Privacy policy

Who we are

Wonderful Invites is run by David Kahale, a sole trader in Sydney, Australia. We handle personal information under the Australian Privacy Principles in the Privacy Act 1988. For any privacy question, email hello@wonderfulinvites.com.

What we collect

From you, the host

• Your email address, when you sign in with Google or with a code we email you. We use it for your account, your receipts and messages about your invitation.
• Your invitation: the names, date, venue, wording, design choices, and any music file you upload.
• Your guest list: your guests’ names, and their email addresses or phone numbers if you add them so we can send their invitation.
• Payment details are handled by Stripe. We see that you paid, the amount and your country, but never your card number.

From your guests

• Their replies: whether they’re coming, how many are coming, and any message they leave for you.
• Dietary requirements, if the invitation asks. These can reveal health or religious information, so they’re shown only to the host and used only to cater for the event.
• For Christmas invitations with Secret Santa, whether they’re taking part and who they’re matched with. Each guest sees only their own match.

Hosts: when you add your guests’ details, please make sure they’d expect to hear from you this way. We use their details only to deliver your invitation and collect their replies, never to market to them.

How we use it

To provide the service: to save and publish your invitation, send it to your guests, show you their replies, take payment, and answer your emails. We don’t use anyone’s information for advertising, and we don’t sell or rent it.

Who we share it with

We use a small number of service providers to run Wonderful Invites. Each handles information only to provide their service to us:

• Stripe: payments.
• Supabase: our database and sign-in, stored in Sydney, Australia.
• Vercel: hosting the website.
• Resend: sending emails (sign-in codes and invitations).
• Google: only if you choose to sign in with Google.
• OpenFreeMap: the map pictures on invitations (from OpenStreetMap data). A guest's browser loads them when it shows the venue map; no cookies are set.
• OpenStreetMap's search (Nominatim) and Photon: finding the venue's address on the map when you type it. Only the address is sent, from our server.

Some of these providers are based in, or process information in, other countries such as the United States. We choose providers that protect information to a standard comparable to the Australian Privacy Principles. We’ll also share information if the law requires it.

Cookies and tracking

We don’t use third-party analytics or advertising trackers. We use only cookies and storage the site needs to work:

• a sign-in cookie, so you stay signed in;
• a random identifier that remembers which device opened a Secret Santa match, so a guest can see theirs again;
• your browser’s own storage, to keep the design you’re working on before you sign in.

How long we keep it

We keep an invitation, its guest list and replies while the invitation is live, and for at least 12 months after the event, so you can look back at it. After that we may delete them. Halloween invitations and birthdays for ages 15 and over end earlier (see our terms), and we may delete them after they end. We keep payment records for as long as Australian tax law requires.

Your choices and rights

You can ask to see the information we hold about you, to correct it, or to delete it, by emailing hello@wonderfulinvites.com. Guests can ask the host, or ask us directly. We’ll respond within 30 days.

If you’re in the United Kingdom or the European Union, you have rights under the GDPR, and we respect them: access, correction, deletion, restriction, objection and portability. We process your information to provide the service you asked for (performing our contract with the host) and, for guests, in the host’s and our legitimate interest in running their event.

If you’re not happy with how we’ve handled your information, please tell us first. You can also complain to the Office of the Australian Information Commissioner (oaic.gov.au), or to your local data protection authority.

Security

Information is sent over encrypted connections and stored with providers that encrypt it at rest. Access is limited to what’s needed to run the service. Each guest’s link is personal, so please only share it with that guest.

Children

Accounts are for adults. A child’s birthday invitation is set up by a parent or carer, who chooses what goes on it and who it’s sent to.

Changes

If we change how we handle information, we’ll update this page and the date at the top.