Privacy policy

Who we are

invi8 (“invi8”, “we”, “us”) is an India-based service that lets a parent create a birthday invitation, share it on WhatsApp, collect RSVPs and run an optional gift wishlist. We are the data controller for the information described below. You can reach us at privacy@invi8.in.

What we collect

If you create an account (the host)

• Your name, email address and/or mobile number — we need one of these to sign you in and to let you back into your own dashboard.
• Basic technical data — the usual server logs (IP address, browser, time of request) that any website receives, used for security and rate limiting.

About your child

• First name only. We never ask for a surname, a school, or an address for your child.
• An optional photo that you choose to upload for the invitation. You can remove it at any time, and the invitation looks good without one.
• A birthday or an age. If you give the date of birth we use it for one thing only: working out the age to print on the invitation (“Aryan is turning 8!”). The date itself is never shown on the public invitation page and is never included in the data our public invitation queries return.

About your event

The party date and time, venue name and address, an optional Google Maps link, your invitation theme and any wishlist items you add (title, an optional link, an optional image and an approximate price in ₹).

If you RSVP as a guest

Guests never create an account and never set a password. When you RSVP we store the parent name you type, an optional child name, how many adults and children are coming, any dietary note or message, and — only if you choose to give it — a phone number so the host can reach you.

What is visible on an invitation link

Every invitation lives at an unlisted, unguessable link such as /e/aryan-8-k7x2m9. The random suffix means the address cannot reasonably be guessed, and we ask search engines not to index invitation pages (they are served with a noindex instruction and excluded in our robots file).

Even so, please treat the link the way you would treat a paper invitation card: anyone who has the link can open the page. Share it in the WhatsApp groups you would have invited anyway, and not in public posts.

A visitor to an invitation page can see the child’s first name and age, the party date, time and venue, your invitation design, and the wishlist if you chose to publish one.

What a visitor can never see: another guest’s phone number, the name of the person who reserved a gift (everyone else simply sees “Someone has picked this gift ❤️”), your child’s date of birth, or your account details. Guest phone numbers and reserver names are visible only to the host of that event.

Cookies and similar storage

• Session cookie (hosts only). Set when you log in so we know it is still you. Essential — without it you would be signed out on every page.
• Guest RSVP token. A random value stored in your browser after you RSVP so you can come back and change your answer without an account. It identifies an RSVP, not a person.
• Anonymous analytics id. A random identifier used to count things like “how many people opened an invitation” and “did the RSVP form work”. It is not linked to your name and we do not use it for advertising.

We do not run advertising trackers, we do not sell data, and we do not share anything with data brokers.

Who else touches your data

• Supabase — our database, authentication and file storage provider.
• Vercel — hosts and serves the website.
• WhatsApp. We do not connect to WhatsApp’s systems. When you tap “Share on WhatsApp” we simply hand your phone a pre-written message; sending it is entirely your action, and from that point WhatsApp’s own privacy policy applies.

These providers process data on our instructions to run the service. If a provider stores data outside India, it is still held under contract for this purpose alone.

How long we keep it

Your event stays available for as long as you keep it. Deleting an event deletes everything attached to it — the invitation, the wishlist, every RSVP and every gift reservation — and that removal cascades in our database rather than merely hiding the page. Deleting your account removes your profile and your events the same way. Write to privacy@invi8.in if you would like us to do it for you, or if you want a copy of what we hold about you.

Children’s information

invi8 is for parents and guardians, not for children. Accounts are created by adults, and we do not knowingly collect information directly from a child. The only child-related details we hold are the ones a parent chooses to put on their own child’s invitation, and a guest’s optional note of how many children are coming. If you believe a child has given us information directly, email privacy@invi8.in and we will delete it.

Security

Data is transmitted over HTTPS and stored in a managed Postgres database with row-level security so that a host can only read their own events. Public invitation pages are served by a query that selects only the fields meant to be public. No system is perfect, but we keep the amount of information we hold deliberately small.

Your choices

• Edit or delete any event, wishlist item or photo from your dashboard at any time.
• Change or withdraw an RSVP as a guest using the link in your browser.
• Ask us for a copy of your data, or for it to be corrected or erased.

Grievance officer and data protection contact

Under India’s Digital Personal Data Protection Act, 2023 you can raise a concern about how your or your child’s information is handled. Our grievance officer can be reached at privacy@invi8.in (invi8 Grievance Officer). We aim to acknowledge within 48 hours and resolve within 30 days. Parents and guardians confirm their consent when they add a child, and can withdraw it at any time by deleting the child or the event, which removes the data.

Changes and contact

If this policy changes in a way that matters, we will update the date at the top of this page and, where it affects hosts, tell you in the product. This policy is governed by the laws of India, and any dispute will be subject to the courts of India.

Questions: privacy@invi8.in. See also our terms of use.