This page is specifically for users located in the European Union, European Economic Area, and the United Kingdom. It explains how Marryo complies with the General Data Protection Regulation (GDPR) and the UK GDPR.
For our full data practices, please see our Privacy Policy.
Marryo acts as the data controller for personal data collected through the platform. As data controller, we determine the purposes and means by which your personal data is processed.
If you have any questions about how we handle your data, you can reach us via our Contact page.
Under GDPR, we must have a lawful basis for processing your personal data. We rely on the following bases depending on the type of processing:
Contract
Processing necessary to deliver the Service you have purchased — including storing your wedding content, running AI features on your inputs, and managing your account.
Legitimate interests
Processing necessary for our legitimate business interests, where those interests are not overridden by your rights — including platform analytics, debugging, and product improvement.
Legal obligation
Processing required to comply with applicable law — including retaining transaction records for tax and accounting purposes.
Consent
Where we rely on consent — such as sending marketing emails, or processing a photo you upload to an AI editing feature — you can withdraw that consent at any time. For marketing emails, use the unsubscribe link in any email we send. For uploaded photos, you can delete them from your account at any time.
As an EU or UK user, you have the following rights regarding your personal data:
To exercise any of these rights, visit our Contact page. We will respond within 30 days. There is no charge for making a request.
We retain your personal data only for as long as necessary to provide the Service and meet our legal obligations.
Marryo serves users globally. To provide the Service, your data may be processed by third-party providers operating outside the EU and UK — including AI processing services and analytics tools.
Where data is transferred outside the EU/UK, we ensure appropriate safeguards are in place in accordance with GDPR requirements, including relying on providers who participate in recognised transfer frameworks or operate under Standard Contractual Clauses.
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. This includes TLS encryption in transit and AES-256 encryption at rest.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay, as required by GDPR.
If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with your local data protection supervisory authority. In the EU, this is your national data protection authority. In the UK, this is the Information Commissioner's Office (ICO).
We would always appreciate the opportunity to address your concerns directly first — please visit our Contact page and we will do our best to resolve any issue promptly.
We may update this GDPR Compliance page from time to time to reflect changes in our practices or applicable law. When we make significant changes, we will update the "Last updated" date at the top of this page.