Privacy Policy

This Privacy Policy explains what personal data Invitorio (operated by E.G.M. Inter-Quantum Investments Ltd) collects, why, for how long, and the rights you have under the EU General Data Protection Regulation (GDPR).

E.G.M. Inter-Quantum Investments Ltd, based in Cyprus, is the data controller responsible for your personal data. For privacy requests, contact info@invitorio.com.

We collect the following categories of personal data:

• Account data: your name, email address and password (stored as a hashed secret).
• Event information: titles, dates, times, locations and descriptions you enter for invitations.
• Guest information: names, emails and details you add to guest lists or that guests submit via RSVP forms.
• RSVP responses: attendance status, guest counts, meal choices, allergies and notes submitted by your guests.
• Uploaded images: photos you upload for invitation designs and event pages.
• Uploaded videos: video content you upload to event pages.
• Voice recordings: audio messages you record and upload for event pages.
• Device & connection data: IP address, browser type, device type and usage logs collected automatically.
• Cookies & similar technologies: see our Cookie Policy.

We process your data to:

• Create and manage your account and authenticate you;
• Build, host and display your invitations and event pages;
• Enable QR activation and public URLs for your events;
• Collect and display RSVP responses from your guests;
• Process payments and activation through Stripe;
• Provide support and communicate about your account;
• Improve, secure and analyze the service.

We rely on the following legal bases under Article 6 GDPR:

• Consent — for cookies, marketing and optional features you enable;
• Contract — to deliver the service you requested (account, invitations, hosting);
• Legal obligation — where we must keep records or respond to lawful requests;
• Legitimate interests — for security, fraud prevention and service improvement, balanced against your rights.

We keep your data only as long as necessary:

• Account data: while your account is active, and up to 30 days after deletion to allow recovery.
• Invitation projects & media: while your subscription is active, plus a short grace period; deleted when you delete the project or account.
• RSVP data: linked to the project; deleted when the project is deleted or its retention period ends.
• Billing records: kept for the period required by tax/accounting law (up to 7 years), with minimal personal data.
• Server & security logs: up to 12 months.

We protect your data with industry-standard measures: encrypted transmission (HTTPS/TLS), hashed passwords, access controls, and isolated storage. Uploaded media is stored in access-controlled object storage.

While no system is perfectly secure, we apply reasonable technical and organizational measures and respond promptly to security incidents.

Payments are handled by Stripe, which processes your card and payment data as an independent controller under its own privacy policy. We receive only the information Stripe returns (such as a transaction reference and payment status), not your full card details.

If you sign in with Google, we receive the name and email address Google shares with us. We do not access your Google account beyond what is needed for sign-in. Google processes that authentication under its own terms.

We use privacy-respecting analytics to understand usage and improve the service. Analytics runs only with your consent (see the cookie banner) and may be configured to operate without cookies or with anonymized data.

We use cookies for authentication, preferences and (with consent) analytics. See our Cookie Policy for the full breakdown and your choices.

Under the GDPR you have the following rights:

• Right of access — request a copy of your personal data;
• Right to rectification — correct inaccurate or incomplete data;
• Right to erasure ("right to be forgotten") — request deletion of your data;
• Right to data portability — receive your data in a structured, machine-readable format;
• Right to restriction — limit how we process your data in certain cases;
• Right to object — object to processing based on legitimate interests or for marketing.

You can exercise several of these rights directly in My Profile. For any request, email info@invitorio.com — we respond within one month.

Some processors (such as cloud and email providers) may operate outside the EU. We only transfer data under appropriate safeguards, such as Standard Contractual Clauses, and minimize what is transferred.

Invitorio is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child provided data, contact us to delete it.

For privacy questions or to exercise your rights, contact info@invitorio.com. You may also lodge a complaint with the Cyprus Data Protection Commissioner.