Privacy notice

1. Who is responsible

For hosts (people who order) and visitors of belovedinvites.com: Theodoxia LLC (a Delaware limited liability company, United States), hello@belovedinvites.com, is the controller.

For guests of an invitation: the hosts who invited you decide what is asked and are the controllers. We process your reply for them, as their processor.

2. What we collect from hosts

• Your order: names, event date, time and address, the sections and text you write, photos and videos you upload, your guest list.
• Contact details: email, and phone if you give it.
• Payment: handled by Stripe. We see the amount, the country and the last four digits, never your full card number.
• Your login (an email link, no password) and, if you allow them, push notifications.

Why: to make, deliver and host your invitation (our contract with you), and to keep accounts and tax records (legal obligation).

3. What we collect from guests

• Your name as the hosts wrote it, whether you are coming and for how many, and anything you choose to add: a message, a song, food allergies or diet, an email or phone number so the hosts can reach you.
• That you opened the invitation, with the country and city from your connection (never your IP address), the device type and the language. No cookies.

Allergies and diet are health information. Only the hosts see them, we use them only to pass them to the hosts, and we delete them when the invitation closes.

The name search on an invitation only finds a whole first name and shows names, never anyone’s email, phone or answers.

4. Visitors of belovedinvites.com

We count visits with Vercel Web Analytics and measure page speed with Vercel Speed Insights. Neither uses cookies or stores IP addresses. Only if you accept on the banner do we use product analytics (Amplitude) to see where people get stuck in the order builder. We set small cookies for your language, currency, a draft order and any referral code you followed.

5. Who processes data for us

• Vercel Inc. (hosting, analytics), USA and EU (Frankfurt).
• Supabase Inc. (database and login), stored in the EU (Frankfurt).
• Cloudflare Inc. (domain, email forwarding, photo storage R2).
• Resend Inc. (sending emails).
• Stripe Payments Europe Ltd. / Stripe Inc. (payments).
• Anthropic PBC and image-generation providers (to write your page and paint your photos; used only to make your invitation).
• Amplitude Inc. (only with your consent).

Some of these are in the United States. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s standard contractual clauses.

6. How long we keep it

• Guests’ replies and visits: deleted 90 days after the invitation closes; allergies and diet as soon as it closes.
• Your invitation, photos and paintings: deleted 90 days after it closes, unless you keep it online longer.
• Orders and payment records: 10 years (tax law).

7. Your rights

You may ask to see, correct, download or delete your data, or object to how we use it, by writing to hello@belovedinvites.com. Guests can also ask the hosts. If you are in the EU or the UK you may complain to your data protection authority (in Denmark: Datatilsynet).

8. Security

Guests’ data can only be read by the server and by the hosts of that invitation (checked in the database itself). Photos are stored privately and shared through short-lived links. Logins use one-time email links.

9. Data processing terms for hosts

When we process guests’ data for you, we: act only on your instructions (running your invitation), keep it confidential, protect it, use only the providers listed above, help you answer guests’ requests, tell you without delay about any breach, and delete it as described. You confirm that you may invite your guests and ask them what you ask.

10. Changes

If we change this notice, we will update the date above, and tell hosts by email when the change matters.