Privacy Policy

1.Who we are

Wedding Card Maker is operated as a sole proprietorship based in India. For anything in this policy — questions, requests, or complaints — write to support@example.com. We aim to reply within 7 working days.

In data-protection language we are the controller of the data you give us about yourself, and a processor acting on your instructions for the data you collect about your guests. Section 5 explains what that split means in practice.

2.What we collect

We collect only what the service needs to work. We do not buy data about you from anyone.

• Account data — your name, email address, and a hashed password. If you sign in with Google, we receive your name, email address and profile picture from Google instead of a password; we never see your Google credentials.
• Invitation content — everything you type or upload while building an invitation: couple and family names, event names, dates, venues and addresses, your story, schedules, and any photos, music choices or custom text. This is your content, and we hold it for you.
• Guest and RSVP data — the guest names, phone numbers, email addresses and household groupings you add, plus the answers your guests submit: attendance, headcount, meal preferences, travel and accommodation details, and any message they leave. You decide what to ask for; we store the answers.
• Images and media — photos you upload are stored with our image host, Cloudinary. We keep only the resulting URL and an identifier, never a copy on our own servers.
• Payment data — when you buy a plan, our payment providers (Stripe, Razorpay) process the card or UPI details directly. Card numbers, CVVs and bank credentials never reach our servers. We store only the outcome: the plan bought, the amount, currency, provider reference, and status.
• Technical data — IP address, browser and device type, referring page, and timestamps, recorded in ordinary server logs. We also count how many times a published invitation has been viewed, in aggregate only — never who viewed it.
• Cookies — a small, listed set, all of them essential or functional. There are no advertising or third-party analytics cookies on this site. The full inventory is on our Cookie Policy.

3.How we use it

• To create and secure your account, verify your email address, and let you sign back in.
• To build, preview, publish and render your invitation, and to serve it to the guests you share it with.
• To collect and organise RSVPs for you, and to send the event emails and reminders you choose to send.
• To take payment, apply your plan's entitlements, issue receipts, and handle refunds.
• To keep the service running and safe: preventing abuse, debugging faults, and blocking fraud.
• To send you service messages about your account. We do not send marketing email you have not asked for, and every optional email has an unsubscribe route.
• To meet legal, tax and accounting obligations.

We do not sell your data, we do not share it with advertisers, and we do not use your invitation content or your guest lists to train machine-learning models.

4.Our legal bases

Where the GDPR or a similar law requires us to name a legal basis, they are:

• Contract — everything needed to give you the service you signed up for: your account, your invitation, RSVP collection, and payment.
• Legitimate interests — keeping the service secure, preventing abuse, fixing faults, and understanding aggregate usage. We balance these against your rights and keep the data minimal.
• Consent — optional extras, such as any marketing email you opt into. You can withdraw consent at any time without affecting the service.
• Legal obligation — tax records, and responding to lawful requests.

5.Your guests' data, and your responsibilities

When you upload a guest list or collect RSVPs, you decide what is collected and why. We act on your instructions and process that data to run your event — nothing else. We do not contact your guests for our own purposes.

That makes some things your responsibility, and our Terms of Service restate them:

• You must have a proper basis for holding your guests' contact details, and for sending them invitations and reminders through us.
• Ask for only what your event genuinely needs. Special-category data — health conditions, dietary requirements that reveal religion or belief — should be requested only when you actually need it, and handled with care.
• Answer your guests if they ask you what you hold about them, and pass any request you cannot handle on to us at support@example.com.
• Delete the invitation, or the guest list, when the event is over and you no longer need it.

If you are a guest and want your details removed, the fastest route is the couple or host who invited you, because it is their list. You can also write to support@example.com and we will forward your request to them and help them action it.

6.Who we share it with

We share data with a short list of service providers who process it on our behalf, under contract, and only to deliver the service:

Beyond that, we disclose data only where the law requires it, to establish or defend legal claims, or — if the business is ever sold or restructured — to the acquirer, who would remain bound by this policy. We would tell you before that happened.

A published invitation set to Public is, by design, visible to anyone with the link and can be indexed by search engines. Anything you put on it is public. Section 9 covers the controls you have.

7.International transfers

We are based in India, and the providers listed above operate in India, the EEA, the UK and the United States. Your data may therefore be transferred outside your own country.

Where data leaves the EEA or UK, the transfer is covered by the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant) or by an adequacy decision, together with the technical measures described in Section 10.

8.How long we keep it

• Account data — for as long as your account exists. Delete your account and we remove it within 30 days, except where we must keep records for tax or legal reasons.
• Invitations, guest lists and RSVPs — until you delete them, or until you delete your account. Deleting an invitation deletes its guest list and RSVP answers with it.
• Published snapshots — when you publish, we freeze a copy of the invitation so the public page never shows mid-edit changes. Unpublishing removes it from public view; deleting the invitation removes the snapshots.
• Uploaded images — removed from Cloudinary when you delete them, or when the invitation they belong to is deleted.
• Payment records — kept for as long as tax and accounting law requires, typically 8 years in India.
• Server logs — kept for a short operational period, normally under 90 days.

9.The controls you have

Every invitation has a visibility setting, and you can change it at any time:

• Public — anyone with the link can open it, and search engines may index it.
• Unlisted — anyone with the link can open it, but we ask search engines not to index it.
• Password protected — the content is withheld by our server until the correct password is entered. The password is never sent to the browser.
• Private — only you can see it.
• Invited guests only — the invitation opens only through a personal link issued to a named guest.

Guest and RSVP pages are served with no-store and no-index headers so they are neither cached by intermediaries nor listed in search results.

10.How we protect it

• Passwords are stored only as bcrypt hashes, are excluded from database reads by default, and are stripped from anything the server sends back.
• The whole site is served over HTTPS.
• Access to a password-protected invitation is proved by a signed, HTTP-only cookie derived from a server-side secret. No password or hash ever reaches the browser.
• Guest and RSVP links are unguessable tokens, and those pages are excluded from caching and search indexing.
• Every action that reads or changes your data is re-checked on the server against your identity and your plan, so no account can reach another's invitations, guests or exports.
• Card details never touch our servers — our payment providers handle them directly, and their webhooks are signature-verified.

No system is perfectly secure. If a breach ever affects your data, we will notify you and the relevant regulator as the law requires.

11.Your rights

Wherever you live, you can ask us for a copy of your data, ask us to correct it, or ask us to delete it. Write to support@example.com and we will respond within 30 days. We will not charge you or treat you differently for exercising a right.

India (Digital Personal Data Protection Act, 2023) — you have the right to access a summary of your personal data and how it is processed, to correction, completion and updating, to erasure, to nominate someone to exercise your rights if you die or become incapacitated, and to a grievance-redressal route. Send grievances to support@example.com; if you are not satisfied with our answer, you may approach the Data Protection Board of India.

EEA and UK (GDPR) — you have the rights of access, rectification, erasure, restriction, portability and objection, and the right not to be subject to solely automated decisions with legal effects (we make none). Where we rely on consent you may withdraw it at any time. You may also complain to your local supervisory authority, or to the UK Information Commissioner's Office.

California (CCPA/CPRA) — you have the right to know what we collect and why, to access and delete it, to correct it, and to limit the use of sensitive personal information. We do not sell or share personal information for cross-context behavioural advertising, and we have not done so in the preceding twelve months — so there is nothing to opt out of. You may use an authorised agent, and we will not discriminate against you for exercising these rights.

Everywhere else — if your local law gives you rights beyond the above, tell us in your request and we will honour them.

12.Children

The service is not intended for children, and you must be at least 18 to hold an account. We do not knowingly collect data from children. If a guest list includes a child's name because a family is attending, treat it as you would any guest detail — keep it minimal. If you believe a child has given us data directly, write to support@example.com and we will delete it.

13.Changes to this policy

We update this policy when the service changes or the law does. The date at the top always reflects the current version. If a change materially affects your rights, we will email account holders before it takes effect.

14.Contact us

Questions, requests or complaints about privacy go to support@example.com. See also our Contact page.