🔒 Privacy Policy

The controller of personal data entered on digitalinvitations.online is Jarosław Oroń, address: Lublin, ul. Herberta 11/54, Poland, e-mail: [email protected]. The service does not collect guest data. Guests open the invitation via a link, with no forms, no account and no data to enter, so the host does not entrust us with any data about their guests.

Data entered by the host in the editor: names, event date and venue, contact details and the content of add-ons (e.g. schedule, menu). It is encrypted with AES-256-GCM and deleted automatically 30 days after the event date. Data provided voluntarily: the recipient’s and sender’s e-mail addresses when an invitation is sent by e-mail (used only for that delivery), the e-mail address subscribed to the newsletter (encrypted, with confirmed opt-in) and the content of messages sent through the contact form or a bug report. Technical data: IP address in server logs and in abuse protection (for ratings we store only a hash) and anonymous, cookie-free visit statistics. Billing data will be processed only once paid services launch, in line with the information given at purchase.

An account is optional: a free invitation can be created without one. When you sign up with email, we store your first name, last name, email address and password (kept only as a cryptographic hash). When you sign in with Google or Microsoft, we receive your name, email address and profile picture from those companies. We have no access to your password with those services or to any other account data. We send one-time codes to your email address (address confirmation, passwordless sign-in, password change). At each sign-in we store the date and IP address to protect the account against misuse. Legal bases: performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in security (Art. 6(1)(f) GDPR). Account data is kept until the account is deleted. To delete your account, write to us from the address linked to the account.

We process your data to provide services electronically (performance of a contract, Art. 6(1)(b) GDPR). For analytical, statistical and security-improvement purposes (legitimate interest, Art. 6(1)(f) GDPR). For accounting and tax purposes in the case of paid transactions (legal obligation, Art. 6(1)(c) GDPR).

We process data on servers in the European Union. We use the following providers: • Contabo (server hosting, Germany). • Cloudflare (protection against attacks, content delivery, and storage of invitation files and guest-uploaded photos in R2 storage located in the European Union). • Resend (e-mail delivery). • Sentry (application error monitoring, without invitation content). • Google (map and weather forecast in invitations where the host has enabled these add-ons). Visit statistics are collected by the self-hosted Umami tool, without cookies. A payment operator (Stripe, Przelewy24) will be added when paid services launch. We do not sell data and do not share it for marketing purposes.

You have the right to: access your data, rectify it, erase it, restrict processing, data portability and objection, as well as the right to lodge a complaint with a supervisory authority. To exercise your rights, contact us: [email protected].

Data of guests on the list (full name, phone, email, plus-one, reply to the invitation) is entered by the organiser. Insofar as the GDPR applies, the organiser is the controller of this data and the Operator processes it on the organiser’s behalf and instructions. The data is encrypted and used only to show the guest’s name in their personal link, record that the invitation was sent and opened, and store the reply. We do not use it for marketing and share it only with infrastructure providers. We delete the data 30 days after the event date, or earlier if the organiser deletes the guest or their account. Guests can contact the organiser or us at the contact address given in this policy.