Privacy Notice

1. Who we are

invitations.store is operated by KEYVISION EOOD, a company registered in Bulgaria. KEYVISION EOOD is the data controller for the personal data described in this notice. You can contact us at support@invitations.store.

2. Data we collect and why

• Account data (email address, login credentials, sign-in provider) — to create and secure your account. Legal basis: performance of our contract with you.
• Invitation content (event title, hosts, date, venue, message, and any guest details you enter) — to create and host your invitation. Legal basis: contract.
• Guest RSVP data (name, attendance, meal preference, whether children are coming) — to pass replies to the host who invited them. Legal basis: our legitimate interest and the host's legitimate interest in organising their event.
• Support messages — to answer your questions. Legal basis: legitimate interest.
• Technical and usage data (IP address, device and browser identifiers, log and error data) — for security, fraud prevention, and improving the product. Legal basis: legitimate interest.
• Email delivery data (delivery, bounce and open status of service emails) — to deliver account emails reliably. Legal basis: contract and legitimate interest.

We do not receive or store your card details. Payment data is collected and processed by Paddle as Merchant of Record.

3. Who we share data with

• Service providers / subprocessors — hosting, database, email delivery and error-monitoring providers who process data on our instructions.
• Paddle.com, our Merchant of Record, for the sale of our plans, payments, invoicing and tax compliance.
• Hosts — if you submit an RSVP, your reply is shown to the host who sent you the invitation.
• Professional advisers (legal, accounting) and authorities where required by law.

Some providers are located outside the EEA. Where that happens we rely on adequacy decisions or EU Standard Contractual Clauses as safeguards.

4. Retention

We keep account and invitation data while your account is active and for up to 12 months afterwards, unless you ask us to delete it sooner. Guest RSVP data is deleted together with the invitation it belongs to. Records required for tax and accounting are kept for the period required by law. After these periods data is deleted or anonymised.

5. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict or port your data, to object to processing based on legitimate interests, and to withdraw consent where processing is based on consent. Write to support@invitations.store and we will respond within one month. You may also complain to your local supervisory authority — in Bulgaria, the Commission for Personal Data Protection.

6. Security

We use appropriate technical and organisational measures, including encryption in transit, access controls and row-level database permissions, so that each account can only reach its own data.

7. Cookies and local storage

We use only essential cookies and browser storage: keeping you signed in, remembering your language choice, and saving an unsaved invitation draft on your device. We do not use advertising cookies. You can clear this data at any time in your browser settings, though doing so will sign you out.

8. Changes

We may update this notice; the date above shows the latest version.