Privacy Policy
Invely is a digital invitation and event management platform for weddings and other events in Indonesia. This policy explains what personal information we collect, why we collect it, who we share it with, and what you can ask us to do with it.
1. Who We Are
Invely is operated by an independent individual operator based in Indonesia. Invely is not yet registered as a limited liability company, and we do not claim otherwise. The operator is responsible for the service and for the handling of personal data described in this policy.
Website: https://invely.id
Contact: middleearthdev@gmail.com
This policy covers the Invely marketing site (invely.id), the Invely dashboard where accounts are created and invitations are managed, the published invitation pages we serve on behalf of our users, and the guest check-in application used by event staff.
2. Information We Collect
Account information
When you create an Invely account we collect your name, email address, and a password. Passwords are stored only as a cryptographic hash, never in readable form. You may optionally add a phone number and a profile picture. We also store your account role (for example customer, vendor, or staff) and whether your email has been verified.
Google account information
If you choose to sign in with Google, we receive basic profile information from Google. This is described in detail in section 3.
Vendor and business information
If you use Invely as a vendor or wedding organizer, we also collect your business name, description, logo, address, city, and website, so that these can appear to your own clients.
Invitation content
We store the content you put into your invitation: names, event dates, venues and addresses, your story text, gift and contact details you choose to display, and the photos, videos, and music you upload or select. Uploaded files are stored in our object storage.
When you upload an audio file, we also record who uploaded it, when, the file's cryptographic fingerprint (SHA-256), the version and text of the rights declaration you accepted, and the IP address and browser used at that moment. This is our audit trail for copyright complaints (see our Terms), and it is kept even if the file or the invitation is later removed.
Guest information you provide
If you use the guest features, we store the guest list you enter or import: guest name, optional email address and phone number, salutation, group size, seating or table notes, guest tier, invitation session, and internal notes. Each guest is issued a unique invitation token so that a personal link and, where the plan includes it, a check-in QR code can be generated. We also record when a personal link is opened and when a WhatsApp message was marked as sent.
RSVP and guestbook
When a guest responds to an invitation, we store their name, their attendance answer, the number of people attending, the events or sessions they selected, and any message they wrote. The invitation form does not ask guests for an email address or phone number.
Check-in records
For events using Smart Event check-in, we store the time of check-in, the number of people checked in, the scanning method, basic device information from the scanning device, and which staff account performed the scan.
Technical and usage information
For security purposes, each sign-in session records an IP address and browser user agent. For published invitation pages we record simple usage events such as page views, RSVP submissions, and music playback, together with the browser user agent and the referring page. We do not store visitor IP addresses for invitation page analytics.
Payment information
When you purchase an invitation or vendor credits, we store the amount, description, payment status, payment method, and the transaction identifier issued by our payment provider. We never receive or store card numbers, CVV codes, or banking credentials — those are handled entirely by the payment provider. Orders placed through WhatsApp are recorded as a pending transaction until they are confirmed by us.
Pre-launch waitlist
Before launch, visitors could leave an email address to be notified. For those who did, we hold only that address and the date it was submitted.
3. Google User Data
Invely offers Sign in with Google as an optional way to create and access your account. When you use it, we request only the basic sign-in scopes openid, email, and profile. From these, Google provides us with:
- your name;
- your email address and whether Google has verified it;
- your profile picture, if your Google account has one;
- your Google account identifier, which we store so that we can recognise the same Google account on your next sign-in.
We use this information only to:
- create your Invely account and authenticate you when you sign in;
- identify your account and link it to the invitations you own or manage;
- display your name and picture to you inside your own dashboard;
- contact you about your account, your orders, and the service itself.
We also store the authentication tokens Google issues during sign-in. They are used solely to complete and maintain the sign-in process, and are not used to read any other Google service on your behalf. We do not request access to Gmail, Google Drive, Google Calendar, Google Contacts, or any other Google product.
Invely does not use Google user data for advertising, does not sell Google user data, does not transfer Google user data to third parties except to the service providers listed in section 6 that are strictly necessary to operate Invely, and does not use Google user data to build profiles or for any purpose other than providing and improving the Invely service.
Invely's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect Invely from your Google account at any time at myaccount.google.com/permissions. Doing so stops future sign-ins through Google; it does not by itself delete the Invely account you already created. To have that data deleted, see section 10.
4. How We Use Information
We use the information described above to:
- create, authenticate, and maintain your account;
- build, publish, and serve your invitation pages to the guests you invite;
- collect RSVP answers and guestbook messages on your behalf;
- run guest check-in and show arrival information to the event organizer;
- process your orders and record payment status;
- send transactional email such as email verification, password reset, and order or approval notices;
- respond to your support requests;
- detect and prevent abuse, fraud, and unauthorised access, and keep the service working;
- show the invitation owner aggregate statistics about their own invitation, such as how many times it was opened.
We process this information because it is necessary to provide the service you asked for, because you consented (for example by joining the waitlist or uploading a guest list), or because we have to keep records of transactions. Where Indonesian Law No. 27 of 2022 on Personal Data Protection applies, we act on those legal bases.
5. Guest Data and Our Role
Guest lists belong to the person or business that created the invitation. When a couple or a vendor uploads a guest list to Invely, they decide what is collected and why; Invely processes that data on their instructions in order to deliver the invitation, record RSVPs, and run check-in. We do not use guest lists for our own marketing, and we do not contact guests for any purpose of our own.
If you are a guest and want your details corrected or removed, the fastest route is to ask the person who invited you. You may also write to us at middleearthdev@gmail.com and we will pass the request on or act on it where we are able to.
If you upload a guest list, you are responsible for having a lawful reason to share those details with us.
7. Published Invitation Pages
An invitation you publish is served on the public internet. Anyone who has the link for a named guest can open that invitation and read what you put on it, so treat invitation content as information you are comfortable showing your guests.
Two things limit this by design: a bare invitation address without a guest link does not open, and invitation pages are marked so that search engines do not index them. We do not list invitation pages in our sitemap.
8. Storage and Security
Account and application data is stored in our own PostgreSQL database running on servers we control. Uploaded files are stored in Cloudflare R2 object storage. Traffic between your browser and Invely is encrypted with HTTPS, passwords are stored only as hashes, and access to production systems is limited to the operator.
We take reasonable technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure, or destruction. No online service can promise perfect security, and we do not claim to. If a breach affects your personal data, we will notify you as required by applicable law.
9. Data Retention
We keep account information for as long as your account exists, and transaction records for as long as we need them for accounting and legal purposes.
Invitations are active for six months from the date they are created. After that the invitation page stops being available to guests and to its owner, and its address may be reused. Guest lists, RSVP answers, and uploaded files linked to an expired invitation remain in our systems until they are deleted by our clean-up process or at your request.
Audio upload records — uploader, time, file fingerprint, rights declaration, IP address — are retained after the file or the account is deleted, because they are the evidence we rely on if a rights holder later raises a complaint.
Pre-launch waitlist addresses are kept only until we have sent the launch notice, or until you ask us to remove them.
10. Your Rights
Under Indonesian Law No. 27 of 2022 on Personal Data Protection, and as a matter of our own practice, you may ask us to:
- confirm what personal data of yours we hold, and give you a copy;
- correct data that is wrong or out of date;
- delete your account and the personal data associated with it;
- withdraw a consent you previously gave, such as the pre-launch waitlist;
- explain how a particular piece of your data is being used.
Invely does not yet have a self-service delete button. To delete your account, email middleearthdev@gmail.com from the address on the account, with the word "delete" in the subject. We will confirm and carry out the deletion within 30 days, except for records we are required to keep, such as completed transactions.
11. Children
Invely is intended for adults planning and attending events. We do not knowingly create accounts for children. If you believe a child has provided us with personal data, please contact us and we will remove it.
12. Changes to This Policy
We will update this policy as Invely adds features or changes the way data is handled. The date at the top always reflects the most recent revision, and the current version is always published at this address. If a change materially affects how we use your personal data, we will notify account holders by email before it takes effect.
13. Contact Us
For any question, request, or complaint about privacy and personal data, write to:
Email: middleearthdev@gmail.com
Website: https://invely.id