Privacy Policy
Effective date: June 1, 2026
1. Overview
SmartInvite ("we", "us", "our") is committed to handling your data with transparency and care. This Privacy Policy explains what information we collect, how we use it, and the limited circumstances under which it may be shared. By using the Platform, you acknowledge and consent to the practices described in this Policy. We do not sell personal data. We do not run advertising. Our business model is subscriptions — your data is not the product.
2. Information We Collect
We collect the following categories of information: (a) Account Data: When you register, we collect your name, email address, and password (stored in encrypted form via Supabase Auth). This information is necessary to provide you with access to the Platform. (b) Event Data: Information you enter when creating events — event name, date, venue, description, and invitation copy. This data is stored in your account and used solely to operate your events. (c) Guest Data: Names, attendance responses, and optional contact numbers submitted by your guests when RSVPing to your events. This data belongs to you as the event host and is not used by SmartInvite for any purpose other than displaying it in your dashboard. (d) Usage Data: Automatically collected information including IP address, browser type, pages visited, and interaction timestamps. This is used solely to maintain platform security and performance. (e) Payment Data: Payment processing is handled entirely by Stripe. SmartInvite does not store your card number, CVV, or full billing details. We receive only a payment confirmation and subscription status from Stripe.
3. How We Use Your Information
We use collected information only for the following purposes: • To provide and operate the SmartInvite Platform • To authenticate your account and maintain session security • To process subscription payments via Stripe • To send transactional emails (account confirmation, RSVP notifications, broadcast messages) via Resend • To generate AI invitation copy using Groq — only the event details you provide are sent; no personal account information is transmitted • To respond to support enquiries submitted through our contact form • To detect and prevent fraud, abuse, or violations of our Terms of Service We do not use your data for marketing profiling, targeted advertising, or sale to third parties under any circumstances.
4. Guest Data and Your Responsibility
As a SmartInvite user, you are the data controller for the personal information your guests submit (names, attendance choices, contact numbers). You are responsible for ensuring you have a lawful basis to collect this information and that your guests understand how it will be used. SmartInvite acts as a data processor on your behalf. We process guest data only as necessary to display it in your dashboard, enable broadcast messages you send, and support CSV exports you request. We do not access, analyse, or retain guest data beyond what is required to operate your events.
5. Data Sharing and Third Parties
We share your data only with the following service providers, strictly as necessary to operate the Platform: • Supabase — database and authentication infrastructure (EU/US data centres) • Stripe — payment processing and subscription management • Resend — transactional email delivery • Groq — AI text generation (event copy only; no personal account data) • Vercel — hosting and edge network All third-party providers are bound by data processing agreements and are prohibited from using your data for their own commercial purposes. We do not share your data with any other third party unless required by law or valid legal process.
6. Data Retention
We retain your account and event data for as long as your account is active. If you delete your account, we will permanently delete your personal data and event records within 30 days, except where we are required to retain certain information for legal or financial compliance purposes (e.g., payment records, which may be retained for up to 7 years under applicable accounting law). Guest data submitted to your events is deleted alongside your account data upon account deletion.
7. Security
We implement industry-standard technical and organisational measures to protect your data, including: encrypted data storage via Supabase with Row Level Security (RLS) enforced at the database level; HTTPS/TLS encryption for all data in transit; hashed and salted password storage; restricted access to production systems. However, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security and accept no liability for unauthorised access resulting from circumstances beyond our reasonable control.
8. Cookies and Tracking
SmartInvite uses only essential cookies required to operate the Platform — specifically, authentication session cookies managed by Supabase Auth. We do not use advertising cookies, tracking pixels, or third-party analytics cookies. We do not fingerprint your device or track you across other websites. If you disable cookies in your browser, you will not be able to remain logged in to the Platform.
9. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data: • Access: Request a copy of the personal data we hold about you • Rectification: Request correction of inaccurate or incomplete data • Erasure: Request deletion of your personal data (subject to legal retention requirements) • Portability: Request your data in a machine-readable format • Objection: Object to specific processing activities To exercise any of these rights, contact us at privacy@smartinvite.app. We will respond within 30 days. We reserve the right to verify your identity before actioning any data request.
10. Children
SmartInvite is not directed at children under the age of 16. We do not knowingly collect personal information from anyone under 16. If we become aware that a child under 16 has provided us with personal data, we will delete that information promptly. If you believe we have inadvertently collected data from a child, please contact us immediately at privacy@smartinvite.app.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by updating the effective date at the top of this page. Your continued use of the Platform after any change constitutes your acceptance of the revised Policy. We encourage you to review this Policy periodically.
12. Contact
For privacy-related enquiries, data requests, or to report a concern, contact us at privacy@smartinvite.app or through our contact page. We take all privacy concerns seriously and will respond within 30 days.
See also: Terms of Service · Contact Us