Privacy policy

Last updated 2 October 2026. In plain language, as required by Malaysia's Personal Data Protection Act 2010 (PDPA).

BlissPath is run by Moses Wong ("we"). Couples use BlissPath to send wedding invitations and collect replies. This page explains what personal data we hold, why, who can see it, and how to have it removed.

Couples and their helpers

• What we collect: your email address (to sign you in), the name you give us, your wedding details (names, dates, venues, photos you upload), and your payment status. Card and bank details are handled by ToyyibPay; we never see them.
• Help messages: when you use Help & feedback, we keep your message with your email, your wedding, the page you were on and your phone and browser type, so we can answer and fix problems.
• Why: to run your account, show your invite to your guests, and confirm your payment.

Guests

• What we hold: the names, WhatsApp numbers and groupings that the couple adds or that you enter yourself when you reply; your replies for each event; dietary needs; any message you leave for the couple; and, if the couple uses the angpow ledger, the amount recorded against your family.
• Why: so the couple can invite you, know who is coming, plan seating and thank you. We do not use guest details for anything else, and we never sell them or send marketing to guests.
• Who decides: the couple decides whom to invite and what to record. Contact them first about your details; you can also contact us (below).

Visit counts

To see how BlissPath is used, we count visits: which part of the site was opened, for how long it was on screen, the website that linked to it, and whether it was a phone, tablet or computer. We use no cookies and store no IP address or account, so these counts cannot tell us who you are. They are deleted after 12 months.

Who can see what

• The couple and the co-hosts they invite can see their own wedding's guest list, replies, wishes and angpow records. Nobody else can, including other couples.
• Wedding-day helpers (for example ushers) can see guests' names, table numbers and arrival only: not phone numbers, replies or wishes.
• A guest's personal invite link shows only that family's names and replies.
• We can access the data to keep the service running and to help when you ask us to.

Service providers

We use: Supabase (database and sign-in), Cloudflare (hosting), ToyyibPay (payments) and Google Fonts (typefaces on invites). They process data on our behalf and may store it outside Malaysia. Invitations are sent by the couple through their own WhatsApp; WhatsApp's own privacy terms apply there.

How long we keep it

A couple can delete their wedding at any time (Overview › Delete this wedding), which removes the invite, guest list, replies, seating, angpow records and uploaded photos. Otherwise: 90 days after the last event, the invite stops taking replies; 12 months after it, we delete the wedding and everything in it. We email the couple two weeks before, and they can download their guest list free of charge until then. Help messages are deleted 12 months after you send them. Payment records are kept as long as the law requires.

Security

Access is enforced inside the database for every request, data is encrypted in transit, and invite and team links are long random codes. No system is perfectly secure; if we learn of a breach affecting your data we will tell the affected couples promptly.

Your rights

You may ask to see, correct or delete your personal data, or withdraw your consent. Couples can do most of this in the dashboard. Guests: ask the couple, or contact us and we will pass the request on or act on it.

Contact

Email [email protected] or WhatsApp +601111942382. We will answer within 21 days, as the PDPA requires.