Privacy Policy

If you have an account: you signed up, or someone invited you to their organization, we are the data controller for your account data.

If you are a guest who received an invitation, the company that invited you is the controller of your data. We process it on their behalf. To have your details corrected or removed, ask them, or ask us and we will pass it on.

• Name, email address, phone number and password (hashed, never stored in plain text)
• Your company name, country and timezone
• Sign-in records: time, IP address and browser, so you can see where your account is signed in
• What you do in the product, recorded in an audit log
• Billing details and payment records

• Name, and phone number or email address, as uploaded by the company inviting them
• RSVP response, party size, meal preference and any note left
• Whether an invitation was opened, and when
• Check-in time and gate, if they attend
• Whether they have opted out of messages

A guest's QR code contains a random token and nothing else. It carries no name, no phone number and no event details, so a photograph of an invitation does not expose personal data.

To provide the service you asked for: delivering invitations, collecting RSVPs, admitting guests, taking payment, and keeping the platform secure. We do not sell personal data, and we do not use guest data for our own marketing.

Providers who help us run the service: hosting, SMS and WhatsApp delivery, email delivery, and payment processing. Each receives only what it needs to do its job, a messaging provider gets a phone number and a message, not the guest list.

Guest data is kept for as long as the company that uploaded it keeps it, and is deleted when they delete the guest, the event or their account.

Account data is deleted 30 days after cancellation, and purged from backups within a further 90 days. Invoices and payment records are kept as long as tax law requires.

You can ask for a copy of your data, ask us to correct it, or ask us to delete it. Account holders can do most of this from Settings; for anything else, email us.

Guests can opt out of messages from the link in any message they receive, or from the footer of their invitation.

Traffic is encrypted in transit. Passwords are hashed with argon2id. Invitation links, API keys and session tokens are stored hashed, never in plain text. Each company's data is isolated from every other company's at the database level, and that isolation is verified by an automated test before every release.

Privacy questions or requests: privacy@kadichap.com.