Privacy Policy — Invitly

At Invitly, protecting your personal data is our priority. This Privacy Policy explains how we collect, use, and share your information in compliance with applicable laws, including the California Consumer Privacy Act (CCPA) and the legal framework for data protection and electronic commerce in El Salvador.

1. Information We Collect

We collect information you provide directly to us (such as your email address when you sign in with our single-use email passcode) and data related to the events you create or manage on our platform. We also automatically collect certain technical data (such as IP addresses and browser types) and use strictly necessary cookies to keep you signed in and protect your session. To help organizers measure interest, we record aggregate, first-party engagement analytics about the events you create — such as page views, calendar downloads and clicks, referral or UTM source, and a coarse country derived from request headers. This product analytics data is first-party only and is never used to track you across other websites.

2. How We Use Your Information

Your data is used to provide, maintain, and improve our services, manage your account, generate calendar links, and communicate with you. For security and authentication, we use single-use, email-delivered passcodes (OTP). For billing, any payment payloads from our providers are strictly redacted of Personally Identifiable Information (PII) such as your full name, billing address, and phone number before being recorded in our audit logs. We do not sell your personal information to third parties.

3. Cookies and Tracking Technologies

Invitly sets strictly necessary (essential) cookies — primarily a secure, signed session cookie that keeps you logged in and short-lived security tokens that protect against cross-site request forgery and bot abuse (Cloudflare Turnstile) — regardless of any choice you make, because the service cannot function without them. With your opt-in consent, we also use Google Analytics (Google Consent Mode v2) to understand aggregate site usage; this analytics cookie is only set if you accept it in the cookie banner, and you can withdraw consent at any time. Our own first-party product analytics record only aggregate event interactions (such as page views and calendar downloads) about the events you create and never track you across other websites. You may clear or block cookies in your browser, but the service cannot function without the essential session cookie. For a full description of each cookie we set, see our Cookie Policy.

4. Information Sharing and Disclosure

We may share your information with trusted third-party service providers (our sub-processors, listed below) who assist us in operating our platform, provided they agree to maintain the confidentiality of your data. We may also disclose information if required by law or to protect our rights.

5. Sub-processors and Data Processing Agreements

We rely on a small number of vetted sub-processors to operate Invitly, each bound by a Data Processing Agreement (DPA) and contractually required to safeguard your data and process it only on our documented instructions: Amazon Web Services (Amazon SES) for transactional email delivery; PayPal and Wompi for processing paid-subscription payments; Cloudflare for content delivery, DNS, and bot protection (Turnstile); and Google (Google Analytics) for aggregate, consent-gated site analytics. If you configure an alternative SMTP email provider, or enable a CRM integration (HubSpot, Slack, or Zapier) from the dashboard, that provider also acts as a sub-processor on your behalf for the data you choose to send it. We will provide reasonable prior notice of material changes to this list. Our current sub-processors are published on our Sub-processors page; to request a copy of our DPA, contact [email protected].

6. International Data Transfers

Your information may be stored and processed in the United States, El Salvador, or other countries where our service providers operate. Where we transfer personal data of users in the EEA, the United Kingdom, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs). By using Invitly, you acknowledge this transfer.

7. Your Privacy Rights (CCPA & El Salvador)

Depending on your jurisdiction, you have specific rights regarding your personal data. Under the California Consumer Privacy Act (CCPA/CPRA), California residents have the right to access, delete, and opt-out of the sharing of their data, as well as limit the use of sensitive personal information. We do not sell or share your personal information for cross-context behavioral advertising; California residents may nonetheless exercise their Right to Opt-Out ("Do Not Sell or Share My Personal Information") at any time by contacting [email protected]. You may also ask us to restrict processing of your data; we will action such requests by contacting that same address. Under the laws of El Salvador, including the constitutional right to Habeas Data, users have the right to access, rectify, cancel, and oppose (ARCO rights) the processing of their personal information. To exercise any of these rights, please contact our Data Protection Officer at [email protected].

8. Your Rights Under the GDPR (EEA, UK & Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) governs our processing of your personal data. Our lawful bases are: performance of a contract (to provide the service you sign up for and process your subscription), our legitimate interests (to secure, maintain, and improve the platform and prevent abuse), compliance with legal obligations, and your consent where specifically requested. You have the right to access, rectify, erase, restrict, or object to processing, to data portability, and to withdraw consent at any time without affecting processing carried out beforehand. You also have the right to lodge a complaint with your local data-protection supervisory authority. To exercise any of these rights, contact our Data Protection Officer at [email protected].

9. Data Security and Retention

We implement robust, industry-standard security measures to protect your data against unauthorized access, including row-level security at the database level and encryption of sensitive credentials at rest. We retain your data only for as long as necessary to fulfill the purposes outlined in this policy. Specifically, our system automatically purges application and subscription audit logs that are older than 365 days. In the event of a personal-data breach that affects you, we will notify you and any applicable supervisory authority without undue delay and, where legally required, within 72 hours of becoming aware of it.

10. Event RSVPs, Attendee Data, and CRM Integrations

If an event organizer enables RSVP collection on their event, we ask attendees to confirm consent before their name and email are recorded and shared with that organizer; we record the fact and time of that consent alongside the RSVP. When an organizer manually adds an attendee on their behalf (Manual RSVP), the organizer confirms to us that they already hold the attendee's consent to do so. For that RSVP or attendee data, the event organizer is the data controller and Invitly acts as a data processor on their behalf. If the organizer has connected a CRM integration (HubSpot, Slack, or Zapier), the attendee's name and email are additionally forwarded to that provider so the organizer can manage attendance in their own tools; see the Sub-processors section above. Attendees who wish to exercise a privacy right over data an organizer holds about them should contact that organizer directly, or contact us at [email protected] and we will assist in routing the request.

11. AI and Machine Learning Data Usage

We respect your data sovereignty. Invitly does not use your personal data, event details, or guest lists to train public or proprietary Artificial Intelligence (AI) or Large Language Models (LLMs) without your explicit opt-in consent. Any automated processing is strictly limited to delivering the core functionality of our service, such as calendar link generation and spam detection.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on this page.