Privacy Policy

InviteCardAI helps you generate invitation cards and collect RSVPs. This policy explains what data we collect, why we collect it, who we share it with, and the rights you have over your data. We collect the minimum we need to deliver the product.

• Account data: Your email address when you sign up. We use this to authenticate you and to send transactional emails.
• Event details: The information you enter when creating a card — event type, date, time, location, the name of the person being celebrated, and any style description.
• Generated content: The AI-generated card images we store on your behalf so you can download or print them later, including free previews you haven’t kept yet.
• Free-preview count: To limit free previews per person, we keep a count of how many previews you’ve made against a one-way keyed hash of your email address — not the address itself, and it can’t be turned back into it. The count stays if you delete your account, so the free previews can’t be reset that way. We also keep a record of each preview (the same hash, your account, and the time) for 2 days, to cap the number of free previews made across the site each day. We rely on our legitimate interest in preventing abuse of a free service.
• Guest RSVP responses: When guests respond to an RSVP page, we collect their name, response (yes/no/maybe), optional email, and a guest count (additional adults, and children for family events). The guest’s name, response, guest count, and email (if provided) are shared with the event host so they can plan and, if needed, contact the guest.
• Payment metadata: For paid features we store Stripe identifiers (customer ID, payment intent ID, checkout session ID). We never store card numbers, CVVs, or cardholder data.

We rely on a small number of trusted providers to deliver the product. Each one receives only the data needed for their role.

• Anthropic: Receives your sanitized event prompt to enhance it for image generation. Anthropic does not train on API data.
• OpenAI: Receives the enhanced prompt to generate the background image. OpenAI does not train on API data.
• Supabase: Hosts our database, authentication, and image storage.
• Stripe: Processes payments. Receives your email and payment details. PCI-DSS compliant.
• Resend: Transactional email provider on standby for future notifications.
• Google Analytics: Records anonymous page-view and event data, only after you accept cookies.
• Vercel: Hosts and serves the app. Sees all incoming traffic at the network layer. Also measures page-load speed (Speed Insights): load timings, the page visited, and your device and browser type, with no cookies and no identifier.

We use a small number of cookies, in three groups:

• Signing you in (always on): Your Supabase session cookie keeps you logged in as you move between pages. Without it the site cannot tell who you are, so it is strictly necessary and is not subject to consent.
• Taking payment (only if you start a purchase): When you open the checkout window, Stripe loads its payment form and sets its own cookies (__stripe_mid, __stripe_sid) to process the payment and detect fraud. They are set at that point and not before — browsing the site without buying anything never loads Stripe.
• Analytics (only if you accept): Google Analytics records anonymous page views and events. It is loaded only after you click “Accept” on the cookie banner. Choose “Reject”, or ignore the banner entirely, and Google Analytics is never loaded and sets nothing at all.

You can change your analytics choice at any time using the Cookie settings link in the footer of every page.

• Cards: Hard-deleted 90 days after your event date — the card and its images are permanently removed, so download anything you want to keep before then. Your dashboard shows each card’s date. Deleted within 24 hours if you delete the card yourself.
• Free previews: A preview you don’t keep is hard-deleted about 30 days after you make it, or right away if you discard it.
• RSVP pages & guest responses: Hard-deleted 30 days after the event date.
• Account: Kept for as long as your account is active. Deleted within 24 hours of you deleting your account.

• Access & export: Download all of your data — cards, RSVPs, and guest responses — as a ZIP from your settings page.
• Deletion: Delete your account from settings. We hard-delete your cards, card images, RSVP pages, and guest responses immediately.
• Changing a response: To change or cancel a response, guests contact the event host, who can update or remove it. All guest responses are deleted 30 days after the event.
• Regional rights: EU and California residents have additional rights under GDPR and CCPA — including the right to object, restrict processing, and lodge complaints with a supervisory authority. Contact us to exercise any of these.

InviteCardAI is not directed at children under 13. We require account holders to confirm they are 13 or older at signup. If you believe a child has provided data, contact us and we will delete it.

All API keys live in server-side environment variables. Third-party API calls are made only from our servers. Payments are processed with Stripe's hosted checkout — your card details never touch our infrastructure.

For privacy questions, data export requests, or to exercise any right under GDPR or CCPA, email us at support@invitecardai.com.