Legal
Privacy policy
An invitation carries names, dates and the people you love. We collect as little as possible, keep it only as long as your invitation is live, and never sell it.
- Effective
- {{EFFECTIVE_DATE}}
- Operator
- {{LEGAL_ENTITY}}
- Contact
- hello@kindlyinvite.com
01Who is responsible
{{LEGAL_ENTITY}}, {{ADDRESS}}, {{COUNTRY}} runs Kindly Invite and is the data controller for the personal data of people who visit our site and buy from us. For any privacy question write to hello@kindlyinvite.com.
Guest replies are a little different. When guests answer your RSVP, we store those answers on your behalf, to show them to you. For that data we act on your instructions, and you decide who you invite and what you ask.
02Data we collect from hosts
- Contact details: your email address, and your name if you give it at checkout.
- Invitation content: names, event date, venue, schedule, story, photos, music and any other text you add.
- Guest list: the names and party sizes you enter for personal guest links.
- Order details: what you bought, the amount, date and status. Card details go straight to Dodo Payments; we only receive confirmation that the payment succeeded.
- Messages: anything you send us by email or social media when you ask for help.
03Data we collect from guests
Guests do not create an account. When a guest replies, we store only what the host’s RSVP form asks for:
- name, and email if the guest chooses to give it;
- whether they are coming and how many people are in their party;
- meal choice, dietary notes, a song request or a message, if the host switched those questions on.
Dietary notes can reveal health or religious information. Share only what you are comfortable with. Only the host can see it, and it is deleted with the invitation.
04Technical data and cookies
Like every website, our servers briefly record IP addresses and browser details to deliver pages, stop abuse (for example, spam RSVPs) and fix errors. These logs are kept for a short time by our hosting provider and are not used to profile you. We do not use advertising cookies or cross-site trackers, on our site or inside invitations. Access to editing works through a private link rather than a login, so no tracking cookie is needed.
05Why we use it
| Purpose | Legal basis (GDPR) |
|---|---|
| Building, publishing and hosting your invitation, collecting RSVPs | Performing our contract with you, Art. 6(1)(b) |
| Sending order confirmations, dashboard links and service notices | Performing our contract, Art. 6(1)(b) |
| Answering support requests | Contract, or our legitimate interest in helping you, Art. 6(1)(f) |
| Security, abuse prevention and error logs | Legitimate interest in a safe, working service, Art. 6(1)(f) |
| Keeping order records for tax and accounting | Legal obligation, Art. 6(1)(c) |
| Occasional product news by email | Your consent only, which you can withdraw with one click |
06What we never do
- We never sell or rent personal data.
- We never email or contact your guests for marketing.
- We never show your invitation in our portfolio without your written permission.
- We never use your photos or guest data to train AI models.
07Who processes data for us
We use a small number of trusted providers, each bound by a data processing agreement or its own privacy terms:
| Provider | What for | Where |
|---|---|---|
| Vercel Inc. | Website hosting and delivery | USA and EU edge network |
| Turso (ChiselStrike Inc.) | Database for invitations, guest lists and replies | EU region |
| Dodo Payments | Merchant of record: checkout, receipts, tax, refunds | Independent controller for payment data |
| Resend Inc. | Order and account emails | USA |
| OpenRouter Inc. | Illustrated portraits, only if you order one | USA |
When data is handled outside the European Economic Area, the transfer is covered by the European Commission’s Standard Contractual Clauses or the EU-US Data Privacy Framework. Dodo Payments processes payment data as an independent controller under its own privacy policy.
08How long we keep it
- Published invitations, with their guest lists, replies and uploads: for the 12-month live period, then deleted within 30 days. You can ask us to delete everything earlier at any time.
- Unpaid drafts: deleted after 90 days without activity.
- Order records (email, items, amount, date): as long as tax and accounting law requires, then deleted.
- Support emails: up to 24 months after the conversation ends.
- Server logs: a few weeks at most.
09Your rights
Under the GDPR and similar laws, you can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything that is wrong;
- delete your data, or restrict how we use it;
- send your data to you in a portable format (RSVP lists are already downloadable as CSV);
- stop using your data where we rely on legitimate interest, or withdraw consent you gave.
Guests: the quickest way to change or remove your reply is to ask the host, who manages the guest list. You can also write to us directly and we will help.
Email hello@kindlyinvite.com and we will reply within 30 days, usually much sooner. If you are unhappy with our answer, you can complain to the data protection authority in your country.
10Children
Hosts must be adults. Invitations for a child’s party or a quinceañera are created by a parent or guardian, who decides what information about the child to include. We do not knowingly collect data directly from children.
11Changes to this policy
If we change how we handle personal data, we will update this page and the effective date above. For significant changes we will also email hosts with a live invitation.