Privacy Policy

Effective: June 20, 2026  ·  Last updated: June 20, 2026

UR Invited ("we," "our," or "us") helps people create animated invitation websites for life's celebrations. We take privacy seriously — the data you trust us with is yours, and we use it only to make your invitation work. This policy explains what we collect, how we use it, and the choices you have.

1. Who we are

UR Invited is operated from Los Angeles, California. The service is available at urinvited.store. If you have questions about this policy or your data, email us at hello@urinvited.store.

2. What we collect

Information you give us

• Account info: email address and a password (stored as a one-way bcrypt hash — we never see the plaintext).
• Invitation content: the names, dates, venues, photos, and messages you add to your invitations. This is the content of your invitation — by design it's intended to be shared with the guests you choose.
• Guest information you enter: if you add guest names or emails to your guest list, we store them so we can power your RSVPs.
• Payment info: when we accept paid orders, payment is processed by a third-party processor (Stripe). We never see or store your full card number — only the last four digits and a token used for receipts.
• Support correspondence: if you email us, we keep the message so we can help and follow up.

Information collected automatically

• Log data: IP address, browser type, referring page, and timestamps — used to keep the service running and secure.
• Device info: screen size and operating system, used to render the site properly.
• Essential cookies: a session cookie that keeps you signed in. See Cookies below.

Information from your guests

• RSVPs: when a guest opens your invitation and responds, we store their name, RSVP status, guest count, and any message they leave. We share this back with you, the host.
• Page views: we count how many times an invitation has been opened, so hosts can see their reach.

3. How we use it

We use your data only to:

• Create, display, and deliver the invitation you designed.
• Show you who has RSVP'd and let you message your guests.
• Process payments and send receipts.
• Send transactional emails — account confirmations, password resets, RSVP notifications.
• Keep the service safe (spam prevention, abuse detection, fraud screening).
• Improve the product by understanding which templates and features are used.
• Comply with legal obligations.

We do not sell your personal information. We do not use your invitation content to train AI models. We do not run third-party advertising on the service.

4. When we share

We share data only with the parties that help us run the service:

• Hosting & infrastructure: Railway (application hosting) and Postgres database providers store your invitation data so the site can serve it.
• Email delivery: Resend sends transactional emails on our behalf (account, RSVP, receipt emails).
• Payments: Stripe processes payments and is the controller of card data.
• Legal: we will share data when required by law, valid legal process, or to protect the rights and safety of our users.
• Business transfers: if UR Invited is ever acquired or merged, your data may transfer with the business under the same protections in this policy.

Each provider above is contractually bound to protect your data and use it only to provide the service to us.

5. Cookies & tracking

We use a minimal set of cookies. There are no third-party advertising cookies and no cross-site tracking pixels.

• Session cookie — keeps you logged in. Expires when you sign out or after a period of inactivity.
• Preference storage — small bits of data in your browser's local storage to remember your draft invitation while you edit.

You can clear cookies and local storage at any time in your browser settings — note that this will sign you out and discard unsaved drafts.

6. Security

We protect data in transit (TLS / HTTPS everywhere), hash passwords with bcrypt, set strict security headers (HSTS, CSP, X-Frame-Options), and store payment info only with Stripe. No system is perfectly secure — if we ever discover a breach affecting your data, we'll notify you promptly and in accordance with applicable law.

7. How long we keep data

• Invitations & RSVPs: kept for as long as your account is active so you and your guests can revisit them. You can delete an invitation any time from your dashboard.
• Account data: kept while your account exists. Delete your account and we'll remove your personal data within 30 days, except where we're required to keep records for tax, accounting, or legal reasons.
• Payment receipts: retained for at least 7 years to comply with US tax law.
• Logs: rotated and purged within 90 days.

8. Your rights

No matter where you live, you can:

• Access the data we have about you.
• Correct inaccurate information.
• Delete your account and personal data.
• Export your invitations and guest list.
• Opt out of non-essential emails (transactional emails are required to run the service).

Email hello@urinvited.store and we'll respond within 30 days.

9. California residents (CCPA / CPRA)

If you live in California, you have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to opt out of "sale" or "sharing" of personal information for cross-context behavioral advertising. We do not sell or share personal information for advertising purposes. To exercise any right, email hello@urinvited.store. We will not discriminate against you for exercising your rights.

10. Europe & UK (GDPR)

If you are in the European Economic Area, the UK, or Switzerland, our lawful bases for processing are: performance of a contract (to deliver the service you signed up for), legitimate interest (to keep the service secure and improve it), consent (for any optional communications), and legal obligation (for tax and accounting). Data is transferred to the United States for processing under appropriate safeguards. You have the right to lodge a complaint with your local data-protection authority.

11. Children

UR Invited is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Baby shower invitations are created and managed by adult hosts. If you believe a child has provided us with personal information, please email hello@urinvited.store and we'll delete it.

12. Changes to this policy

We may update this policy as the product evolves or the law changes. When we do, we'll update the "Last updated" date at the top of this page. Material changes will be announced by email or with a visible notice on the site at least 14 days before they take effect.

13. Contact us