Privacy Policy
Last updated: September 3, 2026
1. Who is responsible for your data
Invitly is operated by [LEGAL ENTITY NAME], [REGISTERED BUSINESS ADDRESS], [COUNTRY]. We are the data controller for personal data processed through Invitly. For any privacy request, email contact@theinvitly.com.
2. Information We Collect
Account data you provide (name, email, password hash); content you add to invitations (event details, images, text, music links); RSVP responses submitted by your guests; support messages; and technical/usage data such as IP address, device and browser type, and pages visited, collected to operate and secure the service.
3. How We Use Your Information
To create and run your account; to host and publish your invitations; to send RSVP notifications and transactional account emails; to process payments through our reseller; to provide support; to detect fraud and abuse; and to comply with legal obligations. We do not use your data for advertising and we do not sell it.
4. Legal Bases (where GDPR/UK GDPR applies)
We process data to perform our contract with you (providing the service), on the basis of our legitimate interests (security, fraud prevention, improving the product), to comply with legal obligations (tax and accounting records), and with your consent where required (e.g. optional communications).
5. Service Providers / Sub-processors
We share data only with providers that help us run the service, under contract and only as needed: Paddle (Paddle.com Market Ltd) as Merchant of Record for payment processing, billing, tax and refunds; MongoDB Atlas for database hosting; Cloudinary for image hosting; Resend for transactional email; and our application hosting provider. Payment card details are entered directly with Paddle and are never received or stored by us.
6. International Transfers
Our providers may process data in countries outside your own, including the United States. Where required, these transfers are covered by appropriate safeguards such as the EU Standard Contractual Clauses or an equivalent mechanism.
7. Data Retention
Account data is kept while your account is active and for a short period afterwards to handle disputes and legal obligations. Invitation and guest (RSVP) data is deleted when you delete the invitation or your account. Payment and invoice records are retained by us and by Paddle for the period required by tax law (typically 6–10 years). Backups are cycled out on a rolling basis.
8. Guest Data
RSVP data submitted by your guests is accessible to you (the invitation creator) and, for support and abuse-prevention purposes, to our team. As the invitation creator you are responsible for handling your guests' information lawfully and for any custom questions you choose to ask them.
9. Data Security
We use industry-standard measures including HTTPS everywhere, hashed passwords, access controls, and encrypted database storage. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and regulators of any breach as required by law.
10. Cookies
We use only essential cookies for authentication and session management. We do not use advertising or third-party tracking cookies.
11. Your Rights
Depending on where you live, you may have the right to access, correct, delete, export or restrict processing of your personal data, to object to processing, and to withdraw consent. You can manage most account data from your profile settings, or email contact@theinvitly.com and we will respond within the time required by law. You also have the right to complain to your local data-protection authority.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be posted here with a new date and, where required, notified by email.
13. Contact
For any privacy question or request, email contact@theinvitly.com. You can also reach us on Instagram at @theinvitly, but email is our primary channel for privacy matters.