Privacy Policy
Who we are
Invitfy is a service to design digital invitations, send them and follow guests' replies. It is provided by Novotech Alliance for Design and Custom Software W.L.L., Commercial Registration 226267, Doha, Qatar ("we"). For anything about your data: [email protected].
Two kinds of data
Your account data (you, the host): we decide how it is used, as this policy explains.
Your guest list: you add it and decide who is invited; we process it on your behalf and only for your event. You are responsible for having the right to contact your guests.
What we collect
- Account: name, mobile number and/or email address, and how you sign in (a code by WhatsApp or email, Google, or Apple).
- Event: the details you type (host, occasion, date, venue), the design and any photos you upload.
- Guests: name, title, mobile number and/or email, reply, companions, table and check-in at the door.
- Payments: handled by Stripe; we never see or store your card number, only what you bought and the amount.
- Technical: operating logs and error reports, which contain no mobile numbers or email addresses.
Why we use it
To provide the service you asked for: create the invitation, send it to your guests, receive their replies, prepare the door list, issue invoices and protect the service from abuse. We do not sell data, do not use guest lists for marketing and show no advertising.
Companies that help us
Each gets only what it needs to do its job:
- Supabase (database) and Railway (runs the app): in Singapore.
- WhatsApp (Meta): the guest's mobile number, name and title, the event details, the invitation picture and their personal link.
- Resend (email): the guest's email address, name, the event details and a calendar file.
- Anthropic (Claude AI): the event details you type, to write the wording; when a guest replies with free text on WhatsApp, only that text is sent, without their name or number.
- Stripe: payments.
- Cloudflare: domain and bot protection. Google: sign-in and address search. Apple: sign-in. Apple Wallet and Google Wallet: only if a guest adds their pass. Sentry: error reports.
Some of these process data outside Qatar (Singapore, the United States, the European Union), under their contracts and safeguards.
How long we keep it
Guest data (names, numbers, emails, replies, messages, check-ins) is deleted automatically 30 days after the event; you can choose fewer days. Longer only under a signed contract. After deletion we keep only counts (how many were invited and attended), no names or numbers. Your account data is kept while your account exists; you can delete it in your account settings. Payment records are kept as long as the law requires.
Cookies
Only what is needed: sign-in cookies and one cookie that remembers your light or dark theme. No advertising cookies and no tracking tools.
Your rights
Under Qatar's Law No. 13 of 2016 on the Protection of Personal Data Privacy, and other laws that apply, you can ask to access, correct or delete your data, and object to its processing. Write to [email protected]. If you are a guest, ask the host to remove you, or write to us with the event's name and we pass your request to the host.
Security
Data is encrypted in transit, every account is isolated from the others in the database, links and QR codes carry a random code rather than a name or number, and door helpers see only the last 4 digits of a mobile number.
Children
The service is for hosts aged 18 or over.
Changes
If we change this policy in a material way we will tell you before it applies, and update the date above.