Privacy Policy

1 · Who we are, and our two roles

We handle personal data in two distinct capacities, and it matters which applies:

• Controller — for data about our own customers: your account email, authentication records, payment records, support correspondence and server logs. We decide how and why this data is used.
• Processor — for the invitation content you put into the platform and the replies your guests send through it: guest names, email addresses, attendance and messages, and photographs you upload. You are the controller of that data; we process it only on your instructions, to run the service for you.

The processing terms that govern our role as your processor are in section 13 of our Terms and Conditions.

2 · Data we collect

Envit is self-service. You build your own invitation, so most of the data we hold is data you chose to enter. We collect:

• Account data: your email address, used to sign you in with a one-time code
• Invitation content: the names of the couple, event date and time, venue and arrival details, dress code, any text you write in any language, photographs you upload, and music you upload or link to
• Gift section (optional): if you turn on the gift section, we store the title and the free text you write in it — which may include bank or payment details you choose to share. You decide this content and it is shown to guests who open your invitation. We never verify it, and no money moves through it; it is displayed as text
• Guest replies: when a guest replies through your invitation, we store their name, email address, whether they are attending, and the optional message they write — which a guest may use to mention dietary or other needs
• Shared access: the email address of any partner you add to your invitation
• Payment data: handled by our payment provider. We never receive or store your card number
• Technical data: minimal server logs, including IP address and timestamps, used for security
• Data stored in your browser: see section 6

A note on dietary requirements. We do not ask guests for dietary or health information, but a guest may choose to mention it in their message. Allergies and dietary needs can reveal information about health, which data protection law treats as a special category. We store such a message only as part of the guest's reply, we do not use it for anything else, and it is shown only to you and your partner.

3 · Why we process it

We use personal data to:

• Create, host and display your digital invitation
• Authenticate you and keep you signed in
• Give access to any partner email you specify
• Take payment through our payment provider
• Reply to you about your account, your invitation, or a complaint you raise
• Keep the platform secure and prevent fraud and abuse
• Comply with legal, accounting and tax obligations

4 · Legal basis for processing

• Performance of a contract: to provide the service you purchased
• Legal obligation: to meet tax, accounting and other legal requirements
• Legitimate interest: limited to platform security, fraud and abuse prevention, and maintaining the integrity of the service. We do not rely on legitimate interest to process invitation content or guest data for product development, analytics or marketing
• Consent: for any optional communication you opt in to, which you may withdraw at any time

Where a guest mentions dietary or health-related information in their reply, they choose to share it with you; use it only to plan your event.

5 · Guest responses

When guests reply through your invitation, they provide their name, email address, whether they are attending, and an optional message.

• You are the controller of this data and we are your processor
• You are responsible for telling your guests that their responses are stored and displayed through our platform, and for having a lawful basis to collect them

A guest who wants their data removed and cannot reach the couple may write to us at support@envit.me.

6 · Data stored in your browser

So the builder works before you create an account, some data is stored locally in your own browser rather than on our servers. This includes the invitation draft you are working on — which may contain the bank details you entered in the gift section — the photos and music you add before publishing, your sign-in token, your chosen language, and a short record of your payment while your invitation is being published.

This data stays on your device and is not stored on our servers until you publish. When you review your invitation before paying, we send it to our server once to check it is complete — it is checked, not saved. It can be cleared at any time. Our Cookie and Local Storage Policy lists exactly what is stored and how to remove it. If you are working on a shared or public computer, clear it when you finish.

7 · How long we keep it

• Your published invitation: live at its link until 90 days after the event date stated in the invitation. It is then taken offline automatically — guests can no longer open it
• Invitation content and guest replies: kept in your account after the invitation is taken offline, until you ask us to delete them
• Account data: kept while you have an account, until you ask us to delete it
• Payment and transaction records: 7 years, to meet tax and accounting obligations
• Server logs: no more than 90 days

You can ask us at any time to delete your account and invitation by emailing support@envit.me. We will do so within 30 days, except for records we are legally required to keep.

8 · Who else sees your data

We share personal data with the following providers:

• Amazon Web Services — hosting, storage and database
• Resend — sending sign-in code emails
• Stripe, Inc. — payment processing; as merchant of record (Stripe Managed Payments), Stripe sells the purchase to you and handles sales tax and VAT

Services an invitation can load. When a guest opens an invitation, it may load content from other companies, which then see that guest's IP address and browser details under their own privacy policies: Google Maps (the venue map), SoundCloud (when the couple chooses a SoundCloud song) and Google Fonts (some themes' typefaces). If you contact us on WhatsApp, that conversation is handled under WhatsApp's own privacy policy. None of these companies process data on our behalf, and we send them nothing beyond what the visit itself reveals.

We also disclose data to public authorities where we are legally required to. We do not sell, rent or share your data with third parties for commercial or advertising purposes.

We will give at least 30 days' notice before adding or replacing a provider that processes your invitation or guest data. You may object, and if we cannot resolve your objection you may stop using the service and ask us to delete your data.

9 · International transfers

Saasmithlab LLC is established in the United States, and personal data is hosted on Amazon Web Services infrastructure.

Where personal data is transferred out of the European Economic Area or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses and, for the UK, the International Data Transfer Addendum, as incorporated into our provider's data processing terms — together with encryption in transit and at rest.

10 · Your rights

Depending on where you live, you have the right to:

• Access the personal data we hold about you
• Correct data that is inaccurate or incomplete
• Request deletion of your data
• Restrict how we process it in certain circumstances
• Object to processing based on our legitimate interests
• Receive your data in a portable format
• Withdraw consent at any time, where processing is based on consent

We make no decisions about you by automated means that produce legal or similarly significant effects.

To exercise any of these, write to support@envit.me. We respond within one month. If a request is complex we may extend that by up to two further months, and we will tell you if we need to.

If you are unhappy with our response, you may complain to your national data protection authority — in the EU, the authority for your country of residence; in the UK, the Information Commissioner's Office.

11 · Security and data breaches

We apply reasonable technical and organisational measures:

• TLS encryption for data in transit and encryption at rest
• Application-level access controls, so an account can only reach its own invitations and guests
• Restricted administrative access
• Card data handled entirely by our PCI-DSS certified payment provider and never stored on our servers

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. Where the risk is high we will inform affected users without undue delay. Where we act as your processor, we will notify you without undue delay so you can meet your own obligations.

12 · Children

Our service is not directed to children, and you must be 18 or over to purchase or publish an invitation. We do not knowingly collect personal data from children as our own customers, and will delete it if we learn we have.

13 · California privacy rights

If you are a California resident, you may request access to the categories and specific pieces of personal information we have collected about you, request deletion, request correction, and not be discriminated against for exercising those rights.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months.

14 · Changes and contact

Where a change to this policy materially affects your rights, we will notify you by email at least 30 days before it takes effect. Where a change requires your consent, we will ask for it separately. Other changes are published here with a revised “Last updated” date.

For any question about this policy, or to exercise your rights, contact Saasmithlab LLC at support@envit.me or by post at 30 N Gould St, Ste R, Sheridan, WY 82801, United States.