LegalFor all users

Privacy Policy

Last updated 17 June 2026

UNVL Privacy Policy

Last Updated: 17 June 2026 · Version: 4.0

1. Who We Are

UNVL Ltd is a UK-based wedding marketplace platform that uses AI-powered matching to connect couples planning their weddings with trusted suppliers across the UK. We're registered at Companies House and operate under UK data protection law, primarily the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

When we say "we," "us," "our," or "UNVL," we mean UNVL Ltd. This privacy policy explains how we collect, use, and protect your personal information when you use our platform, website, and services.

2. Information We Collect

We collect information in different ways depending on whether you're a couple or a supplier, and how you interact with our platform.

2.1 Information You Provide to Us

For Suppliers:

  • Account details: your full name, email address, phone number, and business name
  • Business information: service category, location(s), years in business, website, Instagram handle, and certifications
  • Profile content: portfolio images, video content, service descriptions, pricing, availability calendars, and response time
  • Payment details: processed securely through Stripe (we don't store your card details)
  • Reviews and testimonials: feedback from couples who've booked with you
  • Communication: messages you send through our platform to couples

For Couples:

  • Account details: first and last names, email address, and phone number
  • Wedding details: wedding date, venue location, estimated guest count, and budget
  • Style preferences: inspiration images you upload, mood boards, and saved supplier profiles
  • Requirements: specific requests, dietary needs, accessibility requirements, or special requests. Some of these may be "special category data" under UK GDPR, and we only process them with your explicit consent (see Section 4).

Both Suppliers and Couples:

  • Payment information: billing address and payment method details (processed by Stripe, not stored by us)
  • Preference information: communication preferences, notification settings, and optional features you use

2.2 Information Collected Automatically

When you use UNVL, we automatically collect certain information:

  • Device information: device type, operating system, browser type and version, device ID
  • Usage data: pages you visit, features you use, time spent on the platform, clicks, searches, and interactions
  • Connection information: IP address, referring website, and the pages you visit
  • AI processing data: when you use UNVL Assist, your questions and conversation history are processed by our AI providers (see Section 5.2)
  • Location data: if you grant permission, we collect approximate location to help with local matching
  • Cookies and similar technologies: we use these to remember your preferences, keep you logged in, and understand usage patterns (see Section 9)

2.3 Data Generated by Our AI Systems

UNVL uses artificial intelligence to improve your experience. This generates additional data:

  • UNVL Style Analysis: when you upload images, our AI analyses visual preferences, colour palettes, design aesthetics, and style themes to create a profile of your wedding aesthetic
  • UNVL Match Compatibility Scores: we analyse your profile (style, budget, location, values, and specific requirements) alongside supplier profiles to generate compatibility scores that determine which suppliers are shown to you
  • UNVL Budget: budget allocations, category spending, booked supplier costs, and other wedding costs you enter are stored to provide budget tracking and planning tools. This data also informs UNVL Match (matching suppliers within your budget range) and UNVL Assist (budget-aware planning advice)
  • Recommendations: personalised supplier suggestions and content recommendations based on your behaviour and preferences
  • UNVL Assist conversation memory: decisions, preferences, and open questions extracted from your Assist conversations are stored on your account to provide continuity across sessions
  • AI provider processing: to deliver these features, relevant inputs are sent to third-party AI providers for processing (for example to power the Assist chat, to analyse supplier portfolios, and to enable search). We do not train or host our own AI models. The current list of our AI providers, and what each receives, is on our Sub-processors page at unvl.co/subprocessors. Section 6A explains what AI providers never receive, including why Google Calendar data is never sent to any AI provider.
  • Voice transcription: if you use voice input, your audio is processed for real-time transcription and is not stored after transcription completes
  • Platform insights: anonymous aggregated insights about trends, popular styles, and market patterns

2.4 Information from Third Parties

  • Payment processors (Stripe) provide transaction confirmations and failure notifications
  • We may receive information if you link your social media accounts (if this feature is available)
  • Reviews and references you choose to share publicly
  • For suppliers, we show a Google star rating and review count that the supplier provides themselves; before it appears on their profile, we verify it against their public Google listing. Suppliers are responsible for keeping it accurate, and anyone can ask us to check a rating they believe is wrong by contacting privacy@unvl.co

2.5 Onboarding Website Import (Suppliers)

During supplier onboarding, where you provide your business website address and confirm the import, we copy content from that website (such as service descriptions and portfolio images) into a draft profile for you to review and edit before it is published. We do this only at your direction and only after you have created an account and accepted our terms. You can edit or remove any imported content during review or later from your profile.

2.6 Real Wedding Features (Suppliers)

If you choose to showcase a past real wedding, you may give us a link to a public page (such as a blog feature) and we import details for you to edit before publishing. You are responsible for ensuring you have permission to share that content. We publish only the details you keep after editing, and we do not retain other people's names from the source page unless you choose to include them.

3. How We Use Your Information

3.1 Operating and Improving the Platform

  • Creating and maintaining your account
  • Displaying your profile to matched couples or suppliers
  • Processing searches, matches, and recommendations
  • Enabling communication between users
  • Providing customer support
  • Technical troubleshooting and platform maintenance

3.2 AI-Powered Matching

  • Running UNVL Match to analyse compatibility between couples and suppliers
  • Creating UNVL Style profiles from your uploaded inspiration images
  • Generating personalised supplier recommendations for couples
  • Improving the accuracy of our matching over time
  • Analysing why certain matches work well (to improve future matching)

The factors we use to match and order suppliers for you are described in Section 4A.

3.3 UNVL Assist

Our AI-powered planning advisor provides advice and inspiration to couples. This feature draws on the expertise of our supplier community:

  • We use aggregate knowledge from supplier profiles and content to inform suggestions
  • When a supplier's specific expertise is referenced, they're credited by name
  • This is a core feature of our platform; by becoming a supplier, you consent to your expertise being used this way
  • This helps couples and promotes the supplier's business through attribution

3.4 Payments and Billing

  • Processing subscription payments via Stripe
  • Managing billing cycles and invoicing
  • Detecting and preventing payment fraud
  • Responding to billing enquiries and disputes

3.5 Communication

  • Sending transactional emails (account confirmations, booking updates, payment receipts)
  • With your consent, sending marketing emails about features, new suppliers, or special offers
  • Notifying you of important changes to our terms or policies
  • Responding to your enquiries and support requests

3.6 Legal and Security

  • Preventing fraud, abuse, and illegal activity
  • Investigating complaints and disputes
  • Complying with legal obligations (tax records, law enforcement requests)
  • Protecting the rights, property, and safety of UNVL, our users, and the public
  • Enforcing our Terms of Service

3.7 Analytics and Improvements

  • Understanding how the platform is used
  • Identifying trends and patterns (anonymised)
  • Testing new features and improvements
  • Measuring the success of our AI systems
  • Creating business intelligence reports (anonymised)

4. Legal Basis for Processing (UK GDPR)

Under UK GDPR, we must have a legal reason to process your data. Here's ours:

Contractual Necessity: We process information necessary to provide platform services (matching, communication, payments) because you've agreed to our Terms of Service.

Legitimate Interests: We use your data to improve services, enhance security, prevent fraud, conduct analytics, and (for suppliers) build a draft profile from your website at your direction. We have balanced these interests against your rights and consider they do not override them, because they directly improve your experience and keep the platform secure. You can object to processing based on legitimate interests (see Section 8).

Consent: For marketing communications and optional features (like location data), we ask for your consent, which you can withdraw anytime.

Explicit Consent (special category data): Some details you may choose to give us, such as dietary requirements, accessibility needs, or religious or cultural ceremony preferences, are "special category data" under UK GDPR. Where you provide these, we process them only on the basis of your explicit consent (Article 9(2)(a)), to help match you with suitable suppliers and tailor planning advice. You are never required to provide this information to use UNVL, and you can withdraw this consent at any time.

Legal Obligation: Some data must be retained for tax purposes (6 years), regulatory compliance, and law enforcement.

4A. Automated Processing and How Matching Works

UNVL Match uses automated analysis to suggest and order suppliers for you. We do not consider this to produce legal or similarly significant effects, and there is no solely-automated decision that significantly affects you; the matches are recommendations, and you choose whether to contact, shortlist, or book any supplier.

To be transparent about the logic involved, the main factors that determine which suppliers are matched and how they are ordered are: (1) how well a supplier fits your stated style, requirements, budget, and location; (2) the completeness and quality of the supplier's profile; and (3) the supplier's recent activity and responsiveness. Reviews and booking history contribute to quality. We do not disclose the precise weightings or the underlying models, both to protect our intellectual property and to keep matching fair and resistant to manipulation. You can ask us about how matching applied to you by contacting privacy@unvl.co.

5. Who We Share Your Information With

5.1 Within the Platform

  • Supplier profiles: visible to matched couples (business info, portfolio, reviews)
  • Couple preferences: shared with compatible suppliers so they understand what you're looking for
  • Reviews and testimonials: publicly displayed with your permission
  • Messages: only visible to the intended recipient and UNVL support if you request help

5.2 Third-Party Service Providers

We work with trusted partners who process data on our behalf. All third-party processors have contracts that require them to protect your data and use it only for the purposes we specify. The categories of processor we use are:

  • Payment processing (card payments and subscriptions)
  • Cloud hosting and infrastructure (storing and serving the platform, authentication, media storage and delivery)
  • Email delivery (transactional and marketing email)
  • Product and log analytics (understanding usage and operating the platform)
  • Error monitoring (technical diagnostics)
  • AI service providers (powering matching, search, the Assist chat, image analysis, and transcription)
  • Supplier onboarding research (web research about a supplier to help build their draft profile)

The named companies in each category, the data each receives, and the country of processing are listed on our Sub-processors page at unvl.co/subprocessors. We do not train or host our own AI models.

Data boundary , Google OAuth scopes: data obtained via Google OAuth scopes, including Google Calendar events accessed under the calendar.readonly scope, is never forwarded to any AI service provider. Calendar events are read on our backend solely to determine a supplier's busy/free status on a given wedding date, and the resulting availability flag is surfaced in the product UI. Raw event titles, descriptions, attendees, locations, and any other calendar metadata are not shared with any AI provider.

Google API Services compliance: UNVL accesses Google Workspace APIs (specifically Google Calendar, via the calendar.readonly OAuth scope) on behalf of suppliers who have explicitly connected their Google Calendar to the platform. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. In practice:

  • We use Google Calendar data only to determine a supplier's busy/free status on a given wedding date, and to surface that availability indicator in the product UI to couples viewing that supplier.
  • We do not transfer Google Workspace API data to third parties (including AI providers) except as necessary to provide or improve user-facing features that are visible and prominent in the UNVL platform.
  • We do not use Google Workspace API data to serve advertisements, including retargeted, personalised, or interest-based advertising.
  • We do not use Google Workspace API data for any purpose other than the user-facing features described in this policy.
  • Human access to Google Workspace API data is limited to (a) what is necessary to comply with applicable law, (b) ensuring the security of the platform, (c) where the user has explicitly given consent, or (d) where data has been aggregated and anonymised so individual users cannot be identified.

5.3 Legal Requirements

We may disclose information if required by law or court order; needed to protect the rights, safety, or property of UNVL or our users; necessary to prevent or investigate fraud or illegal activity; or requested by law enforcement or regulatory authorities.

5.4 Business Transfers

If UNVL is acquired, merged, or sold, your information may be transferred as part of that transaction. We'll notify you of any such change and any choices you may have.

5.5 What We Don't Do

We do not sell, rent, or lease your personal information to third parties for marketing purposes. Your data is never used for purposes outside of running UNVL without your consent.

6. UNVL Assist and Supplier Expertise

UNVL Assist is our AI planning tool that provides couples with advice, inspiration, and guidance, powered in part by knowledge and best practices from our supplier community.

How it works: Suppliers' advice, tips, and expertise (drawn from profile content, published guides, or past interactions) may be used to inform suggestions provided to couples through UNVL Assist.

Attribution: When a specific supplier's expertise is referenced, they're credited by name. For example: "As photographer Sarah Jones recommends..." or "Florist Tom's tip: consider seasonal blooms..."

Your consent: By registering as a supplier on UNVL, you consent to your expertise being used in this way. This is a core benefit of being part of the platform.

Opt-out: If you prefer not to have your expertise used for UNVL Assist, contact privacy@unvl.co, but note that this may affect your visibility on the platform.

6A. AI Services Transparency

This section, together with the Sub-processors page, is the single place to see how UNVL uses AI.

We use third-party AI providers to power matching and search, the UNVL Assist chat, analysis of supplier portfolio images, and voice transcription. We do not train or host our own AI models. The named providers, and what each receives, are listed on the Sub-processors page.

What AI providers never receive:

  • Payment details, card numbers, or billing information
  • Account passwords or authentication tokens
  • Data obtained via Google OAuth scopes. In particular, Google Calendar events accessed under the calendar.readonly scope are used only to determine a supplier's busy/free status on a given wedding date. Raw calendar metadata (event titles, descriptions, attendees, locations) is never forwarded to any AI provider.

Legal basis and your choices: AI processing that is necessary to deliver the feature you've asked for (for example, sending your message so UNVL Assist can reply) is carried out on the basis of contractual necessity. AI processing that improves or personalises optional features is carried out on the basis of legitimate interests, balanced against your privacy. Special-category data is processed only with your explicit consent (Section 4). You can exercise the rights in Section 8 in respect of AI-processed data just as for any other personal data.

7. Data Retention

We don't keep data longer than necessary.

Active Accounts:

  • Your profile and account data are retained while your account is active
  • Usage and activity logs are kept for 12 months
  • Anonymised analytics data may be kept longer

AI-derived data: data generated by our AI systems about you (for example Style profiles, Match compatibility scores, text embeddings, and Assist conversation memory) is retained while your account is active and is deleted or anonymised when your account is deleted, on the same schedule as the underlying account data below.

Cancelled Supplier Accounts:

  • Your public profile is removed within 30 days of cancellation
  • Your account data (emails, messages, login history) is deleted within 90 days
  • Business records (invoices, tax information) are retained for 6 years as required by law

Cancelled Couple Accounts:

  • All personal data is deleted within 30 days of your deletion request
  • Anonymised transaction records are kept for 6 years for legal compliance

Payment Records: kept for 6 years as required by UK tax law, stored securely and access-restricted.

Messages and Communication: retained for the duration of your account; deleted when your account is deleted, unless we're legally required to retain them.

Reviews and Testimonials: kept for as long as the associated account exists; may be anonymised if accounts are deleted.

Cookies: session cookies are deleted when you close your browser; persistent cookies expire after 12 months; marketing and analytics cookies can be deleted through your preferences anytime.

8. Your Rights Under UK GDPR

Right of Access: request a copy of all personal data we hold about you in a structured, commonly used format.

Right of Correction: update or correct any inaccurate or incomplete information.

Right of Erasure (Right to be Forgotten): request deletion of your data, with some exceptions (for example where we're required to keep it for legal reasons). You can request account deletion from Settings > Privacy & Data > Delete Account. Your data will be removed within 30 days, except for records we're legally required to retain (see Section 7).

Right to Restrict Processing: ask us to limit how we use your data while you investigate or dispute something.

Right to Data Portability: request your data in a machine-readable format. You can export all your personal data at any time from Settings > Privacy & Data > Export Data. This generates a downloadable ZIP file containing your profile, conversations, messages, shortlist, match data, and notifications.

Right to Object: object to processing based on legitimate interests or for marketing purposes.

Right to Withdraw Consent: withdraw consent for optional processing (like marketing emails, or special-category data) at any time.

Right to Lodge a Complaint: if you believe we've mishandled your data, you can complain to us directly first at privacy@unvl.co, and we will acknowledge and respond within 30 days. You can also lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk at any time, though we'd appreciate the chance to put things right first.

How to exercise your rights: contact privacy@unvl.co. We'll respond within 30 days (or up to 90 days for complex requests). We may ask you to verify your identity before processing your request.

9. Cookies and Similar Technologies

Cookies are small files stored on your device that help us recognise you and improve your experience.

Essential Cookies: keep you logged in, maintain your session, prevent fraud and abuse, and are required for basic platform functionality. These cannot be disabled without breaking the platform.

Analytics Cookies: help us understand how you use UNVL, track which features are popular, and identify technical problems. Set only with your consent.

Preference Cookies: remember your settings and communication preferences.

Marketing Cookies: track activity to show relevant ads elsewhere. Only used with your explicit consent.

Managing Cookies: when you first visit, we ask for your consent (except essential cookies). You can change your choices anytime in your account preferences, and you can delete or block cookies through your browser settings, though this may limit platform functionality.

10. Data Security

Encryption: data is encrypted in transit (HTTPS) and at rest using industry-standard encryption protocols.

Access Controls: only authorised staff can access personal data, and only as needed to do their jobs.

Secure Infrastructure: we host on secure, monitored cloud platforms with firewalls, intrusion detection, and regular security updates.

Regular Reviews: we conduct regular security assessments and penetration testing.

Staff Training: our team receives data protection and security training.

Incident Response: if we discover a breach, we'll investigate immediately and notify affected users and authorities as required by law.

Important Limitation: no security system is 100% secure. Use a strong password, keep your login details secret, and use secure internet connections.

11. International Data Transfers

Most of your data is stored in the UK or European Economic Area (EEA). Our primary database is hosted in the London (eu-west-2) region by MongoDB Atlas.

When data is transferred outside the UK/EEA (for example to AI providers with US-based processing), we rely on appropriate safeguards as required by UK GDPR. Following the Data (Use and Access) Act 2025, we assess that the protection in the destination is not materially lower than under UK law, and we use one of:

  • the UK-US Data Bridge / EU-US Data Privacy Framework and UK Extension where the recipient is certified;
  • EU Standard Contractual Clauses (2021) with the UK Addendum / the International Data Transfer Agreement (IDTA) for transfers to countries without an adequacy decision; or
  • an adequacy decision where the receiving country has equivalent protection.

The safeguard relied on for each provider is shown on the Sub-processors page. Transfers are only made where necessary to provide services or for legitimate business reasons.

12. Children

UNVL is not intended for anyone under 18. At sign-up we ask you to confirm you are 18 or over and we record that confirmation (the timestamped boolean only, never your date of birth or any other identifying age data). We don't knowingly collect data from children. If you believe we've collected data from a child, please contact privacy@unvl.co immediately, and we'll delete it.

13. Third-Party Links

Our platform may include links to other websites. This privacy policy applies only to UNVL. Other websites have their own privacy policies, and we're not responsible for how they handle your data.

14. Changes to This Privacy Policy

We may update this policy as our services evolve or laws change. If we make material changes, we'll notify you by email at least 30 days before the changes take effect, post a notification on the platform, and ask for your consent if required by law. Your continued use of UNVL after changes means you accept the updated policy.

15. Contact Us

Email: privacy@unvl.co

We'll aim to respond to general enquiries within 7 business days. For requests about your data-protection rights, the statutory timescales in Section 8 apply (normally within one calendar month). For urgent data protection issues, you can also contact the Information Commissioner's Office at ico.org.uk.

Version: 4.0 Effective Date: 17 June 2026