Privacy Policy

1. Who we are

Inviteo ("we", "us") provides invitation pages with RSVP collection at inviteo.design. For privacy questions, or to exercise any of the rights below, contact privacy@inviteo.design.

For the data you enter about your event, you are the data controller and Inviteo acts as your processor. For your own account data, we are the controller.

2. What we collect

Account data. Your name and email address. If you sign in with Google, we receive your name, email address, and profile picture from Google, never your Google password.

Event data. Whatever you choose to put on your invitation: names, date, venue, contact phone, your messages, and an optional song selection.

Guest RSVP data. When a guest responds, we store the name they enter, their attendance status, party size, and any message. Email is optional and only stored if the guest provides it.

Analytics data. Only if you accept analytics cookies on our marketing site: pages viewed and basic device information. Invitation pages are never analytics-tracked, so your guests are not measured by us.

Payment data.When you pay to publish, Stripe processes the payment and we store only the outcome: which plan, the amount, and Stripe's reference for it. Your card number never reaches our servers.

3. Why we use it, and our legal basis

• To provide your invitation, RSVP dashboard, and account: performance of a contract.
• To take payment and keep records of it: performance of a contract and legal obligation.
• To keep the service secure and prevent abuse: legitimate interests.
• To measure and improve our marketing site: consent, which you give or refuse in the cookie banner and can change at any time.
• To send you service emails about your own events: performance of a contract.

We do not sell your data or your guests' data, and we do not use it to train machine-learning models.

4. Who we share it with

Guest RSVP responses are visible to you, the event owner, in your dashboard. Beyond that, we share data only with the processors that run the service:

• Supabase: database and authentication (data stored in Canada).
• Vercel: application hosting and delivery.
• Stripe: payment processing when you publish.
• PostHog: marketing-site analytics, only with your consent.
• Google: only if you choose to sign in with Google.
• Spotify: if you add a song, guests' browsers load Spotify's player directly from Spotify.

Some of these providers are based in the United States. Where data leaves the UK/EEA, transfers rely on Standard Contractual Clauses or an equivalent safeguard.

5. How long we keep it

Event and RSVP data is kept while your account is open, so you can revisit past celebrations. We do not automatically delete guest responses after an event date passes: RSVP data (guest names, contact details, and messages) is retained indefinitely until you delete the event or close your account. Delete an event and its RSVP data is removed with it. Close your account and we delete your account, events, and their RSVP data within 30 days, except where we must retain records to meet a legal obligation. Payment records, for example, must be kept for tax purposes. Analytics data is retained for up to 12 months.

6. Your rights

Depending on where you live, you have the right to access, correct, delete, export, or restrict processing of your personal data, and to object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time without affecting prior processing. Email privacy@inviteo.design and we will respond within 30 days. You also have the right to complain to your local data protection authority.

If you are a guest who responded to an invitation and want your response removed, contact the couple or host who invited you, or email us and we will pass the request on.

7. Children

Inviteo is not directed at children under 16, and we do not knowingly create accounts for them. If you believe a child has given us personal data, contact us and we will delete it.

8. Security

Data is encrypted in transit and at rest. Access to production data is limited to those who need it to operate the service. No system is perfectly secure, but if a breach affects your data we will notify you and the relevant authority as required by law.

9. Changes

If we make a material change to this policy, we will update the date above and notify account holders by email before it takes effect.