarried.email.

We have not appointed a data protection officer. You may complain to a supervisory authority where you live. A list of EEA authorities is published by the European Data Protection Board.

This policy covers the site, checkout, the mailbox service, and the emails we send you about your order. It does not cover third-party sites we link to, and it does not cover what a recipient does with a message you send them.

Information you give us

• The mailbox address you request (the part before @gettingmarried.email) and the term length you select.
• A contact email address, collected before payment. We use it for the receipt, the one-time password-setup link, renewal reminders, and the notice that a mailbox is about to be deleted. It is not the wedding address itself. The wedding mailbox does not exist until after you pay.
• The mailbox password you choose on the setup page. It is transmitted to MXroute so the mailbox can be opened. We do not write it to our database. See "Passwords" below.

We do not ask for your name or phone number. Please do not put those in the address you choose. If they show up inside mail you send or receive, they are in the mailbox at MXroute, not in our order database.

Information the service creates

• Reservation records: status (held, paid, released, or expired), when the hold started, and when it expires. Unpaid holds last one hour.
• Order records: term start and end, whether the mailbox is pending, active, locked after expiry, or deleted, and, if you renew, a link to the previous term so the history stays intact.
• A Stripe Checkout Session identifier. If Stripe attaches a customer identifier to that payment, we store that too. We do not create a separate customer profile ourselves.
• One-time tokens for the password-setup link and for renewal links. We store a SHA-256 hash of the token, not the token itself, plus an expiry time and, for reminders, which reminder (14, 7, or 1 day before the term ends) the link belonged to.
• Your IP address, taken from Cloudflare's connecting-IP header, used only to rate-limit address lookups and new holds (20 lookups and 5 holds per minute per address). Those counters are kept briefly by Cloudflare's rate-limiting service and expire after about a minute. They are not written to our database.
• Server logs. Cloudflare records each request to the application: IP address, time, method, URL, status, and user agent. The application log records errors, which can include a reservation id, the mailbox address, and a contact email when a payment or provisioning step fails. These logs are kept by Cloudflare for a few days and then deleted.

Payment information

Payments use Stripe Managed Payments. Link is the merchant of record for the charge ("Sold through Link"). Checkout happens on Stripe's hosted page, not in a form embedded on our site. Card numbers, expiry dates, security codes, the billing name and address used to calculate tax, and a phone number if the page asks for one, go to Stripe and Link and do not touch our servers. Stripe is a PCI-DSS compliant processor. Its privacy notice is at stripe.com/privacy. Link's notice is at link.com/privacy.

We send Stripe the pre-tax amount, the currency, your contact email (so the receipt has a destination and so we have a fallback if our copy is missing), the product name (the mailbox address and term), a digital-goods tax category, and metadata that ties the payment to the reservation or the mailbox being renewed. Stripe and Link also collect device and usage data on their checkout page to prevent fraud and to support the transaction. That collection is theirs, under their notices. Link sends the payment receipt and tax invoice. We still email the password-setup link, and our own receipt, from our mail sender.

What we keep afterwards is the Checkout Session id and, when present, the Stripe customer id. We do not keep the card number, the last four digits, or the billing address Stripe collected.

You can ask Link to delete the data it holds for Managed Payments transactions. When that happens, Stripe may delete the related customer and payment objects in our Stripe account and email us. That does not by itself delete the mailbox or our order row. To ask us to delete the contact email we hold, use the request described under "Your rights".

The mailbox itself

Messages sent to and from your address, and their attachments, are stored by MXroute, not in our database. We send MXroute the mailbox name and a password (first a random placeholder that we discard, then the password you choose). We do not send MXroute your contact email as part of creating the mailbox.

The application has no screen for reading customer mail. We do not read mailbox contents in the ordinary course, we do not scan them for advertising, and we do not use them to train machine-learning models. MXroute describes its own handling, including abuse reports that can include a copy of a message, in its terms at mxroute.com/terms and its GDPR note at docs.mxroute.com/docs/general/gdpr.html.

If we receive a credible complaint that a mailbox is being used for spam, phishing, or something illegal, we may review the specific mailbox, or the information the host gives us about it, in order to decide whether to suspend or delete it. That is the exception, and it is limited to the mailbox the complaint is about.

Passwords

You set the mailbox password yourself, over an encrypted connection, using a link that works once. We store only a hash of that link. The password is forwarded to MXroute and then dropped. It is not emailed to you and it is not written to our database or to our logs by the application. When a term lapses we lock the mailbox by setting a new random password that we also do not store, which is why a renewal during the grace period requires you to choose a password again.

Cookies and local storage

We do not set a first-party cookie for an account session, for advertising, or for analytics. You can read the public pages without logging in. There is no account dashboard and no advertising profile.

Your browser does store one first-party record, in local storage rather than in a cookie, so that a refresh or a new tab can resume a payment already in progress. The entry is named gme:checkout-resume:v1. It holds the reservation id, the address, the term length, the contact email, the Stripe checkout link for that payment, a token that can release the hold, and the time the one-hour hold ends. We write it only after the hold and the checkout link have been created. We delete it when you reach the confirmation page, when you back out, or when the hold has expired. You can also clear it by clearing site data for gettingmarried.email. Clearing it does not cancel a hold that is still running on the server; the hold still ends after one hour, or when you leave Stripe's checkout with its back link.

Two other companies may store cookies when you use the site:

You can block or delete cookies in your browser. Blocking cookies on Stripe's checkout page will stop payment from completing. Blocking every cookie will not stop the local-storage entry above; that is cleared in the browser's site-data settings. Browser help:

• Chrome
• Safari
• Firefox
• Edge

We do not respond to a "Do Not Track" signal by changing the service, because we do not track you across other websites. The signal does not turn off checkout, the security proxy, or the records we need to sell you a mailbox.

What we do not do

• We do not sell personal information, and we do not rent it.
• We do not share it for cross-context behavioral advertising, and we do not allow anyone else to do that with data we hold.
• We do not run a marketing or newsletter list. The emails we send are the receipt, the password link, renewal reminders, and the deletion warning.
• We do not use a third-party analytics product, an advertising pixel, or a session-replay tool.
• We do not use personal information or mailbox contents to train machine-learning models.

Why we use it

Where the GDPR or UK GDPR applies, the legal bases are these:

• Contract. Creating the hold, taking payment, provisioning the mailbox, sending the setup link, reminding you to renew, and deleting the mailbox at the end of the grace period.
• Legitimate interests. Rate-limiting, keeping server logs, backing up the database, preventing address squatting, and investigating abuse. Those interests are keeping the service available and safe. You can object, as described under "Your rights".
• Legal obligation. Keeping records we are required to keep for tax, accounting, or a lawful request.

We do not rely on consent for the core service. The one place we ask you to agree to something extra is the checkout acknowledgment that provisioning starts immediately, which is a contract term, described in the Refund Policy.

Who else receives it

We use the following processors. Each receives only what it needs to do the job named here. Their handling of that data is also governed by their own terms.

We also disclose information if the law requires it, in response to a valid legal process, or when it is reasonably necessary to protect the service, our users, or the public from illegal activity. We do not hand over mailbox contents on an informal request.

International transfers

We and the processors above operate in the United States and may process data in the United States and in other countries where those processors run infrastructure. If you are outside the United States, your information will be transferred there. Where the GDPR or UK GDPR requires a transfer tool, we rely on the processor's standard contractual clauses or an equivalent lawful mechanism the processor makes available. You may ask us for a copy of the relevant safeguards using the contact email on this page.

How long we keep it

• Order and reservation rows stay in our database, including holds that expired unpaid and mailboxes we have since deleted at the mail host. The database does not delete them on a schedule. They are the record of who held an address and of what was paid. On a valid deletion request we will remove or anonymize the contact email and other direct identifiers where we can do that without breaking a legal duty (tax, accounting, fraud prevention, or an ongoing dispute). We may keep the mailbox address and a payment reference as that record.
• Hashed tokens stay with those rows after they expire or are used. The raw token is never stored.
• Mailbox contents stay at MXroute until the mailbox is deleted: at the end of the 7-day grace period, sooner if we delete it for breach, or if you ask us to delete the mailbox. We cannot restore them after that.
• Rate-limit counters expire after about a minute and are not kept.
• Logs are kept for a few days.
• Backups. Cloudflare D1 keeps a point-in-time history of the database, which includes the personal data in it, for 30 days. A deletion from the live database does not erase that history; the data leaves it 30 days after the deletion.
• Local storage in your browser lasts until we clear it, you clear it, or the stored hold time has passed.

Security

The site is served over HTTPS. Payment card data is collected by Stripe on its own checkout page. Setup links are random and stored only as hashes. Secrets for Stripe, MXroute, and Resend are held as encrypted server-side secrets and are not sent to the browser. No method of transmission or storage is perfectly secure. If we learn of a breach that the law requires us to announce, we will notify the people and authorities that law names.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of the personal data we hold about you, to restrict or object to certain processing, and to withdraw a consent where processing was based on consent. You may also have the right to complain to a regulator and the right not to be discriminated against for exercising these rights. We will not deny you the service, or charge a different price, because you made a request.

If the GDPR or UK GDPR applies, those rights include access, rectification, erasure, restriction, portability, and objection (including objection to processing based on legitimate interests). Portability covers the contact email, the address, the term, and the payment reference we hold in our database. It does not require us to extract the contents of the mailbox from the mail host; you can copy those yourself with webmail or IMAP while the mailbox exists.

If you are a California resident, you have the rights to know, delete, and correct, and the right to opt out of sale or sharing. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use or disclose sensitive personal information to infer characteristics about you. In the preceding 12 months we collect the categories described above: identifiers (contact email, IP address, mailbox address, payment reference), commercial information (the term you bought and the amount Stripe charged), and internet activity on our own site (request logs). Sources are you, your browser, Stripe, and our own systems. We disclose those categories to the processors listed above for the business purposes listed above. We do not knowingly sell or share the personal information of anyone under 16.

Residents of other US states with similar privacy statutes may exercise the same kinds of rights by the same method. We will honor a request the applicable statute actually grants.

Email privacy@gettingmarried.email with the contact address you used at checkout, the mailbox address if you have one, and what you want done. We may ask for enough information to confirm the request is yours. We will respond within 30 days, or sooner if the law that applies to you requires it. There is no in-site form for this; we handle requests manually. If we deny a request, we will tell you why and, where the law provides one, how to appeal.

Children

The service is for adults. You must be 18 to buy a mailbox. We do not knowingly collect personal information from anyone under 16. If you believe we have, email privacy@gettingmarried.email and we will delete it.

Changes

We will post changes on this page and update the date above. If a change is material and you have a live mailbox, we will also email the contact address. The California notice of collection is this page, and it is linked from the footer of every page, including the home page.

Contact

WMAD LLC
privacy@gettingmarried.email