How InviApp® handles personal data

1. Scope, trademark and roles

InviApp® is a registered European Union trade mark (EUTM No. 019363690).

This policy applies to InviApp® websites, applications, event pages and related services. InviApp is normally the controller for account, billing, support and product-usage data.

For guest lists, RSVP answers, registration questions and event content, the event host decides why the data is collected. The host is normally the controller and InviApp processes that data on the host’s instructions.

2. Information we process

We process information supplied by hosts and guests, information generated while the service is used, and limited technical information needed to operate and secure the service.

• Account details such as name, email address, language and account type.
• Event details, guest names, contact details, RSVP status, companions, answers and host-only notes.
• Uploaded covers, photos, videos, guestbook messages, wishlist items and business-event content.
• Billing records, plan status and invoice details. Payment-card details are handled by the payment provider.
• Device, browser, security, diagnostic and event-page analytics data.

3. Why we use data

We use personal data to provide and secure the service, deliver invitations and reminders, process RSVP activity, support users, administer subscriptions, prevent abuse and improve reliability.

• Contract: operating accounts, event pages, invitations, exports and paid subscriptions.
• Legitimate interests: security, fraud prevention, service analytics and product improvement.
• Consent: optional communications or device permissions where consent is required.
• Legal obligation: tax, accounting, sanctions and lawful authority requests.

4. Service providers and transfers

We share data only with providers needed to run InviApp, such as hosting, database, media storage, email, SMS, payments, monitoring and customer-support services. Providers must process data under appropriate contracts and instructions.

Where data leaves the European Economic Area, we use an approved transfer mechanism such as an adequacy decision or Standard Contractual Clauses, together with supplementary safeguards where appropriate.

5. Retention

We keep data only as long as needed for the purpose collected, the host’s instructions, security, dispute resolution and legal obligations. Hosts can delete events and accounts. Backups and security logs may remain for a limited period before automatic deletion.

Billing and accounting records may be retained for the period required by applicable law.

6. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent. Guests should normally contact the event host first for event-specific data. You may also complain to your local data-protection authority.

7. Contact

For privacy requests or a data-processing agreement, contact alex@inviapp.com. We may need to verify your identity before completing a request.