Privacy Policy

Who this is from

invitedFor is operated by [registered legal name], at [registered address].

Under the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data of the hosts who hold invitedFor accounts. For the guest lists hosts bring with them, the position is different, and it is set out in “Guests” below.

Hosts: what we collect, and why

When you create an account and use it to run an event, we hold:

• Your name, email address and — if you give it — your phone number. The email address is your sign-in identity and the address we send confirmation and password-reset codes to. The phone number is optional, is never used to sign you in, and is not verified.
• How you told us you would use invitedFor — personal, organisation or agency. It decides which features your account is offered.
• A password, stored only as a scrypt hash. We cannot read it, and we cannot tell you what it is. If you sign in with Google instead, we hold no password at all — only the account identifier Google gives us and the email address on it.
• The events you create and everything you put in them: names, dates, venues, your story text, photographs, questions, and the schedule.
• Sessions. A sign-in lasts eight hours. We store a digest of the session credential, never the credential itself.

We use this to provide the product and nothing else. We do not sell personal data, we do not share it for anyone else’s advertising, and we do not profile you.

Guests

A guest never needs an invitedFor account and we never ask one for a password. What we hold about a guest is what the host put in, plus what the guest chose to reply:

• the name the host entered, and optionally an email address or phone number;
• whether they are coming to each function they were invited to;
• a dietary preference, where the host asked for one — vegetarian, Jain or non-vegetarian. A dietary preference can imply something about a person’s religion or beliefs, so it is only ever collected when a host turns that question on, and it is visible only to that host;
• answers to any additional questions the host chose to ask.

For guest data, the host is the Data Fiduciary and we act on their instructions. They decide who goes on the list and what is asked; we hold it for them, scoped to their event, and delete it when they or their event go. If you are a guest and want to know why you are on a list or want to come off it, the host is the person who can answer — their name is on the invitation. You can also write to us and we will pass it on.

An invitation link is a key. Anyone holding the link can open that invitation and reply on it — that is how a link forwarded in a family group chat is expected to work. It is not a password and it does not identify who is holding it. A host can issue a fresh link at any time, which stops the old one working.

What we deliberately do not record about guests. We count whether an invitation has been opened and roughly how many times, and we keep the time of the first open. We do not log each open, and we do not store a guest’s IP address, location or device against their invitation. That is a decision written into the database schema rather than a setting: the table is structurally incapable of answering “where were they and on what device”.

Who else sees it

We use a small number of processors to run the service. Each one only gets what it needs to do its job:

• Neon — the Postgres database everything is stored in.
• Vercel — serves the website and the host application.
• Render — runs the API.
• Resend — delivers the confirmation and password-reset emails. It sees the recipient address and the message.
• Google — only if you choose to sign in with Google, and only the identity check itself.

Some of these store or process data outside India. We do not otherwise disclose personal data, except where the law requires it of us.

Cookies and local storage

We set no advertising or analytics cookies. What we do set:

• invitedfor_session — your sign-in, for eight hours. HttpOnly, so page scripts cannot read it.
• invitedfor_signed_in — a marker holding the single character “1”, so the public site can offer a signed-in host their dashboard instead of a sign-in button. It carries no credential and expires with the session.
• invitedfor_google_oauth and invitedfor_google_registration — short-lived, only while a Google sign-in is in progress.
• In your browser’s local storage: invitedfor-theme, remembering whether you chose light or dark; and, once you are signed in, invitedfor-rail-collapsed and invitedfor-rail-drafts-dismissed, remembering whether you collapsed the sidebar and dismissed its drafts reminder; and invitedfor-create-draft, keeping what you have typed into a new event until you create it or choose Start over. None of these ever leave your browser.
• If you use the host application, your browser’s app cache: invitedfor-app-shell, keeping the application’s own code, icons and an offline page so it opens quickly and can tell you when you are offline. It never holds your events, guests, replies or anyone’s invitation, and it never leaves your device.
• invitedfor-storage-notice, also in local storage, remembering that you have read the notice about this list so it is not shown on every visit.

How long we keep it

Your account and its events are kept until you delete them. Closing your account erases your profile, your events, their guest lists, invitations and replies — including events that are already open to guests. We do it immediately, which is well inside the period the DPDP Act allows.

Two things survive that deletion, deliberately. We keep an audit record that an account was closed and what was erased with it, without your email address, because that record is the evidence the erasure happened. And a guest’s invitation link simply stops working: it will not explain why, because there is no longer anything to explain it with.

Our audit log records administrative and security-relevant actions. It stores the reader’s IP address only as a keyed digest, never in the clear — enough to see that one origin performed forty actions, not enough to be a location history.

Your rights

As a Data Principal under the DPDP Act, you may:

• Ask what we hold about you and who it has been shared with.
• Correct it. Your name and phone number are editable in your account settings. Your email address is your sign-in identity and was proven with a code, so changing it is something we do for you rather than a text field.
• Have it erased. Closing your account does this in full, immediately, and you can do it yourself from your account settings.
• Nominate someone to exercise these rights on your behalf if you die or become incapacitated. Write to us and we will record it.
• Complain — to us first, and then to the Data Protection Board of India if we have not resolved it.

Children

invitedFor is not for people under 18, and we do not knowingly hold a child’s data as a host. A child may of course be a guest at a wedding: where a host puts a child on a guest list, the host is responsible for having a lawful basis to do so, as they are for every other name on it.

Security

Passwords are stored as scrypt hashes. Session credentials, invitation tokens and email codes are stored only as digests, so reading our database cannot mint a working one. Traffic is served over TLS. Sign-in, registration, reply and password-reset endpoints are rate limited. No system is perfectly secure, and we do not claim otherwise.

Changes

If we change this policy we will publish the new version here with a new effective date. Where a change materially affects how we use data you have already given us, we will tell account holders by email rather than relying on you to notice.

Contact and grievance redressal

For anything in this policy, including a request to exercise a right above, write to [contact email address].

Our Grievance Officer under section 13 of the DPDP Act is [name and email of the Grievance Officer]. We aim to answer within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.