Privacy Policy

Welcome to CloudInvites. We respect your privacy and are committed to protecting it through our compliance with this policy. This Privacy Policy describes the types of information we may collect from you or that you may provide when you visit the website cloudinvites.wedding (our "Website") and our practices for collecting, using, maintaining, protecting, and disclosing that information.

Because our primary market is the Philippines, this Privacy Policy strictly adheres to the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations.

1. Data Controller vs. Processor Dynamics

How we classify your data depends on your relationship with us:

• Couples (Hosts): For individuals who create an account and purchase our services to host their wedding website, CloudInvites acts as the Personal Information Controller (PIC) for your account, billing, and profile data.
• Guests: For guest data (such as names, contact info, and RSVP responses) uploaded by the Couple or submitted directly by the Guest via the platform, the Couple is considered the PIC. In this scenario, CloudInvites acts strictly as the Personal Information Processor (PIP), processing data on behalf of the Couple.

2. Information We Collect

We collect several types of information from and about users of our Website, including:

• Account Details & Event Information: Names, email addresses, phone numbers, and wedding details provided during registration and onboarding.
• Guest Information: Names, contact details, and attendance status.
• Sensitive Personal Information: Our RSVP forms let a guest optionally record dietary restrictions or allergies, which may reveal health information. Providing it is voluntary — a guest can complete an RSVP without it — and it is used for the single purpose of meal planning and catering for that wedding. The couple hosting the wedding determines that this is collected and is the PIC for it; we process it on their behalf and do not use it for any other purpose.
• Payment Information: Processed securely via our third-party payment gateway. We do not store raw credit card numbers or e-wallet credentials.
• Photographs: Photos uploaded by a couple to their website, and photos uploaded by guests to a wedding's CloudAlbum. Images may contain personal information (faces, and any location or device metadata embedded in the file).
• Technical & Diagnostic Data: Server logs (including IP address and browser user-agent), error reports, and privacy-preserving usage analytics, used to keep the service running, secure, and debuggable. Our analytics are first-party and cookieless, IP addresses are masked, and we honour your browser's Do Not Track setting.

3. Third-Party Data Sharing

We do not sell your personal data. We disclose personal information to contractors, service providers, and other third parties we use to support our business and who are bound by contractual obligations to keep personal information confidential and use it only for the purposes for which we disclose it to them. These include:

• PayMongo: For processing payments securely.
• Google Gemini API: Certain text and planning data (e.g., event details) may be sent to Google Gemini AI models to generate intelligent checklists, budgets, and narrative stories. This data is processed exclusively for feature generation and is not used to train public AI models.
• Infrastructure Providers: Our application and database are hosted on Render (servers located in Singapore); files and photographs are stored in Cloudflare R2; and Cloudflare also provides our CDN, TLS, and security filtering. By using our service, you consent to the cross-border transfer of your data to these providers.
• Resend: Delivers our transactional email — including invitation and RSVP-reminder emails addressed to guests — which requires sharing the recipient's name and email address.
• Sentry: Application error monitoring, used to detect and fix crashes. We configure it not to send personal data by default, though a diagnostic report may incidentally include technical request context.
• BetterStack: Stores our server logs, which include IP addresses and request metadata, for operational troubleshooting.
• Google Maps / Places: Powers the venue picker in a couple's settings. We call Google from our servers, not from your browser, so your device never contacts Google and your IP address is never shared with them — we send only the address text being searched, or the coordinates of a chosen venue. See our Cookie Policy.
• Open-Meteo: If a couple enables the weather detail on their website, a visitor's browser requests a forecast for the venue's coordinates and the wedding date. No personal data about the visitor is sent.
• Google Sign-In & Google Drive: Used only if you choose to sign in with Google or connect Drive to attach planning documents. We receive your Google account email and profile name, and access only the files you explicitly select.
• User-Initiated Sharing (CloudCollab): Our platform lets Couples generate shareable links to collaborate with third parties (e.g., wedding coordinators, caterers, or suppliers). When a Couple uses these features to share guest lists, seating charts, or dietary restrictions, the Couple is solely responsible for ensuring they have the right to share that data. CloudInvites acts only as the facilitator of this user-initiated sharing.
• Delegated Access (Coordinators): If you choose to link your account with a third-party wedding coordinator or allow them to manage your event directly on our platform, you explicitly consent to granting them access to your event data, including your personal information and that of your guests. CloudInvites acts solely as the platform facilitating this delegated access.

4. Data Retention & Deletion

We retain personal information only for as long as necessary for the purposes set out in this policy. Our systems apply the following schedules automatically:

• Wedding data hosted on your subdomain (e.g. jane-and-john.cloudinvites.wedding) is kept for the duration of your plan and, after that, until 12 months past your wedding date. At that point we permanently scrub the personal information — couple and guest names, contact details, venue addresses, photographs and stories — retaining only anonymous, non-identifying counts.
• Guest album photographs are permanently deleted 6 months after the wedding date. This is a hard deletion and cannot be undone. We email the couple roughly 30 days beforehand with a link to download the full album — please save your photos before that date.
• Subdomains from lapsed free trials may be released and made available to other couples after a grace period.
• Analytics and log data is deleted after 6 months.
• Transaction records (orders, receipts, and payment references) are retained for longer where required to meet Philippine tax, accounting, and anti-fraud obligations, even after other data is scrubbed.

You may request deletion of your account at any time by contacting us, and we will action it subject to those legal retention obligations.

5. Your Rights Under the Data Privacy Act

As a data subject in the Philippines, you are entitled to the following rights under RA 10173:

• Right to be informed: You have the right to know when your personal data shall be, are being, or have been processed.
• Right to object: You can object to the processing of your personal data.
• Right to access: You can demand access to your personal data.
• Right to rectify: You have the right to dispute the inaccuracy or error in the personal data and have it corrected.
• Right to erase or block: You can suspend, withdraw, or order the blocking, removal, or destruction of your personal data.
• Right to damages: You can claim compensation if you suffered damages due to inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal data.
• Right to data portability: You can obtain and electronically move, copy or transfer your personal data in a secure manner.

6. If You Are a Wedding Guest

You did not sign up for CloudInvites — you were invited. Here is what that means for you:

• The couple hosting the wedding decides what guest information is collected and why. They are the PIC; we process it for them.
• You can RSVP without providing dietary or allergy information, and without creating an account.
• The rights in Section 5 apply to you too. To access, correct, or delete your details, the fastest route is to ask the couple directly, since they control the guest list. You may also contact us and we will assist and, where appropriate, refer your request to them.
• Photographs you upload to a wedding's CloudAlbum are visible to that wedding's guests and to the couple, who may moderate or remove them.

7. Security

We use organisational and technical measures appropriate to the risk, including encryption in transit (HTTPS), encryption of stored credentials, database-level tenant isolation so one wedding's data cannot be read from another, access controls on internal tooling, and audit logging of administrative actions. No method of transmission or storage is perfectly secure, but in the event of a personal data breach that poses a real risk to your rights, we will notify you and the National Privacy Commission as required by RA 10173.

8. Children

CloudInvites is not directed at children, and accounts are intended for individuals aged 18 or over. A couple may include a minor's name in their guest list (for example, a child attending the wedding); that information is provided and controlled by the couple, who is responsible for having the appropriate authority to share it.

9. Changes to This Policy

We may update this Privacy Policy as the service evolves. The "Effective Date" at the top always reflects the current version. If we make a change that materially affects how we handle your personal data, we will take reasonable steps to notify account holders — for example, by email or an in-app notice — before it takes effect.

10. Contact Information

To ask a question about this Privacy Policy, or to exercise any of your rights under the Data Privacy Act, contact us at privacy@cloudinvites.wedding. We aim to respond within a reasonable period and, in any case, within the timeframes required by law.

If you believe your rights under RA 10173 have been violated and we have not resolved your concern, you may lodge a complaint with the National Privacy Commission of the Philippines (privacy.gov.ph).