GDPR Policy

• Account data: e-mail address, name (when signing in with Google/Facebook), public profile photo (optional).
• Invitation content: texts, event details, uploaded images.
• Guest data entered by you or by your guests (attendance, number of people).
• Billing data entered at checkout.
• Minimal technical data needed for the service to work (login session).

• Performance of a contract (Art. 6(1)(b) GDPR) — to provide the services you use.
• Consent (Art. 6(1)(a)) — for optional features (e.g. social sign-in, analytics and advertising cookies).
• Legal obligation (Art. 6(1)(c)) — invoicing and accounting records.
• Legitimate interest (Art. 6(1)(f)) — platform security and improving the service based on aggregated data.

We keep your data for as long as your account is active and for the period required by law (e.g. accounting records). When you delete your account, the associated data is removed or anonymized, except for data we are legally required to keep.

Exception: an invitation that is not activated (paid) within 7 days of being created is permanently deleted with all its content. We notify you by e-mail at least one day before. Your account remains active.

We use providers that process data on our behalf, with GDPR safeguards:

• Supabase — account and invitation data storage (EU servers).
• Cloudflare — storage and delivery of the photos and videos in your event album.
• Google / Facebook — optional sign-in with your Google or Facebook account.
• Resend — transactional e-mails (account confirmation, RSVP notifications, receipts).
• Stripe — payment processing (card and the other methods offered at checkout, including PayPal). We never store your full card details.
• PayPal — only if you choose to pay with PayPal at checkout.
• Anthropic — AI-generated invitation text, only when you explicitly use this feature; it receives what you type in the form (event type, names, desired tone) solely to generate the text.
• Replicate — AI photo processing in the AI Photo Editor (including an automatic safety check), only when you explicitly start a generation; it receives the selected photo solely to produce the result.
• DeepL — automatic translation of invitation texts, only when you use the translation feature.
• Google Analytics / Google Ads — usage statistics and campaign measurement, only with your consent from the cookie banner (see section 6).

We do not sell or rent your data.

• Right of access.
• Right to rectification.
• Right to erasure (“right to be forgotten”).
• Right to restriction of processing.
• Right to data portability.
• Right to object.
• Right to withdraw consent at any time.

You can exercise your rights by writing to contact@invitationline.org. You also have the right to lodge a complaint with the Romanian supervisory authority (ANSPDCP — dataprotection.ro) or with the supervisory authority of the EU country where you live.

We use encrypted connections (HTTPS/TLS) and appropriate technical and organizational measures to protect your data. Payment data is processed exclusively by Stripe; we do not store your card details.