Privacy notice

The short version

We use personal information to provide wedding websites, invitations, RSVP tools, planning features, support, security, and billing. We do not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising or profiling, or use Guest information to advertise. Optional marketing analytics is currently disabled. Dietary, allergy, and accessibility details Guests share are covered by our separate Consumer Health Data Privacy Policy.

Who we are

The Cordially Invited is operated by Crafted Kit LLC d/b/a The Cordially Invited, a Colorado limited liability company (“we,” “us,” or “our”). Questions and privacy requests can be sent to hello@thecordiallyinvited.com.

Who this notice covers

This notice covers people who browse our public pages, create or help manage a Wedding, purchase the service, visit a published wedding website, receive an invitation, or submit an RSVP. It does not replace the privacy notice of a couple or another organization that independently decides how to use Guest information.

For account, product, security, support, and billing information, The Cordially Inviteddetermines why and how the information is used. For Guest rosters, invitations, and RSVP information, the couple decides whom to invite, what to ask, and what to do with the replies they receive, and we process the information to provide the service. We remain responsible for how our service collects and protects that information, including consumer health data, and we may use limited operational information as needed to secure the service, prevent abuse, comply with law, and maintain delivery records.

Information we collect

• Account and contact information: email address, authentication records, legal-acceptance records, collaborator details, how you heard about us when you start a Wedding, and communications with us.
• Wedding and website information: names, wedding date and location, stories, schedules, travel details, registry links, FAQs, design choices, identity settings, photos, and other content a couple provides.
• Guest and RSVP information: names, household groupings, email addresses, phone numbers, and mailing addresses supplied by the couple or a Guest, attendance, meal selections, plus-one details, seating, answers to custom questions, notes, and optional dietary, allergy, accessibility, travel, or lodging details.
• Invitation and delivery information: message content, audience, send status, delivery events, bounces, complaints, suppressions, and private invitation-link records.
• Billing information: plan, purchase status, Stripe customer and transaction identifiers, subscription status, renewal notices, refunds, and disputes. Stripe receives payment-card details directly; we do not receive or store full card numbers.
• Device, security, and log information: IP address, browser and device details, timestamps, requested pages, security events, error reports, and bot-check results. We do not intentionally place names, Guest responses, private links, or message bodies in error-monitoring reports.
• Availability list: if you are outside the United States and ask to hear when paid plans open in your country, your email address, country, and when you asked.
• Early-access information: if you applied to our earlier private beta, the application details and whether it was approved, declined, or withdrawn.

We collect information from you, from a couple or collaborator who adds you, from a Guest or household member who replies for you, automatically from the service and its security systems, and from providers such as Stripe and Resend when they report transaction or delivery status.

How we use information

• Provide, personalize, publish, maintain, and support the service.
• Authenticate users and preserve requested setup or RSVP state.
• Send account, invitation, RSVP, billing, service, and support communications.
• Send the single email you asked for when paid plans open in your country. We do not add availability-list addresses to any other mailing.
• Process purchases, subscriptions, renewals, refunds, disputes, and entitlements.
• Protect accounts and Guests, prevent abuse, debug failures, and enforce our terms.
• Comply with legal obligations and establish or defend legal claims.
• Understand which channels bring couples to the service, using the answer you give when you start a Wedding.
• Improve the product using feedback and limited operational information. We do not use personal information, including Guest lists, RSVP answers, photos, or private Wedding content, to train generative AI or large language models.

Sensitive details

Dietary, allergy, and accessibility answers can reveal health or disability information. We collect them only when the person replying agrees at the RSVP form or as needed to deliver the reply they asked us to send, use them only to deliver the reply to the couple, and never use them for advertising, analytics, or profiling. Our Consumer Health Data Privacy Policy explains these practices and the rights that apply.

Open-text RSVP notes and answers to a couple's custom questions can also reveal health, religious, or other sensitive information. Couples should request only what they need and must not ask Guests for medical diagnoses. Guests should avoid including unrelated sensitive information.

How we disclose information

We disclose information only as needed for the following purposes:

• Couples and collaborators: Wedding owners and authorized collaborators can see the Wedding and Guest information allowed by their role.
• Vendors the couple chooses: a caterer, venue, planner, or other vendor the couple shares a plan link with can see the Guest details relevant to their work, such as meals, seating, and dietary or accessibility needs. Couples may also share Guest replies with vendors outside the service.
• Guests and site visitors: content a couple publishes is available through the Wedding address, subject to any site password or private event controls.
• Service providers: Supabase for database, authentication, and file storage; Vercel for hosting; Resend for email delivery; Cloudflare Turnstile for bot protection; Cloudflare R2 for encrypted backups; Sentry for limited error monitoring when enabled; and Stripe for payment processing and billing management. They may use the information only to provide their services to us.
• Legal and safety: authorities, advisers, or other parties when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or establish and defend legal claims.
• Business changes: a buyer, successor, or adviser in connection with a financing, merger, acquisition, reorganization, or sale, subject to appropriate confidentiality and legal protections.

We do not sell personal information or disclose it for targeted advertising. We do not disclose Guest information to data brokers, and we do not use personal information for profiling that produces legal or similarly significant effects.

Cookies, tracking, and Do Not Track

We currently use cookies and similar technology only for requested setup choices, authentication, security, site-password access, and RSVP sessions. Optional analytics, advertising pixels, and cross-site behavioral tracking are disabled. Our Cookie Notice lists the purposes and retention periods.

We do not track visitors across other websites over time, and we do not allow advertising networks to do so on our pages. Cloudflare and Stripe process device information on their own security challenges and checkout pages to prevent fraud. Because we do not engage in cross-site tracking, sale, or targeted advertising, browser Do Not Track and Global Privacy Control signals do not change how the service behaves today. We will honor applicable signals before activating any use to which they apply.

Retention and deletion

Retention depends on the type of information, the Wedding lifecycle, security and delivery needs, and legal obligations. Couples can export Wedding information and initiate Wedding deletion. A deletion request first takes the site offline and enters a 30-day reversal period. Our team then carries out permanent removal, normally within 30 days after that period ends. Provider, backup, billing, suppression, fraud-prevention, and legal records may remain longer where necessary. Details are in our Data Retention and Deletion Policy.

Your privacy rights

Depending on where you live, and in any case as a matter of our own practice, you may ask us to:

• confirm whether we process your personal information and give you access to it;
• correct inaccurate personal information;
• delete personal information;
• give you a portable copy of personal information you provided;
• withdraw consent you gave, such as for health details in an RSVP; and
• opt out of sale, targeted advertising, or profiling. We do none of these, so there is nothing to opt out of today.

Couples can correct much of their information in the Dashboard, export Wedding data, remove Guests, and initiate Wedding deletion. Guests can change or clear their reply from their private RSVP link and may also contact the couple, who controls the roster and RSVP questions. You can always contact us directly.

How to make a request or appeal

Email hello@thecordiallyinvited.com with the subject “Privacy request.” Tell us what you are asking for and, if you are a Guest, the couple's names or Wedding address. We verify requests by confirming control of the email address or private link connected to the information, and may ask for more detail when needed to protect the information. An authorized agent may submit a request where law permits; we will verify the request and the agent's authority.

We respond within 45 days. If we need more time, we will tell you within that period and may extend once by up to 45 more days. If we decline a request, reply with the subject “Privacy appeal” and explain why the decision should be reviewed. We decide appeals within 45 days and explain the outcome. If your appeal is denied, you may contact your state attorney general.

We will not deny service, charge different prices, or provide a different quality of service because you exercised a privacy right.

Security

We use access controls, tenant-level database policies, encrypted transport, restricted administrative access, abuse controls, and operational monitoring designed to protect personal information. No online service can promise perfect security. If you believe a Wedding, invitation link, or account has been compromised, contact us promptly and do not include sensitive Guest details in the first email. We will notify affected people and authorities of a security breach as the law requires.

International visitors

The service is operated from the United States for weddings planned by couples in the United States. We and our providers process information in the United States and in other countries where our providers operate, which may have different privacy laws. If you are a Guest outside the United States, we honor the privacy requests described above wherever you live. Where applicable law requires transfer safeguards, we rely on provider contractual protections and other lawful transfer mechanisms.

Children

The service is for adults and is not directed to children under 13. We do not knowingly collect personal information directly from children under 13. A parent, guardian, or other authorized adult provides information about children who are invited, such as a child's name, household, meal, or seating, and should provide only what the couple needs. Invitations and other guest messages go only to email addresses listed for adult guests. We do not send them to an email address listed for a guest the couple marks as a child, so couples should list an adult's email for each household. If we learn that a child under 13 submitted information directly, we will delete it. We do not sell minors' personal information, use it for targeted advertising or profiling, or collect precise location.

Changes and contact

We will post updates here and revise the effective date. Before a material change takes effect, we will notify account holders by email or in the service, and we will ask for consent where the law requires it. Questions and privacy requests can be sent to hello@thecordiallyinvited.com.