Privacy Policy
Last updated: 10 November 2026
1. Who we are
Envite is an online service for creating children's party invitations, collecting replies and sharing gift lists. Envite is operated by [Business name], [postal address, Ireland] ("Envite", "we", "us"). We are the data controller for the personal data described in this policy.
For anything to do with your personal data, contact us at contact@envite.ie. We aim to reply within 5 working days and will always respond within one month, as the law requires.
2. The short version
- We only collect what is needed to run an invitation: who's coming, how many, any allergies, and who's bringing which gift.
- Guests don't need an account. A guest's reply is shared only with the host of that party, and only with the guest's consent.
- Everything about a party, including all replies, is deleted automatically 7 days after the party. Allergy info is deleted the day after the party.
- Our database is hosted in Ireland. We don't sell data, we don't show ads and we don't use tracking or analytics cookies.
- We never see or store card numbers. Payments are handled by Stripe.
3. What we collect
If you create an invitation ("host")
- Account details: your email address, used to sign you in with a one-time link.
- Party details you enter: your child's first name and age, whether it's a birthday girl or boy, the party date, time and venue, address and Eircode, your name and mobile number, your message to guests, food notes and your gift list.
- Payment information: the plan you chose, the amount and whether the payment succeeded. Card details are entered directly with Stripe and never reach us.
If you reply to an invitation ("guest")
- The name(s) you give (for example "The Murphys" or "Seán & his mam").
- Whether you're coming, and how many children and adults.
- Any allergies you tick from a fixed list (for example "Peanuts" or "Dairy"). There is no free-text field, so no medical details are collected (see section 5).
- Which gift you're bringing, if you choose one, and the name you give when reserving it.
- A random identifier stored in your browser so you can change your reply later (see section 11).
Technical information
When you use the website, our hosting and security providers process technical data such as your IP address, browser type and the time of the request. This is needed to deliver the website and to protect it from abuse. We don't use it to profile you.
4. Why we use it and our legal basis
| What we do | Legal basis under the GDPR |
|---|---|
| Create and run a host's account and invitations, show the host their replies, and provide the plan they paid for | Performance of a contract with the host (Article 6(1)(b)) |
| Record a guest's reply and share it with the host | The guest's consent, given in the reply form (Article 6(1)(a)) |
| Record allergy or dietary information | The guest's explicit consent (Article 9(2)(a)); see section 5 |
| Process payments and keep accounting records | Contract (Article 6(1)(b)) and our legal obligations under Irish tax law (Article 6(1)(c)) |
| Keep the service secure, prevent spam and fraud, and fix problems | Our legitimate interest in running a safe, reliable service (Article 6(1)(f)) |
| Send service emails, such as sign-in links | Performance of a contract with the host (Article 6(1)(b)) |
We don't send marketing emails. If we ever do, we will only do so with your separate consent, and you'll be able to unsubscribe at any time.
5. Allergy and dietary information
Information about allergies, intolerances or medical dietary needs (for example a nut allergy or coeliac disease) is health data, a special category of personal data under Article 9 of the GDPR. We treat it with extra care:
- It is completely optional. Only add it if you want the host to know, for example to keep a child safe at the party.
- We keep as little as possible: you can only tick allergies from a short fixed list (tree nuts, peanuts, egg, dairy, gluten, sesame, or "something else"). There is no free-text box, so no medical details, diagnoses or children's names are stored with it. For anything more, please talk to the host directly.
- We only record it after you tick the consent box in the reply form, and we use it for one purpose only: to show it to the host of that party.
- The host only sees totals (for example "Dairy: 2 families"), never which guest ticked what. Totals always include every reply, even on a plan that hides some guests' names, so that no child is put at risk.
- It is deleted automatically the day after the party, as it is no longer needed once the party has happened.
- You can withdraw your consent at any time by changing your reply and unticking the allergies, or by contacting us. This doesn't affect anything already shared.
6. Children
Envite is designed for parents and guardians. We don't knowingly allow children to create accounts or reply to invitations themselves.
An invitation will usually include a child's first name and age, and replies may include the names of children coming. This information is provided by the parent or guardian, who should only share what they are comfortable with. We use it only to run that invitation, never for marketing or profiling, and it is deleted automatically after the party.
If you believe a child has given us personal data directly, please contact us and we will delete it.
7. Who can see your information
- The host sees the replies to their own party: names, numbers and gift choices, plus allergy totals that aren't linked to any name. Depending on the plan, some guests' names may be hidden until the host upgrades.
- Other guests see the party details the host published, and whether each gift is still available. They never see other guests' names, replies, notes or who reserved a gift.
- Anyone with the invitation link can see the party details the host entered, such as the venue and the host's contact details. Hosts should only share the link with people they're inviting.
- Anyone with the host's private host link can see that party's replies. Hosts should keep that link private.
- Our service providers (section 8) process data on our behalf, only under our instructions.
- We may disclose information where Irish or EU law requires us to, for example to An Garda Síochána with a valid legal request.
We don't sell or rent personal data, and we don't share it with advertisers.
8. Our service providers
We use a small number of trusted providers. Each processes personal data on our behalf under a data processing agreement, as required by Article 28 of the GDPR.
| Provider | What they do | Where |
|---|---|---|
| Supabase, Inc. | Database and sign-in system that stores invitations, replies and accounts | Data stored in Ireland (AWS eu-west-1, Dublin) |
| Cloudflare, Inc. | Delivers the website quickly and protects it from attacks. It processes technical data but doesn't store your party data | Global network, with EU locations used for EU visitors |
| Stripe Payments Europe, Ltd. | Processes card payments. Stripe is also an independent controller for its own legal and anti-fraud obligations | Ireland / EU |
| Resend, Inc. | Sends sign-in links and service emails | EU or US (see section 9) |
9. Where your data is stored
Our database, which holds all invitation, reply and account data, is hosted in Ireland.
Some of our providers are US companies, and limited data (such as technical data, or your email address when we send you a sign-in link) may be processed outside the European Economic Area. When that happens, we make sure it is protected by an approved safeguard: the provider's certification under the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses. You can ask us for more information about these safeguards.
10. How long we keep it
| Data | How long |
|---|---|
| Allergy information | Deleted automatically the day after the party |
| Invitations, replies and gift reservations | Deleted automatically 7 days after the party date (or 60 days after creation if no date was set). Hosts can delete a party at any time, which deletes it immediately. |
| Host account (email address) | Until you ask us to delete your account |
| Payment records | 6 years, as required by Irish tax law. These records don't include guest details or allergy notes. |
| Technical and security logs | Our security log (which can include IP addresses) is kept for 7 days and security alerts for 90 days. Our providers keep their own technical logs briefly, normally no longer than 30 days |
| Backups | Deleted data can remain in encrypted backups for a short time (normally up to 7 days) before it is overwritten |
11. Cookies and browser storage
We don't use advertising, analytics or tracking cookies, so we don't show a cookie banner. We use only the browser storage that is strictly necessary for the service to work:
| Item | Purpose | How long |
|---|---|---|
| Sign-in session | Keeps a host signed in | Until you sign out |
| Guest identifier | A random code that lets a guest see and change their own reply, without an account | Until you clear your browser data |
| Saved host links | Remembers parties you manage on this device, so you can find them again | Until you sign out or clear your browser data |
| Your name | Pre-fills your name the next time you reply | Until you clear your browser data |
Fonts and all website files are served from our own site, so loading a page doesn't send your data to font or ad providers.
12. How we protect it
- All connections use encryption (HTTPS).
- The database applies strict access rules. Guests can only reach their own reply, and hosts can only reach their own parties.
- Invitation links and host links use long random codes that can't realistically be guessed.
- We keep as little data as possible, and delete it automatically after each party.
- Access to our systems is limited and protected with two-factor authentication.
If a personal data breach happens that is likely to put you at risk, we will tell the Data Protection Commission within 72 hours and, where required, tell you without undue delay.
13. Your rights
Under the GDPR you have the right to:
- Access: get a copy of the personal data we hold about you.
- Rectification: correct inaccurate data. Guests can update their reply at any time, and hosts can edit their party.
- Erasure: ask us to delete your data. Hosts can delete a party themselves at any time.
- Restriction: ask us to limit how we use your data.
- Portability: receive data you gave us in a commonly used format.
- Objection: object to processing based on our legitimate interests.
- Withdraw consent at any time, without affecting processing that has already happened.
Because guests don't have accounts, we may ask a guest to confirm their reply link, or other details, so we can find their reply and make sure we're acting for the right person. Email contact@envite.ie to use any of these rights. It's free, and we'll respond within one month.
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
14. Complaints
If you're unhappy with how we've handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Irish supervisory authority:
Data Protection Commission
21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
www.dataprotection.ie
If you live in another EU country, you can also complain to the data protection authority there.
15. Changes to this policy
We may update this policy, for example when we add a new feature or provider. We'll change the "last updated" date above and, for significant changes, tell hosts by email or on the website before the change takes effect.