Skip to content

Privacy policy

Our platform “invi2” (hereinafter “the Platform,” “We,” or “Us”) is committed to protecting your privacy and the privacy of your Guests, and regards this as a foundational principle in the design of its services. You may try the design without creating an account; a Host needs only a single free account in order to publish; Guests never sign in under any circumstance; and invitation links are generated in a random, non-guessable format. This Policy sets out the categories of data We collect, the purposes for which they are collected, the lawful basis for processing them, the measures We take to protect them, and the rights afforded to you and your Guests.

The party responsible for processing this data is Nada Tech for Technical Solutions and Artificial Intelligence. For any question regarding this Policy or your rights, please contact Us via the Contact us page.

1. Lawful Basis for Processing

We process personal data on one or more of the following lawful grounds, according to the nature of each processing activity:

  • Performance of a contract: to provide the service to the Host and enable them to create, publish and manage invitations.
  • Your explicit consent: for optional processing, such as a Guest enabling event reminders, uploading photos, or submitting an RSVP.
  • Legitimate interest: for platform security, prevention of misuse and the stability of the service, in a manner that does not override the rights of data subjects.
  • Legal obligation: where a statutory or judicial duty requires Us to disclose or retain certain data.

2. Host Data (the invitation owner)

  • Account data: email address and password. The password is stored in encrypted form with Our authentication provider and is never accessible to Us at any time.
  • Invitation content: names, text, dates and venues, along with any logo or audio the Host uploads.
  • Payment data: at checkout We ask for your name, email address and mobile number, which are passed to Our payment partner, Paddle, to process the transaction as the Merchant of Record. Your card details are entered directly with the payment gateway; they never pass through Our servers and are never stored by Us. We retain a record of the transaction (amount, package and reference number) for accounting and statutory purposes.

3. Guest Data (no account required)

  • RSVP: name, headcount and an optional hand-drawn signature, stored as secure numeric coordinates. This data is visible to the Host alone.
  • Guest photos: uploaded to a private album that only the Host can see; this album is never public under any circumstance.
  • A random device identifier: stored in the Guest’s browser (localStorage) to prevent a repeated RSVP from the same device and to count unique visits. It is not linked to the Guest’s identity and is not used to track them beyond the Platform.
  • A hashed fingerprint of the Internet Protocol (IP) address: processed with a secret salt in a way that makes the original address irretrievable, used solely to prevent misuse of the photo-upload feature.
  • Event reminders (optional): when a Guest enables “Remind me before the event,” We store their browser’s push-notification subscription (a technical endpoint and delivery keys generated by the browser) together with the relevant invitation’s language, without any name, email or mobile number. This is used solely to send a reminder ahead of the event, is never used for any marketing purpose, is deleted automatically when the Guest cancels notifications in their browser or when the invitation is deleted, and can be turned off at any time from the browser’s notification settings.
  • Sending invitations via WhatsApp (optional): when a Host uses the Excel-upload feature to send invitations over WhatsApp, Guest names and numbers are processed inside the Host’s browser only, in order to prepare the messages. This list is never uploaded to or stored on Our servers, and sending takes place from the Host’s own WhatsApp account.

4. Statistics

We show the Host aggregated figures for their invitation (opens, unique visitors and RSVPs). We do not use advertising trackers, and We do not sell any data to any party.

5. Where Data Is Stored and Transferred

  • Data is stored on servers within the European Union (Frankfurt, Germany) with an approved infrastructure provider. Error monitoring is handled through a European system, with personal data automatically scrubbed from the reports.
  • As this storage takes place outside Our jurisdiction, the transfer and processing of your data are subject to appropriate controls and safeguards that ensure an adequate level of protection under the applicable regulations, including contracting with providers committed to recognised data-protection standards.

6. Data Sharing and Service Providers

We do not sell your data or your Guests’ data, and We do not share it for marketing purposes. We may share the minimum necessary data with trusted service providers who act on Our behalf under contractual obligations of confidentiality and data protection, as follows:

  • Authentication provider: to manage Host accounts and keep passwords encrypted.
  • Payment gateway (Paddle): to process payments and refund requests.
  • Infrastructure provider (hosting within the European Union): to store data and run the service.
  • Error-monitoring system: to detect technical faults after personal data has been scrubbed automatically.
  • Browser notification service: to deliver event reminders to Guests who have enabled them.
  • We may also disclose data where the law requires it, or in response to a legitimate statutory or judicial request.

7. Retention, Locking and Deletion

An invitation locks automatically once the event has ended, and its content remains available to the Host through the management link. You may, at any time, request deletion of your account or of a specific invitation and all its content (including Guest photos and RSVPs) via the Contact us page. We carry out such requests within a maximum of thirty (30) days, unless a statutory obligation requires certain data to be retained for longer (such as accounting records).

8. Data Subject Rights

You (and your Guests, as far as their own data is concerned) are entitled to exercise the following rights in accordance with the applicable regulations:

  • To be informed of, and to access, the processing of your data.
  • To request the correction or completion of inaccurate data.
  • To request deletion of data once the purpose of processing has ended.
  • To object to, or restrict, a particular processing activity.
  • To withdraw consent at any time for processing that relies on it, without affecting the lawfulness of processing carried out before withdrawal.
  • To lodge a complaint with the competent supervisory authority if you believe your data is being processed unlawfully.
  • Any Guest may request deletion of their RSVP or photos by contacting the Host, or Us directly via the Contact us page, attaching the link to the relevant invitation.

9. Information Security

We apply appropriate technical and organisational measures to protect data, including: privilege isolation at the database level; random, non-guessable access links; dedicated, isolated storage for Guest photos; rate limits to guard against misuse; and encrypted connections (HTTPS) across all Platform pages. While We are diligent in applying best practice, absolute security cannot be guaranteed for any means of electronic transmission or storage; even so, We are committed to taking the necessary steps in the event of any incident affecting data.

10. Protecting Children’s Rights and Privacy

The service is intended for adults organising their own occasions, and We do not knowingly collect data relating to children. Should it come to Our attention that such data has been collected without a lawful basis, We will move to delete it.

11. Updates to This Policy

We may update this Policy from time to time, and We will flag any material changes on the website. An update takes effect from its date of publication, and your continued use of the service thereafter constitutes acceptance of the updated version.

12. Contact Us

For any question about your privacy, or to exercise your data rights, please contact Us via the Contact us page.