Privacy Policy

1. Information We Collect

We collect information to host your invitations and manage guest RSVP entries:

• Account Information: Email, password (hashed securely), and name when you sign up.
• Invitation Details: Groom/bride names, bios, event schedules, venues, maps, background music selections, styling preferences, and photos you upload.
• UPI Details: Receivers name and UPI address to log UPI transaction references.
• Guest RSVP Submissions: Guest name, attendance status, wishes, and guest count.
• Payment Records: Razorpay transaction ID, amount, and tier purchased (credit card numbers and payment details are handled exclusively by Razorpay and never stored on our servers).

2. How We Use Your Information

We utilize collected data to perform the following:

• To construct and publicly host your customizable wedding invitation page.
• To display guest RSVPs and digital gift counts inside the host dashboard.
• To prevent fraud, secure accounts, and apply promo code discounts.
• To monitor and track basic visit analytics (page views) on invitation pages.

3. Cookies & Local Storage

We use necessary authentication cookies (stored locally in your browser) to keep you signed in to your InviteMagic session. We also use browser local storage to save temporary dashboard preferences and debug logs. You can disable cookies in your browser settings, but it will prevent you from signing in to the dashboard.

4. Third-Party Processors

We work with trusted third-party providers to host data and process checkout payments:

• Supabase: Used as our cloud database and user authenticator. All user credentials and invitation contents are stored on Supabase servers in compliance with their privacy guidelines.
• Razorpay: Used for payment processing. Razorpay collects and processes your billing data securely.

5. Data Security

We employ strict security measures including SSL/TLS transfer protocols, Row-Level Security (RLS) policies in PostgreSQL to restrict data ownership, input validation using `zod` schemas to prevent XSS attacks, and token bucket rate limiters to shield APIs from abuse.

6. Your Rights & Data Deletion

You own your data. You can delete individual events, gallery images, or draft invitations directly from your dashboard. If you wish to delete your entire user profile and remove all associated invitations, guest RSVPs, and payments logs from our database, please contact us.

7. Compliance & Log Retention (Indian IT Act & CERT-In)

Pursuant to the Cyber Security Directions issued under Section 70B of the Indian IT Act, 2000 and CERT-In rules, we maintain system security access and activity logs (including user ID, transaction action details, source IP address, and browser user-agents) for a rolling retention period of 180 days. This information is processed strictly for security audits, legal compliance, and preventing fraud. These compliance logs are stored securely and deleted automatically upon expiry of the retention duration.

8. Grievance Officer

In accordance with Section 43A and Section 72A of the IT Act, 2000, and rules made thereunder, any grievances or concerns regarding our privacy practices and data processing can be addressed to the designated Grievance Officer: