Privacy Policy

1. What we collect

When you create an account: your name and email address. When you build a site: the event details, photos, and text you choose to add. When guests RSVP: the names, responses, and any custom-question answers they submit through your site.

2. How we use it

To operate the account and event site you create, to display your published site to the guests you invite, to process RSVPs, and to send account-related email (e.g. password resets). We don't sell your data or your guests' data.

3. Who we share it with

We use a small number of service providers ("subprocessors") to run Invitely, each bound by its own data protection terms:

• Supabase — our database, authentication, and photo-storage provider. Your account, your site's content, and any photos you upload are stored here.
• Resend — our transactional email provider, used to send account emails (e.g. password resets) and, if you choose to send them, guest invitation emails.
• If you use a paid plan once payments launch, a payment processor will handle your card details directly — we never see or store full card numbers ourselves.

We don't sell your data, or your guests' data, to anyone.

4. Your rights

You can access, correct, export, or delete your account data at any time from your dashboard, or by contacting us. If you're in the EU/EEA, UK, or another jurisdiction with similar protections, this includes the rights guaranteed under the GDPR (or that jurisdiction's equivalent) — including the right to lodge a complaint with your local data protection authority.

5. Cookies

We use essential cookies to keep you signed in and to remember your site's draft state. We don't use third-party advertising or tracking cookies.

6. Data retention

We keep your account and site data for as long as your account is active. Deleting your account removes your published site and guest data, subject to any retention required by law (e.g. payment records).

7. Security

We rely on our subprocessors' security controls (encryption in transit and at rest, access controls) and apply our own access restrictions on top — for example, guest RSVP lookups only ever return the one guest's own name, table, and RSVP status, never a full guest list, and a site's content is not publicly readable until its host explicitly publishes it. No method of transmission or storage is 100% secure, so we can't guarantee absolute security.

8. International data transfers

Our subprocessors may store and process data in countries other than your own, including outside the EU/EEA. Where that happens, we rely on the safeguards those providers offer (such as standard contractual clauses) to protect your data to a comparable standard.

9. Children's privacy

Invitely is intended for adults planning events, not for use by children. We don't knowingly collect account data from anyone under 16. A guest RSVP may include a minor's name if a host invites them as a plus-one, but we don't knowingly collect data directly from children.

10. Changes to this policy

We may update this policy as the product changes (for example, once payments launch). Material changes will be reflected here with an updated date; continuing to use Invitely after a change means you accept the update.

11. Contact

Questions about this policy, or a request to access/delete your data? support@invitely.app.