Privacy Policy

1. Overview and Who We Are

Inviterio is a service provided by Strivewin LLC, a limited liability company registered in Indiana, United States, and the company you contract with and pay when you purchase a plan. In this Policy, "Inviterio," "we," "us," and "our" mean Strivewin LLC. Strivewin LLC acts as the data controller for account, billing, support, security, and other information processed for our own business purposes. When an event host uses Inviterio to manage guest personal data, the host generally acts as the data controller and Strivewin LLC acts as a data processor on the host's behalf.

This Privacy Policy explains how we collect, use, share, and protect personal information when you use our RSVP and guest management platform (the "Service"), whether as an event host (registered user) or as a guest responding to an invitation.

We are committed to protecting your privacy and handling personal data responsibly. This Policy reflects our obligations under applicable data protection laws, including the General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), Canada's PIPEDA, and equivalent legislation.

For questions about this Policy or your personal data, contact us at support@inviterio.com.

2. Information We Collect

2.1 Information you provide as an event host (account holder)

• Name, email address, and password (stored as a hashed credential — never in plaintext)
• Billing name, billing address, and payment method details (transmitted directly to Stripe — we do not store full card numbers)
• A record of what you agreed to at checkout (automatic-renewal terms, and your request for immediate delivery), with the date and time, your IP address and browser. We keep it as proof of the agreement.
• Event details: event type, title, date, venue address, event description, photos, theme settings, schedule, registry links, and travel information
• Sub-event configuration, RSVP form questions, and custom field definitions
• Communications you send to us (e.g., support emails)

2.2 Information about your guests

As the event host, you provide or collect on behalf of your guests:

• Full name, email address, and/or mobile phone number
• Household grouping and relationship metadata
• RSVP responses, attendance status, dietary preferences, meal choices, plus-one details, and answers to custom RSVP form questions
• Seating assignment (if the seating chart feature is used)
• Private notes you add to a guest record (not visible to the guest)

A note on dietary and accessibility information. Dietary or accessibility information may reveal health information, religious belief, or other information that can receive additional protection under applicable data protection law. The RSVP form makes these fields optional and explains that the information is shared with the event host for event-planning purposes. Where this information is treated as special-category data under the GDPR or UK GDPR, the event host, as controller, is responsible for ensuring that an appropriate legal basis and Article 9 condition apply. If a host enters this information on a guest's behalf, the host is likewise responsible for having the right to do so. This information is cleared when a guest exercises an applicable right to erasure and is anonymized with the rest of the guest record 365 days after the event.

Guests may also provide information directly when they use their magic-link to access the RSVP page:

• RSVP responses and any custom form answers they submit
• Plus-one name if they add one during RSVP

Magic-link tokens are cryptographically unique per guest and serve as the authentication mechanism for guest access. They do not expire on their own and can be reused by the same guest to view their invitation or update their response (subject to the event's RSVP deadline for changing an answer).

If you RSVP through an event's open public page (rather than a personal invite link) and enter a phone number, you'll see a checkbox to opt in to text messages. Leave it unchecked and we won't text you or record any SMS consent. Check it, and we save that you agreed, along with the date, time, and your IP address, as proof. You can opt out any time by replying STOP to any message.

2.3 Technical and usage information

• IP address and related connection information used for security, fraud prevention, and limited analytics
• User agent string, browser type, and device type
• Timestamps for login, event creation, invitation sends, and RSVP submissions
• Email delivery and engagement data, including sent, delivered, bounced, and recorded open or click activity when detected and reported by our email service provider
• SMS delivery status reported by our SMS provider Twilio
• Feature usage analytics (aggregated and anonymized where possible)

3. Legal Basis for Processing (GDPR / UK GDPR)

Where GDPR or UK GDPR applies, we rely on the following lawful bases:

• Contract performance — processing necessary to provide the Service you have subscribed to (account management, event creation, invitation delivery, billing).
• Legitimate interests — security and fraud prevention, abuse detection, product improvement, and communication about material changes to the Service. We have conducted legitimate interests assessments where required.
• Compliance with legal obligation — retaining billing and transaction records as required by tax and accounting law.
• Consent — for optional marketing communications (where applicable). You may withdraw consent at any time.

As a host, you act as a data controller in respect of your guests' personal data collected through the Service. We act as a data processor on your behalf. We process guest data only according to your instructions and these Terms. You are responsible for ensuring you have a lawful basis to collect and process your guests' personal data and to contact them using Inviterio.

4. How We Use Your Information

• To create and maintain your account and Workspace
• To provide event management, guest list, RSVP tracking, budget, seating, and related features
• To send invitations, reminders, and event updates on behalf of event hosts via Brevo (email) and Twilio (SMS)
• To process payments and manage subscriptions via Stripe
• To provide delivery and engagement statistics to hosts (we report real data only — we do not fabricate open rates or click counts)
• To authenticate users (session management via Laravel Sanctum) and guests (magic-link token authentication)
• To detect and prevent fraud, abuse, and security incidents
• To maintain audit logs for security, dispute resolution, and compliance purposes
• To communicate with you about your account, changes to the Service, or policy updates
• To comply with applicable legal obligations

5. Our Data Sale Policy

Inviterio does not sell or rent personal information about hosts or guests to third parties for their own advertising or marketing purposes. This applies to account data, guest list data, RSVP responses, and usage information collected through the Service.

This commitment extends to:

• Guest email addresses, phone numbers, and RSVP responses
• Event details and guest list composition
• Usage data, behavioral analytics, and event engagement data
• Payment information (which is processed by Stripe and never stored by us)

6. How We Share Your Information

We share data only in the limited circumstances described below, and only with parties bound by data processing agreements:

6.1 Service providers (processors)

• DigitalOcean — hosts our application server and database. This is the largest processor by data volume: the full database, including every guest's personal data, resides on DigitalOcean infrastructure.
• Brevo — transactional email delivery; receives guest email addresses and invitation content
• Twilio — SMS delivery; receives guest phone numbers and invitation content
• Stripe — payment processing and subscription billing; receives billing information
• Cloudflare — content delivery, DNS, and security filtering for our website and API, plus storage (R2) of uploaded images, exports, and generated files. Because traffic to the Service passes through Cloudflare, it processes requests — and any personal data they contain — in transit. See our Sub-processors page.
• Sentry — error monitoring; may receive sanitized error context (no passwords or payment data)
• Google (Places API) — venue address autocomplete. Receives only the venue text a host types while creating an event; never receives guest data, and the call is made from our server, not a guest's browser.

All service providers are bound by data processing agreements (DPAs) that restrict their use of your data to providing services to us.

6.2 Legal and safety disclosures

We may disclose personal information where required by law, court order, or government authority; to protect the rights, property, or safety of Inviterio, its users, or the public; or to enforce our Terms of Service.

6.3 Business transfers

If Inviterio is acquired, merged, reorganized, or substantially all of its assets are transferred, personal data may be transferred to the successor entity. Where required by applicable law, we will provide notice of material changes in ownership or control that affect how personal data is handled.

7. Data Retention

• Account, Workspace, event, and invitation data is retained for as long as your account is active.
• Guest personal data is anonymized 365 days after the event has finished, whether or not the host archives or deletes the event. Names, email addresses, phone numbers, dietary information and RSVP free-text answers are cleared; anonymous counts (headcount, seating) remain so the host's records stay intact. This applies regardless of the host's plan.
• When data is deleted (by you or by us following a deletion request), records are soft-deleted and become inaccessible immediately, then permanently purged from production databases within 30 days. We are implementing automated backup retention with a 90-day destruction cycle for any backup copies; until that is fully deployed, contact us for the current status of backup data tied to your account. A small number of records cannot be deleted outright because other records depend on them or because we are required to keep them — your account row and any Workspace with a payment history. Those are anonymized instead: every identifying field is cleared. See our Data Deletion Policy.
• Billing and transaction records may be retained for up to 7 years as required by tax and accounting regulations.
• Security and audit logs are retained for 12 months.
• Support communications are retained for 3 years.
• Website analytics (page views and RSVP funnel events, which record a keyed hash rather than your IP address) are retained for 13 months.

8. Your Rights

Depending on your location, you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure ("right to be forgotten") — request deletion of your personal data. See our Data Deletion page.
• Restriction — request that we restrict processing of your data in certain circumstances.
• Portability — request an export of your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests or for direct marketing.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Non-discrimination — California residents have the right not to receive discriminatory treatment for exercising CCPA rights.
• Opt out of sale — we do not sell personal data. No opt-out is therefore required, but you may contact us to confirm this at any time.

To exercise these rights, contact us at support@inviterio.com or submit a data deletion request. We will respond within 30 days (or 45 days where permitted by law). We may need to verify your identity before acting on your request.

If you are in the EU or UK and believe we have processed your data unlawfully, you have the right to lodge a complaint with your local supervisory authority.

9. Cookies and Tracking

We use cookies and similar technologies for authentication, session management, and preference storage. We do not use advertising-based tracking or sell data to ad networks. See our Cookie Policy for full details.

10. International Data Transfers

Inviterio operates globally and some of our service providers process data outside your country of residence, including in the United States. Where such transfers involve data from the EU, EEA, or UK, we rely on:

• The EU-US Data Privacy Framework (DPF), where the receiving provider self-certifies under it, as our primary basis for US transfers; and
• Standard Contractual Clauses (SCCs) as approved by the European Commission, as a backstop where a provider is not DPF-certified or is located outside the Framework's scope.

For more information about the safeguards applied to international transfers, contact support@inviterio.com.

11. Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or destruction. These include:

• Encryption in transit (TLS 1.2+). Application-level AES-256 encryption is applied to secrets — API keys, integration credentials, and two-factor authentication secrets. Other data, including guest contact details, is protected by full-disk encryption on our hosting provider's infrastructure rather than encrypted field by field.
• IP addresses stored in binary form, never as readable strings in the database
• Hashed passwords (bcrypt) — we never store plaintext passwords
• Access to personal data is logged: opening an individual's record or exporting a guest list is recorded with the staff member or account responsible
• Role-based access controls and mandatory 2FA for platform administrators
• Security event logging and monitoring via Sentry

While we take security seriously, no system is impenetrable. If you discover a security vulnerability, please report it responsibly to support@inviterio.com.

12. Children's Privacy

The Service is not directed at children under the age of 16, and we do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided personal information to us without your consent, please contact us at support@inviterio.com so we can delete that information.

Event hosts are responsible for ensuring that guest lists including minors are handled in compliance with applicable laws, including obtaining appropriate parental consent where required.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or prominent in-app notice at least 14 days before the change takes effect. The updated Policy will be identified by a new "Last Updated" date. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.

14. Contact and Data Protection Officer

For all privacy-related inquiries, requests to exercise your rights, or complaints, contact us at:

Email: support@inviterio.com
Subject line: "Privacy Request — [Your Name]"

We aim to respond to all inquiries within 5 business days and to resolve requests within 30 days.