سياسة الخصوصية

einvitation is operated by Noor Inc, 95-390 Kuahelani Ave, Mililani, Hawaii, United States. We are the controller for the data of account holders and website visitors. For the guest data that hosts add to their events, the host is the controller and we act as their processor (see our Data Processing Agreement).

Questions about privacy or your data: support@einvitation.app.

We don't ask for special category data (such as health or religion). If you add it to an event, for example dietary needs, please keep it to what the event needs.

We never sell personal data, and we never use guest data for our own marketing.

When you use the AI design assistant, the prompt you type and relevant parts of your design are sent to our AI provider to produce a suggestion. We use providers that don't train their models on data sent through their business APIs. Please don't put guest personal data in prompts.

We share personal data only with providers that help us run einvitation, under contracts that require them to protect it and use it only on our instructions:

• Hosting and databases: our cloud hosting provider.
• File storage: an S3 compatible storage provider for photos and uploads.
• Email delivery: our SMTP email provider, for invitations, codes and notifications.
• Payments: Stripe, which processes card payments, subscriptions and invoices for Noor Inc. You enter card details on Stripe's checkout; we only receive the last four digits and expiry.
• AI: the AI model provider behind the design assistant, only when you use it.
• Maps: when you add a location, the map is loaded from a map provider in your guests' browsers.

We may also share data if the law requires it, to protect people's safety, or as part of a sale or reorganisation of our business, in which case this policy continues to apply.

einvitation serves customers in several countries, and some of our providers process data outside your country. Where data leaves the UK or the European Economic Area, we use recognised safeguards such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.

• Account data: while your account is open. When you delete an event or your account, the data is removed from our systems within 30 days.
• Deactivated accounts: deactivating (Settings > Account) switches the account off but does not delete it. We keep its data so you can reactivate, and while it is off we only email you sign-in codes, payment receipts and answers to your support requests. To have the data removed, ask us to delete the account.
• Archived events: kept until you delete them.
• Invoices and payment records: as long as tax law requires, usually 6 to 10 years.
• Security logs and rate limit records: short periods, typically days to a few months.
• Backups: overwritten on a rolling schedule; deleted data leaves them as backups rotate.

Guest emails and phone numbers and other personal fields are encrypted at rest with AES-256-GCM, and searched through keyed hashes rather than in plain text. Connections use TLS. Passwords are hashed. Two-factor authentication, session management and sign-in rate limits protect accounts. See our Security page for more.

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to its use, receive it in a portable format, and withdraw consent. You can do much of this yourself: edit your profile in Settings, export guests and reports as CSV, and delete events. For anything else, write to support@einvitation.app. We reply within one month.

Guests should contact the host of the event first, as the host controls their data. If you can't reach the host, write to us and we'll pass your request on.

You can also complain to your data protection authority, for example the UK Information Commissioner's Office or your local EU supervisory authority.

einvitation is not for children under 18 to hold an account. Hosts may add children as guests (for example on a birthday invitation) but should share only what the event needs and have a parent's permission.

We use a small number of cookies and similar technologies. Our Cookie Policy lists them.

We will post changes here and update the date above. If a change matters, we will also tell account holders by email or in the dashboard.