Privacy

Two different things happen here and they have different answers, so it is worth being precise.

Your account — your email address, your name, what you have paid. Nimantran decides what to do with that, so we are the data fiduciary for it and you ask us.

Your guest list and the replies — the couple decides who is invited, what is asked of them and what happens to the answers. The couple is the data fiduciary for that; we are their processor, and we act on their instructions and no one else’s.

So a guest who wants their details removed from an invitation asks the couple who invited them. If they cannot reach the couple, they can write to us and we will pass it on.

Your account: email address, the name you gave at sign-up, and whether you have confirmed the address. Your password is held by our authentication provider as a hash and is never visible to us.

Your invitation: everything you type into it — the couple’s names, the ceremonies, venues, dates, a blessing, photographs you upload, and links you add.

Your guests: the name, family name, greeting, side, seat count, phone number, email address and notes you enter, plus a private link for each one, when it was sent, and when it was last opened.

Replies: the name, phone, email, whether they are coming, how many, a meal choice and a message, as your form asks for them. Guestbook notes, and a photograph if the guestbook takes them.

Payments: which plan, how much, when, and the reference the payment provider gives us. We never see or store card numbers, UPI IDs or bank details.

If you choose Shahi: your WhatsApp number and our conversation with you, which is where we agree what to write and send you each version. If you send us your guest list as a spreadsheet, we import it into your invitation and then delete the file from our phone and inbox — your guests then live in your dashboard like anybody else’s, and nowhere else.

Reports: if somebody reports an invitation, the reason and anything they type. We deliberately do not ask who they are.

Technical: a network address, used to count requests so one person cannot flood a form, and ordinary server logs. On this website and your dashboard — not on any invitation — we count visits anonymously: which pages were opened, where the visit came from, the kind of device, and whether a visit went on to sign up, make an invitation, pay for a plan and publish it — with the plan and the amount, and nothing about the invitation itself. That is not tied to your name or email. A browser sending Do Not Track is not counted at all.

Our ads: we advertise on Instagram and Facebook, and the public pages of this website — not your dashboard, and never an invitation — carry Meta’s pixel so we can tell whether those ads work. It tells Meta which of those pages you opened, and that you signed up if you did, and sets a Meta cookie to recognise the browser. Meta can link that to your Facebook or Instagram account and use it to choose who sees our ads. It is never told your name, your invitation, your guests or what you paid. A browser sending Do Not Track is not sent to Meta at all.

We do not sell anything about you or your guests. Apart from the ad measurement described above, we do not share it for advertising — ours or anybody else’s — and your guests’ details never go to an advertiser at all. We do not contact your guests ourselves, ever — the messages come from you, through your own phone.

There are no third-party advertising or tracking scripts on an invitation. The visit counting an invitation can show its couple is our own, it records no personal details, and a guest can switch it off from the invitation itself.

Besides confirming your address and resetting your password, we write to the person who paid for an invitation about two things. A morning summary on any day something new happened: who replied, whether they are coming, any message they left, the headcount for each celebration, and guestbook notes waiting for you. Guests’ phone numbers and email addresses are never put in it. Every summary has a link to switch it off.

And a notice a fortnight and a day before your invitation closes. That one cannot be switched off, because it is about something you paid for.

Tips and offers by email only if you ask for them — the box on the sign-up form starts unticked, and you can also say yes later from your profile page. We keep a record of when you said yes and the words you were shown. You can stop them from your profile page at any time, and that is recorded too.

Only the companies that make the product work, each for one job, and each bound to use it for nothing else.

• Supabase — Hosts the database, the accounts and the photographs. (Tokyo, Japan)
• Vercel — Runs the website and serves every page. (Mumbai and global edge)
• Razorpay — Takes the payment. Card and UPI details go to them and never reach us. (India)
• Cloudflare — Checks that a form was filled in by a person. Sees the IP address and nothing else. (Global)
• Google Fonts — Serves a typeface, and only when a couple picks one we do not host ourselves. (Global)
• Resend — Delivers the emails we send you — sign-in, password and the morning summary of your replies. (United States)
• PostHog — Counts visits to this website and your dashboard — which pages, from where, roughly what device, and which plan was bought. Never on an invitation, and never your guests' details. (United States)
• Meta — Measures our Instagram and Facebook ads: which pages of this website were opened and whether a visit went on to sign up, tied by Meta to your Facebook or Instagram account if you have one. Never on your dashboard or an invitation, and never your guests' details. (United States)
• WhatsApp (Meta) — Carries our conversation with a Shahi couple, and the guest spreadsheet they send us — only if they choose Shahi and message us. (Global)
• OpenStreetMap — Draws the venue map, when an invitation shows one. (Global)

Some of these are outside India, which means your data is transferred there. We also hand over information if the law genuinely requires it.

A paid invitation opens for guests until 90 days after the wedding. Your guest list and every reply stay in your dashboard for a year after that, and then we remove them — your guests’ phone numbers are not something we want to hold indefinitely either. We tell you before it happens, and you can download everything at any point until then.

An unpaid invitation stays while your account does. Deleting one nobody paid for removes it and everything attached to it at once.

Deleting one you paid for takes it off the web immediately and keeps its records while a refund could still be asked for — about a month — after which they are removed for good. If you would rather they went sooner, ask us and they will.

Our WhatsApp conversation with a Shahi couple is kept until a year after the wedding, the same as the guest list, and then deleted.

A draft nobody ever started is swept after about three months. Photographs whose invitation is gone are deleted. Payment records are kept for as long as tax and accounting rules require, because they are also your receipt.

A copy of what we hold about you, a correction, or deletion. You can export your replies as a spreadsheet from your own dashboard at any time without asking anybody.

You can close your account, and you can withdraw a consent you gave. Ask through the contact page, which also names the person who handles complaints and says how long we take.

A cookie keeps you signed in. Without it you would sign in on every page, so there is nothing to consent to and nothing to switch off.

An invitation remembers a few things in your own browser and nowhere else: whether you have opened the envelope, whether you asked for less animation, and whether you opted out of the couple’s visit counting. None of it leaves the device.

On this website and the dashboard, the visit counting keeps an anonymous identifier in the browser’s storage, so that two pages from one visit count as one visitor. It is not a cookie, and it is never set on an invitation.

The public pages of this website set Meta’s advertising cookie, described under “Our ads” above. You can block it in your browser, or switch on Do Not Track, and nothing on the site stops working. Your dashboard and every invitation set no advertising cookie at all.

Every guest link is unguessable, and an invitation can be set so that only those links open it. The database refuses to hand one couple’s wedding to another couple’s session — that rule lives in the database itself rather than in the pages, so there is no route around it.

Photographs are stored under names nobody can guess and the store cannot be listed. Traffic is encrypted. Forms a stranger can post to are rate limited and checked for bots.

No one can promise perfect security. If something does go wrong and it affects you, we will tell you and the regulator as the law requires, rather than hope you do not notice.

This is a product for people planning a wedding, and accounts are for adults. Children appear only as names on somebody’s guest list, entered by the family inviting them.

The date at the top says when this last changed. If a change matters to you we will tell you rather than leave it here to be found.