Privacy Policy

What we collect, why, how long we keep it, who we share it with, and how to ask about your data.

Effective date: November 8, 2026

This policy is published at https://neatlywed.com/privacy. It is linked from the footer of every page of neatlywed.com and from its early-access form, from the sign-in page and the menu of app.neatlywed.com, from the page where a person accepts an invitation ("I accept the Terms of Service and the Privacy Policy"), and from every page a client opens from a client's link.

1. Who we are, and what this policy covers

1.1. NeatlyWed is run by Built by Bean LLC, a Texas limited liability company ("Built by Bean", "we", "us"), 3244 Spaulding Dr, Paris, Texas 75460. This policy says what personal data we collect, why, how long we keep it, who we share it with, and what you can do about it.

1.2. It covers:

• neatlywed.com, the website, including its early-access form, and the status page at status.neatlywed.com;
• app.neatlywed.com, where the people of a wedding planning business sign in and plan their weddings, including the pages a client opens from a client's link;
• the emails NeatlyWed sends, and what you write to hello@neatlywed.com.

1.3. Two roles, and it matters which. For the website, the early-access form, the logins of a business's people and what you write to us, Built by Bean decides what is collected and why: we are the controller (in California's words, the business). For what a wedding planning business puts into NeatlyWed about its weddings, its clients and their guests, the business decides: it is the controller, and Built by Bean is its processor (service provider), holding that data for it as the Terms of Service, sections 5 and 6, say. In this policy "the Business" means the wedding planning business whose account you were invited into, or whose client's link you opened. Section 8 says whom to ask for what.

2. What we collect, by who you are

We collect only what NeatlyWed needs to do what you or the Business asked. It has no field for a Social Security number, a government identification number, a bank or card number, or health information, and the Terms of Service (section 5.4) ask that none be typed into a note.

2.1. A visitor to neatlywed.com

• Nothing identifying, by default. The website sets no cookie for its visitors and runs no analytics or trackers. Its pages load their typefaces from Google Fonts, which receives your IP address and browser, as with any web request, and sets no cookie.
• If you use the early-access form: your name, your business's name and your email address, and, if you choose to give them, your phone number, about how many weddings you plan a year, where you are based, and a message. Cloudflare Turnstile reads your IP address and your browser's signals to check that a person sent it; it does not identify you to us. To stop the form being flooded, a hash of your IP address (not the address itself) is kept for one hour, so that one address can send at most five requests an hour. Your request is kept, and we are told of it by email.
• The status page shows whether NeatlyWed is up, and collects nothing from you.
• Server logs at Cloudflare's edge: your IP address, the page asked for, the time and your browser, kept by Cloudflare for its own short period.

2.2. A person who belongs to a Business (an Owner, an Admin or a Planner)

Your name and email address; the Business you belong to and your role in it; your password, stored only as a salted hash, never the password itself; the fonts you mark as favorites; the invitation that brought you in (the address it went to, the role, who sent it and when); and the record of your acceptance of the Terms of Service and this policy (which version, and when).

2.3. What a Business keeps in NeatlyWed, held for the Business

• Its weddings: the couple's names, the date, an email address for its client if it gives one, and its notes.
• Its guest lists: each guest's first and last name, their table and seat, and the names the Business gives its tables. A list imported from a spreadsheet or a file is read for the first name, the last name and the table only; every other column is ignored and never stored.
• Its seating charts and card designs, and the designs and layouts it saves to use again.
• Its mirrors and photos: each mirror's name, its card area and its photos, and photos from the day of a wedding. A photo is turned upright, and the copy shown carries none of what the camera wrote into it. The original is kept, never shown, with its location (GPS) removed; the rest of what the camera wrote, such as the time and the camera's model, is left as it was.
• Its client's links: whether each is on, when it was made, and when the client last opened it and last changed a name.
• The emails NeatlyWed sends for a wedding: the address, the subject, the words, and whether it was sent.

2.4. A client who opens a client's link

There is no login. We keep what you type on the page (guest names and tables), when you opened it and when you last changed it, and the email address the Business holds for you, if it gave one. Your browser is given the cookie in section 6.

2.5. Guests

Guests never use NeatlyWed and are never contacted by it. A guest's first and last name, table and seat are put in by the Business or by its client. We do not look guests up, add anything to their names, or use them for anything but the Business's seating chart and cards.

2.6. Sign-in and security records

Failed sign-ins are counted by account (kept as a keyed digest of the email address, not the address itself) and by the IP address they came from; the counts by IP address are deleted 30 days after their window ends. Request logs hold the IP address, the page asked for, the time and the browser.

2.7. Help and problem reports

If you write to hello@neatlywed.com: what you write, your name and email address, and the Business you are with. If NeatlyWed reports an error to us, the report carries the page's address, what went wrong, and the login and Business it happened to, never the names or photos on the page. We keep help requests and error reports on Built by Bean's own board at builtbybeans.com.

3. Where it comes from

• From you, when you type it in.
• From the Business, when it invites you, adds a wedding or imports its guest list.
• From the Business's client, through the client's link.
• From NeatlyWed itself, as it is used (sign-ins, the times a link was opened, errors).
• From our email provider, which tells us whether an email was delivered or bounced.

We do not buy data about you and we do not look you up on other services.

4. Why we use it

We do not use your data for advertising, we do not profile you, and we do not use any of it to train a machine-learning model.

5. Who we share it with

We share personal data only as follows. We do not sell personal data and we do not share it for cross-context behavioral advertising, and we have not done so in the past 12 months.

5.1. The Business and its people

What a Business keeps in NeatlyWed is visible to its people, as their roles allow. A wedding's names page is visible to whoever holds that wedding's client's link. That is NeatlyWed working as the Business instructs.

5.2. Our providers

The services that run NeatlyWed. Each provider receives only what its job needs. Railway, Cloudflare, Resend and Anthropic handle it under a written contract with us that limits them to that job (their terms of service and data processing terms). Gmail, Google Fonts and the mailbox providers are services that an email or a web request passes through, under their own terms, and receive only what their row says.

Built by Bean's own board at builtbybeans.com, where we keep help requests and error reports, is ours, not a third party's. GitHub holds our code, and its issue tracker may quote an error report so that we can fix it, never a guest's name.

We give every Business at least 30 days' notice before adding a provider that will handle its data, by email to its Owner and by updating this table (Terms of Service, section 6.5).

5.3. When the law requires

To comply with a law, a court order, a subpoena or a lawful request from a public authority; to enforce the Terms of Service; or to protect the rights, property or safety of Built by Bean, a Business, a person or the public. We tell the Business before we hand over its data unless the law forbids it, and we hand over no more than is required.

5.4. If Built by Bean changes hands

If Built by Bean LLC merges, is bought, or sells NeatlyWed, personal data goes with it to the successor under this policy, and we tell every Business's Owner before it happens.

5.5. The Business's own sharing

What a Business does with its data outside NeatlyWed (the cards it prints, the Cricut files it downloads and cuts, a client's link it sends) is the Business's decision and its responsibility.

6. Cookies and your browser's storage

We use no analytics, advertising or tracking cookies, and set no third-party cookies. The website sets no cookie for its visitors (its admin pages set one for Built by Bean's own sign-in) and keeps nothing in your browser's storage. NeatlyWed itself sets one cookie:

It is sent only over HTTPS, cannot be read by scripts, and goes only to app.neatlywed.com. Cloudflare, which carries every request to our addresses, may set a short-lived cookie of its own to tell people from bots; it is not used to track you. Because we do not sell or share personal data for advertising, a Global Privacy Control signal from your browser changes nothing, and we treat it as honored. The same goes for a Do Not Track signal: we do not track you across other sites or over time, so there is nothing it could turn off, and we treat it as honored too. If we ever add analytics, we will change this section first.

7. How long we keep it

Where the law requires us to keep a record longer (a legal hold), we keep that record for that period and no longer.

8. Your rights, and whom to ask

8.1. What you can ask for. Wherever you live, you can ask to know whether we hold personal data about you and to get a copy of it, in a form you can take elsewhere; to correct what is wrong; and to delete it. Residents of Texas, California and a number of other states have these rights in law (the Texas Data Privacy and Security Act, the California Consumer Privacy Act and their counterparts); we extend them to everyone. We will not treat you differently for using them.

8.2. Ask the Business for what it keeps. If you are a client of a Business, or a guest at one of its weddings, the Business is the controller of your data in NeatlyWed and the one that can act on it: it can correct or delete a name, a wedding or a photo in NeatlyWed itself. A request that reaches us about a Business's data is passed to the Business, and we help it answer within 10 business days. If the Business does not answer you within 30 days, or its early access has ended and it cannot be reached, write to us: we remind the Business and, where its early access has ended, we act on your request ourselves.

8.3. Ask us directly for data we control: your login, the early-access form, what you wrote to us, and our sign-in and security records. Write to hello@neatlywed.com, or by post to the address in section 14, from the email address we hold for you, and say what you want. We may ask you to confirm something only you would know, to be sure it is you. NeatlyWed has no button yet to download everything or to delete a login or a whole Business: we do it by hand. We answer within 45 days; if we need another 45, we say so and why. A request is free, unless it is plainly repeated or excessive, and then we tell you first.

8.4. An appeal. If we refuse, we say why and how to appeal. Write "appeal" to the same address, and we answer within 60 days. In Texas you may then complain to the Texas Attorney General (texasattorneygeneral.gov); in California to the California Privacy Protection Agency (cppa.ca.gov); elsewhere to your state's attorney general.

8.5. Sale, sharing, targeted advertising, profiling. We do none of these, so there is nothing to opt out of. If that ever changes, this policy will say so first, and you will be given the opt-out before anything happens.

8.6. An authorized agent may make a request for you if they show us your written permission or a power of attorney, and we may still confirm it with you directly.

9. Children

9.1. NeatlyWed is for adults running a business. Only a person 18 or older may hold a login, and nothing on the website or in NeatlyWed is directed at children. We do not knowingly collect personal data from a child under 13. If you believe a child has given us data (through the early-access form, say), write to the address in section 8.3 and we delete it.

9.2. A guest list can hold a child's name, because children are invited to weddings. That name is put in by the Business or its client, the adults planning the wedding, and is never collected from the child; it is kept and used like every other guest's name.

10. Security, truthfully

10.1. No system is unhackable, and we will not tell you ours is. What we do:

• Every address is served only over HTTPS, behind Cloudflare.
• Every page of app.neatlywed.com asks for a sign-in, except the sign-in itself, accepting an invitation, the legal pages and a client's link; each Business's data is reached only through that Business's own account, and our tests walk every page to see a stranger turned away.
• Passwords are stored only as salted hashes. Failed sign-ins are counted by account and by IP address, and repeated failures lock the sign-in for a while.
• A client's link is a long random key; a Member can turn it off, or replace it, which stops the old one at once.
• Photos are served only to the Business they belong to; originals are never served; an upload is opened and saved again as an image, and nothing uploaded is ever run.
• Our pages load nothing from other companies' servers except Google's fonts.
• Backups are taken daily and weekly by Railway, and copied nightly, encrypted, to Cloudflare, as section 7 says.
• Secrets live in our host's variable store, never in our code.

10.2. What we do not have yet, and do not claim: two-factor sign-in, and an independent security test. When each is done, this section will say so.

10.3. Your part: keep your password to yourself, send a client's link only to the client, sign out on a shared device, and tell us at once if you think your login has been used by someone else.

11. If there is a breach

11.1. If we learn that a Business's data has been taken, lost or exposed, we tell the Business's Owner immediately, and never later than 72 hours after we discover it (unless law enforcement asks us to wait), with what we know: what happened, whose data, which data, what we have done and what we suggest. Under Texas law a business that keeps data for another must tell the owner immediately on discovery, and we treat that as the standard.

11.2. The Business tells its clients and their guests, because it holds the relationship with them; we help it do so, and we write the notice with it if it wants. Texas law gives a business 60 days from determining a breach of sensitive personal information to notify the people affected, and 30 days to notify the Texas Attorney General when 250 or more Texans are affected; other states have their own clocks.

11.3. For data we control (section 8.3), we notify you ourselves, by email to the address we hold, without undue delay and within 60 days of determining the breach, or sooner where your state's law sets a shorter period, and we notify your state's regulators as its law requires.

12. Where your data is stored

NeatlyWed and every Business's data are hosted in the United States by Railway. Our nightly backup, an encrypted copy that Cloudflare cannot read, is kept by Cloudflare in North America. The website runs on Cloudflare's global network. NeatlyWed is offered to businesses in the United States; if you use it from elsewhere, your data is transferred to and processed in the United States, which may not have the same data protection laws as your country.

13. Changes to this policy

We may change this policy. For a change that matters (a new purpose, a new kind of data, a new provider, a longer time we keep something), we give at least 30 days' notice by email to every person who belongs to a Business, and we update the date at the top. The current policy is always at https://neatlywed.com/privacy; earlier versions are available on request.

14. Contact

Privacy questions and requests, security reports, and everything else: hello@neatlywed.com

Built by Bean LLC

3244 Spaulding Dr, Paris, Texas 75460

Appendix A. Notices for particular states

California. The categories of personal information we have collected are those in section 2: identifiers (names, email addresses, phone numbers, IP addresses); professional information (a business's name, how many weddings it plans a year and where it is based, from the early-access form); customer records (the details a Business keeps about a wedding); visual information (photos of mirrors and from the day); and internet activity (sign-in records and request logs). The sources are in section 3, the purposes in section 4, and the recipients in section 5. We do not sell or share the personal information of anyone, including anyone under 16, and we collect no sensitive personal information. How we answer a Do Not Track signal is in section 6. Your rights (to know, delete and correct, and not to be treated differently) and how to use them are in section 8.

Nevada. We do not sell covered information. A request about sale may be sent to hello@neatlywed.com, the address for every request in section 8.3.

Texas. We do not sell personal data, sensitive or otherwise, and we do not process personal data for targeted advertising or for profiling. The categories, purposes and recipients are in sections 2, 4 and 5. Your rights, the 45-day answer and the appeal are in section 8.

Other states with a privacy law of their own: the same rights, periods and appeal apply to you under section 8. Where Built by Bean falls under a state's small-business or data-volume threshold and its law does not apply to us, we extend the rights anyway.