Privacy Policy
Effective: [Effective date]
This policy explains what we collect when you create an invitation or take part in one as a guest, what we use it for, who can see it and how long we keep it. We collect only what the product needs, and we never sell it.
Who is responsible
Invitly is run by [Legal business name]. It is responsible for the personal information described here.
Send any privacy request or question to [Email for privacy requests].
What we collect
| Data | Where it comes from | Who can see it |
|---|---|---|
| Your account: email address, name, and your Google identity if you sign in with Google. A password is kept only as a scrambled hash, by our sign-in provider. | You, or Google | You and Invitly |
| The invitation: its text, the event's date and place, the hosts' names | The creator, with our AI | Anyone with the link, once it is published |
| The creator's photos | The creator | Anyone with the link, once it is published |
| A spoken description: we turn it into text and do not keep the recording | The creator | The creator |
| Payments: taken by our payment provider. We keep the payment's reference, the amount and its state, never the card number | The payment provider | The creator and Invitly |
| A guest's answer: name, how many are coming, and a message | The guest | The host. The names of those coming, if the host shows the guest list. A message, only if the host makes messages public |
| Guests' photos, videos and voice notes | The guest | Anyone with the link |
| Stickers | The guest | Anyone with the link |
| A pitch-in: the guest's name, the amount if given, and the screenshot | The guest | The screenshot: only the host. The card with the name, and the amount if the host allows it and the guest chose to show it: anyone with the link, once the host accepts it |
| The host's payment handles for pitch-in | The host | Anyone with the link |
| A cookie that recognises a guest's device. We store it only as a hash | Set by Invitly | Nobody: it only lets a guest change their answer and remove their own posts |
| A keyed hash of your network address that changes every day. We keep no network address with an upload | Made by Invitly from each request | Invitly, to limit abuse |
| A report: what was written, and a name and an email address if given | The person who reports | Invitly only. Never the host |
Why we use it
- To show the invitation to the people who have its link.
- To let guests answer, post and pitch in.
- To take payment for a plan.
- To send account emails, receipts and service notices.
- To keep abuse, spam and illegal content out.
- To answer reports and requests.
We never use your information to advertise, and we never sell it.
Who sees what
Anyone who has an invitation's link can see the invitation and what guests posted on it: photos, videos, voice notes, stickers, accepted pitch-in cards, and the guest list when the host shows it.
Only the host sees the answers of people who are not coming or not sure, messages the host keeps private, and pitch-in screenshots.
Invitly's staff look at content when they work on a report or check something our automatic checks held back.
Every invitation asks search engines not to list it.
AI and automatic checks
Photos, the still image of each video, AI-made images, and the names and messages guests write are checked automatically by Google's AI service before they show. A video and a voice note cannot be checked by a model: they wait for the host before they show, unless the host switched on showing them at once. A pitch-in screenshot is never sent to a model.
To build an invitation, the creator's description, photos and the text of a dictation go to Google's AI service. Google does not use them to train its models.
A guest's photo is sent to Google to be restyled only when the guest asks for an AI photo style and has confirmed being 18 or older.
Photos, video and voice
We remove location data from every photo and video we store. A video that still carries a location and cannot be cleaned is refused. Voice notes are stored as the browser recorded them.
An upload that was never finished is deleted within 24 hours.
Companies that work for us
These companies process personal information for us, under their own data-protection terms:
| Company | What it does for us |
|---|---|
| Supabase | Database, sign-in and file storage |
| Vercel | Hosting, and protection against abuse and automated traffic |
| Stripe | Payments |
| Resend | Sending email |
| AI models; sign-in with Google |
How long we keep things
| What | How long |
|---|---|
| An invitation and what guests posted | Until the invitation closes, and 14 days more |
| An unpaid draft | Deleted after 90 days untouched |
| A deleted invitation or account | Deleted for good within 30 days |
| A pitch-in screenshot | 7 days after the host decides, and 30 days at most |
| A reporter's name, email address and words | 90 days after the report is closed |
| Files kept as evidence after a removal, where the law asks for it | 365 days |
| An invitation that lost its plan through a refund or a payment dispute | Offline at once; it closes within 30 days |
| A record of each email we sent | 30 days |
| Payment records | As long as the law requires |
Cookies
We use only the cookies the product needs to work:
| Name | What it does | How long |
|---|---|---|
__Host-inv-auth | Keeps a creator signed in | Until you sign out or the sign-in expires |
__Host-ig | Recognises a guest's device on one invitation, so they can change their answer and remove their own posts | Up to 400 days; it stops working when the invitation closes |
__Host-ih | Opens the host's controls on the invitation | 12 hours |
NEXT_LOCALE | Remembers the language you chose | Up to 365 days |
We use no advertising cookies and no analytics cookies, so there is no cookie banner.
Children
Invitly is for adults who host events. A guest under 13 must not post. Parents often post photos of their own children at a party; that is allowed.
A parent or guardian can ask for anything about their child to be removed through our report page, with no account, and we remove it promptly.
Your choices
- A creator can change their details, and delete an invitation or the whole account, in the app.
- A guest can remove their own posts from the same device, or ask the host to remove them.
- Anyone pictured on an invitation can ask for removal on our report page, with no account.
- For anything else, write to [Email for privacy requests].
We answer every request within 30 days.
How we protect it
- Access rules in the database, so each person reaches only what is theirs or what they were shown.
- Private storage for what only the host may see, such as pitch-in screenshots, opened only through short-lived links.
- Checks on every upload: its real type, its size and its length.
- No card data on Invitly's servers: our payment provider handles it.
Where data is processed
Your information is stored and processed in the United States.
California
Notice at collection: we collect the categories of information listed in the table above, from the sources it names, for the purposes listed under "Why we use it", and keep them for the periods listed under "How long we keep things". We do not sell personal information, and we do not share it for advertising. You can ask to know, correct or delete your information by writing to [Email for privacy requests].
Changes and contact
If we change this policy, we publish the new version on this page with its date, and we tell account holders about any important change before it takes effect.
This policy takes effect on [Effective date].
Questions and requests: [Email for privacy requests].