1. Overview & Scope
This Privacy Policy applies to all services, websites, web applications, and mobile experiences operated under the InviteBox brand ("InviteBox", "we", "our", or "us"), headquartered in Vadodara, Gujarat, India.
By creating an account, creating or customizing digital invitations, submitting RSVP responses, or otherwise browsing our website, you acknowledge and agree to the practices described in this document. If you do not agree with any terms of this policy, please discontinue use of our platform immediately.
2. Information We Collect
We collect information in three distinct contexts:
A. Information Provided by Hosts
- Account Details: Full name, email address, phone number, password hash, and optional profile pictures.
- Event Details: Event titles, dates, venue locations, schedules, dress codes, registry/gift links, custom photo galleries, and audio tracks.
- Guest Lists: Guest names, email addresses, phone numbers, plus-one allocations, and dietary/event questionnaire parameters.
- Payment Information: Handled securely by our PCI-DSS certified payment processors (e.g., Razorpay, Stripe); we never store raw credit card numbers, UPI IDs, or banking credentials on our servers.
B. Information Provided by Guests & Attendees
- RSVP Responses: Attendance status (attending / declined), meal preferences, guest counts, song requests, and direct notes to the host.
- Contact Confirmations: Email addresses or mobile/WhatsApp numbers submitted for receiving event reminders, entry QR codes, and arrival notifications.
C. Automatically Collected Technical Data
- Device & Network Data: IP address, browser type, operating system, screen resolution, and preferred language.
- Usage Insights: Invitation opening events, interactive card flippings, RSVP completion timestamps, and error diagnostics.
3. How We Use Your Data
We process your data strictly to fulfill our services and honor our commitments to you:
- Event Delivery: Rendering personalized digital cards, triggering automated Email, SMS, or WhatsApp invitations, and maintaining interactive RSVP portals.
- Host Analytics & Dashboards: Providing real-time RSVP counts, dietary summaries, open rates, and guest attendance lists for event planning.
- Service Improvements: Optimizing template rendering speed, mobile responsiveness, animation smoothness, and fixing software bugs.
- Customer Support: Assisting you with custom design requests, technical inquiries, and account recovery.
- Security & Abuse Prevention: Detecting fraudulent transactions, preventing spam messaging, and enforcing our terms.
4. Our Guest Privacy Promise
Guest data uploaded by hosts is processed solely on behalf of the host. We never advertise to your guests, never sell their contact details, and never add them to general InviteBox marketing lists unless they explicitly opt in.
When a host closes or deletes an event, all associated guest RSVP responses and contact entries are marked for permanent deletion in accordance with our retention policy.
6. Data Sharing & Third Parties
We never sell personal data. We only share necessary data with vetted third-party service providers under strict confidentiality agreements:
| Category | Provider / Role | Data Shared |
|---|---|---|
| Infrastructure & Hosting | Hostinger / Cloudflare / AWS | Cloud servers, database hosting, and security backups |
| Messaging & Notifications | Twilio, MSG91, SendGrid, Resend | Email, SMS & WhatsApp delivery |
| Payment Processing | Razorpay, Stripe | Billing, payment collection, UPI, and card verification |
| Customer Support | Support Desk & Live Chat | Host support tickets and chat history |
7. Storage, Security & Encryption
We maintain comprehensive technical, administrative, and physical safeguards designed to prevent unauthorized access, loss, or alteration of data:
In-Transit Encryption
All communications between your browser and our servers are encrypted using modern Transport Layer Security (TLS 1.3 / HTTPS).
At-Rest Encryption
Host event records, attendee data, and user assets are encrypted using industry-standard 256-bit Advanced Encryption Standard (AES-256).
8. Your Legal Rights (DPDP Act India, GDPR & Global Privacy Laws)
In accordance with the Digital Personal Data Protection (DPDP) Act, 2023 (India) and applicable global laws, you possess the following rights regarding your personal data:
- Right to Access & Summary: Request a copy or summary of the personal information we hold about you.
- Right to Correction & Erasure: Correct inaccurate account details or request the permanent deletion of your account and related event assets.
- Right to Data Portability: Export your guest lists, RSVP statuses, and event configurations in standard CSV or JSON format.
- Right to Withdraw Consent: Withdraw your consent for data processing at any time (which may affect service availability for active events).
To exercise any of these rights, email our Grievance & Privacy Officer at privacy@invitebox.com. We respond to all verified requests within statutory timelines.
9. Data Retention & Deletion
We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy or comply with statutory requirements:
- Active Events: Maintained for the duration of the event lifecycle and up to 180 days post-event for photo memories and recap access, unless deleted earlier by the host.
- Host Accounts: Stored until the account is closed or flagged as inactive for 24 continuous months.
10. Children's Privacy
InviteBox is intended for general audiences aged 18 and older (or legal adults). We do not knowingly collect personal information directly from minors. If an event host creates an invitation for a child's event (e.g., birthday or naming ceremony), the host acts as the legal guardian/custodian of the guest information provided. If you believe a minor has registered an account directly without parental consent, please contact us for immediate removal.
11. Data Location & Server Security
Our primary website infrastructure and databases are hosted on secure, high-performance servers (via Hostinger) located in India. To ensure high availability, fast loading speeds, and network security (such as CDN, DDoS protection, and cloud backups), certain non-sensitive technical data may be routed or backed up through secure global cloud infrastructure compliant with international security standards.
12. Updates to This Policy
We may update this Privacy Policy periodically to reflect technological updates, legal requirements, or changes to our offerings. When significant modifications occur, we will notify registered hosts via email or a prominent notice on the dashboard before the changes take effect.
13. Contact Information & Grievance Officer
In compliance with Indian Information Technology laws and Data Protection rules, if you have any questions, concerns, or grievances regarding this Privacy Policy or data processing, please contact:
InviteBox • Vadodara, Gujarat, India
Contact Support Page