Privacy policy

Your account. Your name, email address, phone number and profile photo. If you sign in with Google, Google tells us your name, email address and profile photo. We never see your Google password.

Your wedding. What you add while planning: dates and events, your guest list (names, phone numbers, email addresses, groups), RSVPs (who's coming, party size, dietary needs, notes), seating, your registry and places to stay, photos you upload, your calendar and the people you invite to plan with you.

Vendors. If you list a business: its details, photos and prices, the legal name on your ID and the details we need to verify it, and the bank or M-Pesa account we pay you into (we only show you a masked version).

Bookings and payments. Enquiries, messages, quotes and agreements between couples and vendors. When you sign an agreement we record your typed name, the time, your IP address and browser, and that you confirmed a code sent to your email, so there's evidence of who signed. Payments go through Paystack: we receive the amount, status and method, not your full card number or M-Pesa PIN.

Reviews you write about vendors you booked.

Technical information. Our hosting providers log basic request details such as IP address, browser and pages requested, to keep Bango running and secure. We keep you signed in using your browser's local storage. We don't use advertising cookies and we don't sell your information.

Vendor page visits. When you look at a vendor on Bango, we count it for that vendor: that their page was opened, where the visit came from (for example Bango search or Google), and things like checking their dates or asking for a quote. To count each visitor once a day, we set a cookie with a random number and store only a scrambled version of it. We don't store your IP address or link these counts to your account, and vendors only ever see totals, never who looked. We delete the individual visits after 90 days.

When a couple adds guests, Bango stores those guests' details on the couple's behalf so they can send invitations, collect RSVPs and plan seating. Couples: only add people you know, and only the details you need. Guests: if you'd like your details removed from a couple's list, ask the couple, or email us at chris@bango.cloud and we'll help.

• To run your account and the tools you use: planning, invitations, RSVPs, your wedding website and bookings. (Contract.)
• To verify vendors, collect payments for vendors, and handle refunds and problems. (Contract and our legitimate interest in keeping Bango safe.)
• To send you emails you need, such as sign-in links, booking updates, receipts and calendar invites. (Contract.)
• To show vendors how many couples view their page and ask for quotes, as totals only. (Legitimate interest.)
• To prevent fraud, abuse and security problems, and to fix bugs. (Legitimate interest.)
• To keep records the law requires, such as payment records for tax. (Legal obligation.)

We don't send marketing emails without asking you first, and you can say no at any time.

Your wedding website (yourname.bango.cloud) is public to anyone with the link, and so is anything you choose to put on it. A guest's personal invitation link shows that guest their own invitation and RSVP. Vendor profiles, their work and reviews are public. Everything else in your wedding is visible only to you and the people you invite to plan with you, and the parts of a booking you share with that vendor.

We share information only with the services that run Bango for us, and only what they need:

• Supabase: our database, sign-in and file storage.
• Vercel: hosts the website.
• Paystack: takes card and M-Pesa payments and pays vendors.
• Resend: sends our emails.
• Google: "Continue with Google" sign-in, and maps and place search for venues.

We also share booking details between the couple and the vendor involved. We'll share information if the law requires it, or to protect someone's safety or Bango against fraud. Some of these providers store data outside Kenya; we choose providers that protect it to a standard at least as strong as Kenyan law requires.

We keep your information while your account is open. If you ask us to delete your account, we delete it within 30 days, except what we have to keep: payment, booking and signed-agreement records, which we keep as long as the law requires (usually five years for financial records in Kenya), or longer if they're needed for an open dispute.

Under Kenya's Data Protection Act you can ask us to tell you what we hold about you, give you a copy, correct it, delete it, or stop or limit using it, and you can object to how we use it. Email chris@bango.cloud and we'll reply within 14 days. If you're unhappy with our answer you can complain to the Office of the Data Protection Commissioner.

Information is encrypted in transit, access to it is limited to the people and services that need it, and payment card details never touch our servers. No system is perfect; if something goes wrong that puts your information at risk, we'll tell you and the Data Protection Commissioner as the law requires.

Bango is for adults. Don't create an account if you're under 18. Couples may add children to a guest list; please add only what's needed, such as a name.

If we change this policy we'll update the date at the top, and tell you by email or in Bango if the change is significant. See also our terms.