1. Statutory Commitment & Overview
InviteCraft provides an online software platform that enables couples and hosts ("Hosts" or "Users") to create, customize, preview, and publish digital wedding invitation websites with interactive RSVP tracking.
We are committed to upholding the highest standards of data privacy, integrity, and security in compliance with India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000. This Privacy Policy explains the specific categories of digital personal data we process, the lawful purposes for processing, the technical safeguards we maintain to prevent unauthorized access or breach, and your statutory rights as a Data Principal.
2. Roles Under the DPDP Act
Depending on how you interact with InviteCraft, our role under the DPDP Act is defined as follows:
- For Account & Billing Data: InviteCraft acts as a Data Fiduciary in relation to your personal registration details (name, email address, account credentials, and transaction records).
- For Wedding Guest RSVP Data: The Host (the couple or family organizing the wedding) is the primary Data Fiduciary who decides to collect guest attendance details. InviteCraft acts strictly as a Data Processor operating on the Host's authorization, providing the secure infrastructure to collect RSVP responses into the Host's private dashboard.
3. Information We Collect and Lawful Purpose
A. Account and Profile Information
When you register on InviteCraft, we collect your name, email address, and an encrypted, salted password hash. Purpose: To authenticate your identity, secure your account from unauthorized access, enable access to your invitation projects, and transmit essential transactional communications (such as verification codes, receipts and publishing notices).
B. Wedding Invitation Content & Media
When designing an invitation, you provide couple names, family details, event schedules, venue addresses, love story narratives, photos, audio tracks, and video clips. Purpose: To render your interactive preview editor and publish your public invitation website as directed by you. Uploaded media is stored in cloud storage and namespaced strictly to your user account.
C. Guest RSVP Data — Purpose Limitation & Zero-Marketing Guarantee
If a Host enables RSVP on their wedding website, attending guests may submit their names, attendance confirmation, guest count, dietary preferences, and optional well-wishes.
- Guest RSVP information is used strictly and exclusively for the Host's wedding coordination.
- We never sell, rent, monetize, or trade guest contact numbers or names to third parties.
- We never market, spam, or advertise wedding vendor services to your guests.
- Guest RSVP records are visible only in the Host's private dashboard and are never accessible to other platform users.
D. Payment and Transaction Details
Purchases of credits are processed directly through our secure payment gateway partner, Razorpay, complying with PCI-DSS standards. InviteCraft receives and stores only non-sensitive transaction receipts (transaction ID, payment status, amount, and timestamp). We never store credit card numbers, debit card details, or CVVs on our servers.
E. Technical & Diagnostic Logs
Standard technical logs (IP address, device/browser metadata, timestamps, and route requests) are recorded temporarily solely for cybersecurity monitoring, rate-limiting against automated attacks, and service reliability.
4. Technical & Organizational Security Safeguards
In accordance with Section 8(5) of the DPDP Act (which mandates reasonable security safeguards to prevent personal data breaches), InviteCraft enforces strict multi-layered technical protections:
- Encrypted Transmission: All web traffic, API requests, and data in transit are strictly encrypted using modern TLS/HTTPS (TLS 1.2 and TLS 1.3).
- Strict Multi-Tenant Authorization (IDOR Protection): Every authenticated database operation (viewing, editing, publishing, or deleting projects) enforces verified session ownership. No user can view, inspect, or modify another Host's project or RSVP details by manipulating IDs or URL parameters.
- Password Security & Lockout: Passwords are irreversibly hashed using industry-standard salted algorithms. Automated rate-limiting protects against credential stuffing and brute-force attacks.
- Content Sanitization: All user-entered text is filtered and sanitized against malicious script injections (XSS protection) before storage or publishing.
- Cloud Media Isolation: Uploaded media assets are partitioned into account-specific namespaces with verified ownership checks on all deletion endpoints.
5. Sharing with Trusted Infrastructure Providers
We do not sell personal data. We share data only with trusted technical infrastructure providers bound by strict confidentiality and security obligations:
- Cloud storage: Encrypted object storage for user-uploaded wedding photos, audio, and videos.
- Razorpay: Payment processing and invoice generation.
- Hosting providers: Infrastructure for the platform and published invitations.
- Transactional email services: Delivering essential account notifications, verification codes and receipts.
6. Data Retention & Permanent Erasure
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or to comply with statutory legal and tax requirements.
Hosts may delete any of their projects directly from their account dashboard at any time. Initiating project deletion triggers cleanup of the associated database records and uploaded media. If you wish to delete your entire account and all associated personal data, you may submit an erasure request to our Grievance Officer.
7. Your Statutory Rights as a Data Principal
Under the DPDP Act, 2023, you have the following rights regarding your digital personal data:
- Right to Access: You have the right to request a summary of the personal data we process about you and the processing activities undertaken.
- Right to Correction & Updating: You can edit and correct your account profile and wedding invitation content at any time via your project editor.
- Right to Erasure (Right to be Forgotten): You may request the permanent deletion of your account and personal data, subject to retention required by applicable tax or financial regulations.
- Right to Grievance Redressal: You have the right to register grievances regarding the processing of your personal data with our designated Grievance Officer.
- Right to Nominate: You have the right to nominate an individual who, in the event of death or incapacity, shall exercise your data rights.
8. Grievance Redressal Officer (DPDP Act Compliance)
In accordance with Section 8(9) of the Digital Personal Data Protection Act, 2023, InviteCraft has appointed a designated Grievance Officer to address any questions, feedback, or complaints regarding personal data privacy and security.
Grievance & Data Protection Officer
Entity: InviteCraft
Email: privacy@invitecraft.in (cc: hello@invitecraft.in)
Response Timelines: Acknowledgment within 48 hours; substantive resolution within 7 to 14 business days.
If you are unsatisfied with the resolution of your grievance, you have the right to escalate the matter to the Data Protection Board of India.
9. Updates to this Policy
We may update this Privacy Policy periodically to reflect enhancements to our security architecture, service capabilities, or regulatory directives under the DPDP Act. When material changes are made, we will update the "Last updated" date at the top of this page and notify active account holders via email where appropriate.