Privacy policy
Last updated: October 17, 2026
This policy explains the data invitezip uses to provide invitations, account access, attendance replies and payments. Contact [email protected] with privacy questions.
Who operates the service
The service is operated under the name invitezip and uses [email protected] as its contact address. We use data to provide the functions you request, protect the service from abuse and maintain payment records. Event organizers decide which invitation details to publish and which guest information to collect.
Account and draft data
We store your account name, email address, verification status and sign-in provider association. Passwords are stored as password hashes, not readable passwords. Google sign-in provides basic profile and email information. Anonymous drafts use a private draft cookie and browser storage so you can return to your work. We store invitation text, event details, images and published versions to save and show your invitation.
Invitations and security
People with an invitation link can view its published content. A personal guest link can access that guest's reply, so treat it as private. Invitations ask search engines not to index them, but this does not make a link confidential. Abuse protection uses hashed request identifiers derived from IP address and browser information; we do not use these to advertise to you.
Attendance information
Attendance replies contain a name, adult and child counts, attendance status and an optional note. InviteZip stores this information for the event owner to manage attendance and sends an email notification of a reply to that owner. Guest lists are not shown to other guests. Guests can update or cancel their reply using their private link; cancellation changes attendance status rather than deleting the record. For removal, ask the organizer to delete the guest record. Deletion clears personal fields and revokes the private link.
Cookies and optional analytics
Essential cookies support sign-in and anonymous draft access. Optional analytics is off until you enable it in Cookie settings. If enabled, first-party analytics uses a signed anonymous cookie that lasts up to 30 days. We record a limited set of page and workflow events without names, emails, form contents, passwords, guest tokens, URL queries or referrers. When you sign in, events from an unbound anonymous browser identity can be linked to your current account. A previously bound identity is never reassigned to a different account. When configured and enabled by your consent, Google Analytics 4 records page views on public marketing pages, without URL queries, referrers or private invitation URLs; advertising signals are disabled. You can turn analytics off in Cookie settings to stop optional browser tracking and clear the first-party identifier. Service-side completion counts, such as successful payments, are kept separately as the event name, time, a limited business category where needed and a non-readable deduplication digest, without browser, user or event identifiers.
Service providers
Stripe processes payment information on its hosted checkout; InviteZip stores order references, amount, currency and refund state, but does not store card numbers. Google handles Google sign-in when you choose it. If Google Analytics 4 is configured and you enable optional analytics, Google also processes limited public marketing page-view data with advertising signals disabled. Our email delivery service processes the recipient and message needed for verification, password recovery and attendance notifications. Hosting and file delivery providers process requests needed to serve the site. Optional analytics does not start before your consent.
Retention and deletion
Free event availability ends 90 days after the event. Premium events have no automatic expiration date. Event deletion makes it unavailable immediately. Deleting an account immediately disables its sessions and events; safe account cleanup becomes eligible after 30 days. Files or records with retained references, an active rendering lease or pending safe cleanup can remain longer. On final account deletion, the checkout email is removed from local orders; non-email financial history, including payment references, amounts and refund state, is retained. Optional usage events stop appearing in usage reports after 90 days and become eligible for daily bounded cleanup; physical removal can take longer while batches are processed. Minimal service completion counts and their non-readable deduplication digests are retained separately without browser, user or event identifiers. Essential security and financial records have their own operational requirements; we do not promise a retention period that has not been defined.
Your choices and requests
You can edit your profile, delete an event, delete a guest record, delete your account and export accessible guest records as CSV using the site. These controls are not a complete personal-data export. Contact [email protected] about access, correction, deletion or other privacy rights that apply to you. We may need to verify your identity and scope before handling a request. Turning off analytics does not automatically erase events already recorded.