How Noor Inc collects, uses, shares and protects personal data when you use einvitation, and the choices and rights you have. It covers account holders, their team members and clients, and the guests who receive invitations.
1.Who we are
einvitation is operated by Noor Inc, 95-390 Kuahelani Ave, Mililani, Hawaii, United States. We are the controller for the data of account holders and website visitors. For the guest data that hosts add to their events, the host is the controller and we act as their processor (see our Data Processing Agreement).
Questions about privacy or your data: support@einvitation.app.
2.What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email, phone number (optional), password hash, account type, company name and role, country, language, time zone | You, at signup and in Settings |
| Sign-in and security | Two-factor settings, backup codes (hashed), active sessions, device and browser, IP address, sign-in attempts | Your devices |
| Event content | Event details, designs, schedules, locations, photos, messages, templates you save | You and your team |
| Guest and attendee data | Names, emails, phone numbers, groups and tags, party size, replies, answers to your questions, check-in times, messages and photos guests post | Hosts, and guests themselves |
| Planner and company data | Clients, vendors, tasks, budgets, team members and their roles, Brand Kit files | You and your team |
| Billing | Plan, invoices, the last four digits and expiry of your card, billing country | You and Stripe |
| Usage | Invitation views and where they came from (WhatsApp, email, QR and so on), feature use, error logs | Our servers |
| Support | What you write to us and our replies | You |
We don't ask for special category data (such as health or religion). If you add it to an event, for example dietary needs, please keep it to what the event needs.
3.How we use it and why
| Purpose | Legal basis |
|---|---|
| Create and run your account, publish invitations, deliver emails, collect replies, run check-in | Contract with you |
| Take payments, prevent fraud, keep invoices | Contract and legal obligation |
| Keep the service secure: captchas, rate limits, two-factor authentication, logs | Legitimate interests |
| Analytics for your events (views, replies, sources) | Contract with you |
| Improve the product using aggregated usage | Legitimate interests |
| Service emails: sign-in codes, receipts, replies to your events, trial and plan notices | Contract with you |
| Product news and tips | Consent, or legitimate interests where the law allows; you can opt out any time |
We never sell personal data, and we never use guest data for our own marketing.
4.AI features
When you use the AI design assistant, the prompt you type and relevant parts of your design are sent to our AI provider to produce a suggestion. We use providers that don't train their models on data sent through their business APIs. Please don't put guest personal data in prompts.
6.International transfers
einvitation serves customers in several countries, and some of our providers process data outside your country. Where data leaves the UK or the European Economic Area, we use recognised safeguards such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.
7.How long we keep it
- Account data: while your account is open. When you delete an event or your account, the data is removed from our systems within 30 days.
- Deactivated accounts: deactivating (Settings > Account) switches the account off but does not delete it. We keep its data so you can reactivate, and while it is off we only email you sign-in codes, payment receipts and answers to your support requests. To have the data removed, ask us to delete the account.
- Archived events: kept until you delete them.
- Invoices and payment records: as long as tax law requires, usually 6 to 10 years.
- Security logs and rate limit records: short periods, typically days to a few months.
- Backups: overwritten on a rolling schedule; deleted data leaves them as backups rotate.
8.How we protect it
Guest emails and phone numbers and other personal fields are encrypted at rest with AES-256-GCM, and searched through keyed hashes rather than in plain text. Connections use TLS. Passwords are hashed. Two-factor authentication, session management and sign-in rate limits protect accounts. See our Security page for more.
9.Your rights
Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to its use, receive it in a portable format, and withdraw consent. You can do much of this yourself: edit your profile in Settings, export guests and reports as CSV, and delete events. For anything else, write to support@einvitation.app. We reply within one month.
Guests should contact the host of the event first, as the host controls their data. If you can't reach the host, write to us and we'll pass your request on.
You can also complain to your data protection authority, for example the UK Information Commissioner's Office or your local EU supervisory authority.
10.Children
einvitation is not for children under 18 to hold an account. Hosts may add children as guests (for example on a birthday invitation) but should share only what the event needs and have a parent's permission.
12.Changes to this policy
We will post changes here and update the date above. If a change matters, we will also tell account holders by email or in the dashboard.