Invitesse is a digital invitation design and preparation service. This policy explains how personal data is handled on its website and tools. The data controller is Lina Perez Vergara, an individual based in Barranquilla, Colombia. Privacy contact: hola@invitesse.com.
Data we handle
When you create an account, we handle your email address, user identifier and the authentication information needed to provide access. If you sign in with Google, Google and Supabase allow us to receive authorized basic information such as your name, email address, identifier and, when provided, profile picture. Invitesse does not receive your Google password or request access to Drive, Gmail or Calendar through this sign-in.
We handle the content you enter in drafts: names, dates, text, event details, files and preferences. Guest replies are intended to collect names, attendance and optional dietary restrictions. Provide only what is needed to arrange food, without medical diagnoses. The message capsule, when available and selected, will also retain each message and its author’s name. The current editor also allows household members and contact details in prepared lists; do not provide contact details unless needed. Avoid providing identity documents, financial details or sensitive information that the service does not need.
Our infrastructure and service providers may also process technical connection and security information, such as IP addresses, browsers, access times and error logs. Email enquiries are retained to respond to them. If you request a custom quote, we process the form details (names, email and the description of what you imagine) only to reply to you; they are sent to our email and are not stored on the website.
Purposes and authorization
We use the information to identify you, protect access, save and retrieve drafts, provide available features and respond to enquiries or requests. Processing relies on the prior, express and informed authorization required by applicable law, or another applicable legal basis. This policy provides information; publishing it does not replace any authorization that must be obtained.
Where a service is purchased, information may also be used to manage that service and related obligations. We do not use information obtained through Google sign-in for personalized advertising or sell that information.
Guests and publications
You must be authorized to provide other people's information and inform them about its use. Provide only what is necessary to manage the event. Children's information must be handled by an authorized person with any required permissions.
Drafts are private to their owner under the application's access controls. Publication may make event information available according to the selected access mode. Private household links should be shared only with their intended recipients: someone holding a valid link can access the information permitted for that household. Demos use example information and are not published customer invitations.
Providers and international processing
We use Supabase for authentication and data, Vercel for hosting and server functions, Resend to deliver quote requests to our email and Google for optional Google sign-in and the organization's email services. The website may also load fonts from Google Fonts. Each provider processes the information necessary for its role and may operate outside your country. Transfers and access must comply with applicable obligations and those providers' terms. No payment gateway is connected to the current public purchase flow.
Storage on your device
The application uses local and session storage to maintain access, previews and your destination after authentication. Clearing that storage may sign you out or remove content that was saved only on your device. Google Analytics (measurement ID G-2YPN2SZT3R) and Microsoft Clarity (project yzwi7fw4jr) load only after you accept optional analytics, and only on public commercial pages, including design pages and resources. Accounts, the editor, demos and private invitations are excluded. Google Analytics measures visits, selected clicks, confirmed quote requests and page performance (LCP, INP and CLS). Performance events do not include page elements, query parameters, fragments or form data. Microsoft Clarity generates heatmaps and session replays of interactions with the public website, excluding quote pages. Input fields, forms and privacy controls are masked. We do not send guest names, replies, dietary restrictions or messages to these tools. Google Analytics page addresses exclude query parameters, fragments and referrer details. Clarity does not start on a page whose initial address has query parameters or an unrecognized fragment. Advertising signals and personalization are disabled in this integration. Google and other providers may use their own mechanisms during their respective flows.
Analytics choices
You can accept, reject or change optional analytics through “Privacy preferences” on the public website and legal pages. Necessary storage remains available. Neither Analytics nor Clarity is loaded or contacted by this integration before acceptance. Your choice is stored locally for up to 180 days; Analytics cookies are configured with a maximum lifetime of 180 days. Withdrawing consent stops measurement on this device and clears the first-party Analytics and Clarity cookies managed by this integration; it does not erase data previously collected. Contact us to request deletion where applicable. A Global Privacy Control signal keeps analytics disabled. Google and Microsoft process measurement data under their applicable terms and privacy information. Clarity has its own cookie and data retention periods, separate from the event-related retention periods below. Withdrawing permission does not automatically delete third-party cookies on Google or Microsoft domains.
Google Privacy · Microsoft Privacy · Clarity cookies
Retention and your rights
For the invitation publication service, which is not yet enabled, the planned retention period for the invitation and attendance replies is 3 months after the event. If the message capsule is selected, only the capsule content, its authors’ names and the data needed to provide access will be retained until 13 months after the event. The capsule does not extend retention of the guest list or dietary restrictions. Drafts and accounts are handled separately while the account or preparation service remains active, subject to deletion requests and applicable obligations. Backups, security logs and legally required records have separate cycles; the event-based periods do not promise immediate erasure of every backup. Before publication becomes available, the service must provide the applicable expiry and deletion process.
Under Colombia's Law 1581 of 2012 and its implementing rules, you may access, update and correct your data; request proof of authorization where applicable; learn how it is used; access it free of charge; and request deletion or withdraw authorization in the circumstances provided by law. To exercise these rights, email hola@invitesse.com with the subject “Privacy”.
We may request proportionate information to verify your identity and avoid disclosure to someone else. If you are a guest, identify the event or household without attaching unnecessary sensitive documents. Legal obligations or third-party rights may limit immediate deletion; we will explain relevant limitations. We will handle enquiries and complaints within applicable legal periods and communicate any permitted extension. You may complain to Colombia's Superintendence of Industry and Commerce after completing the procedure with the controller when required by law. Mandatory rights applicable in other jurisdictions will also be respected.
Security and changes
We use authentication and owner-based access controls; these do not eliminate all risks. Protect your account and private links and notify us of unauthorized access. Material changes to this policy will be published with their date and, where required, additional notice or authorization.
Payment processing
Coldevs Inc is the seller of invitations. Stripe processes payments through its United States account and receives the data needed for charging and fraud prevention. Invitesse retains order and payment identifiers, amount, currency and expiry; full card details are entered on Stripe and are not stored in the editor. Invitations and household replies are not sent to commercial analytics.