Legal

Privacy policy

Last updated 22 October 2026

This policy explains how Surrey Quays Photo Studio Ltd, trading as SQ Creative Media London (“we”), uses personal data when you use Unseal. We are the data controller for account and order data. Contact us about privacy at support@sqcreativemedia.co.uk or 142 Lower Road, London SE16 2UG, United Kingdom.

What we collect

Account details: your name, email address and an encrypted (hashed) version of your password.
Invitation content: the words, dates, places and photos you add. We remove location metadata from photos when you upload them.
Orders: what you bought, the amount and the payment reference. Card payments are handled by Stripe; we never receive your full card number.
Guest replies: when guests reply to an invitation, the name, attendance, number of guests, message and optional email they enter.
Technical data: basic server logs and a one-way scrambled version of IP addresses, used to keep the service secure and prevent abuse.

How and why we use it

To provide the service you’ve asked for: creating, publishing and hosting your invitation, collecting replies and sending receipts (contract).
To keep the service secure, prevent fraud and spam, and fix problems (legitimate interests).
To keep financial records as required by law (legal obligation).
To send occasional news about new designs, only if you’ve opted in. You can unsubscribe at any time (consent).

Guests

If you’re a guest replying to an invitation, the host decides why your reply is collected and is responsible for it. We process your reply on the host’s behalf, store it securely and show it only to the host. We don’t use guest data for marketing. To change or remove your reply, contact the host or us.

Cookies

We use a single essential cookie to keep you signed in. We don’t use advertising or tracking cookies. Invitations may remember a guest’s reply in their own browser so they don’t see the form twice.

Who we share data with

We use trusted providers to run the service, who process data only on our instructions: Stripe (payments), our hosting and database providers (for example Vercel and Neon), Cloudflare (photo storage) and Resend (email delivery). Some of these providers may process data outside the UK; where they do, transfers are protected by UK-approved safeguards such as the International Data Transfer Agreement or standard contractual clauses. We never sell personal data.

How long we keep it

Account data: while your account is open.
Invitations and guest replies: until you delete them or your account, and no longer than 24 months after the event date.
Order and payment records: 6 years, as required by UK tax law.

Your rights

You can ask to access, correct, delete, restrict or move your personal data, or object to how we use it. You can delete your account yourself in your account settings. To make a request, email support@sqcreativemedia.co.uk. If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk.

Security

Data is encrypted in transit, passwords are hashed, and access to production systems is restricted. Invitation links are unlisted and we ask search engines not to index them, but anyone with a link can view that invitation, so share it with care.

Children

Unseal isn’t intended for children under 16, and we don’t knowingly collect their data.

Changes

We’ll update this page if anything changes, and email account holders about significant changes.