This policy explains what personal information Inwyt collects, why, who we share it with, how long we keep it, and your rights. It covers our website https://inwyt.link, event pages on *.inwyt.link, and the Inwyt dashboard. Inwyt is based in Sri Lanka and this policy is written under Sri Lanka's Personal Data Protection Act, No. 9 of 2022 (PDPA). It applies to everyone who uses the Service. If the law where you live gives you further rights, we will honour them when you contact us (section 10).
1. Who we are and our role
Inwyt is an independent business based in Colombo, Sri Lanka ("Inwyt", "we", "us"). Contact: privacy@inwyt.link.
- For Hosts' account and billing data, and website visitors' data, Inwyt is the controller.
- For Guest Data (information about the people a Host invites, whether the Host enters it or the Guest submits it), the Host is the controller and Inwyt is the Host's processor. We use Guest Data only to provide the Service to that Host. Guests who want to exercise their rights should contact the Host first; we will help (section 11).
2. Information we collect
| From | Information | Required? |
|---|---|---|
| Hosts (account) | Email, first and last name, phone number, address, password (stored by our authentication provider, never by us in plain text) | Email and name required |
| Hosts (events) | Couple's or hosts' names, event and sub-event dates and times, venue names and addresses, story text, photos, music and design choices, event web address | As needed for the invitation |
| Hosts, about Guests | Guest first and last name, phone number, email, relationship tag, groups, plus-one allowance, notes, dietary preferences, table assignment | Name and one contact method per Guest |
| Guests (through their invite link) | RSVP for each sub-event, number of plus-ones and their names, meal preferences, dietary and accessibility notes, a message to the Host, photos uploaded to Guest Moments (with the name and caption given), channel opt-outs | Optional; only what the Guest chooses to submit |
| Automatically, event pages | When an invite link is opened and an RSVP started or submitted, with a one-way hash of the IP address and browser user-agent (we do not store the raw values) | Automatic |
| Automatically, our website, dashboard and event pages | Pages viewed, referrer, device and browser type, approximate location (country or city), and technical details of errors in the page, collected by PostHog without cookies. On event pages the invite link's personal code is removed before anything is sent, and nothing typed into a form is collected | See section 6 |
| Automatically, all services | Server and security logs (IP address, timestamps, errors) | Automatic |
| Payments (from Paddle) | Name, email, billing country, plan bought, amounts, transaction and subscription IDs. We never receive full card numbers. | For paid plans |
| Waitlist | The email address you gave to join our pre-launch waitlist | If you joined |
| Support | What you write to us | If you contact us |
Guests do not create accounts. We do not collect information directly from Guests other than what they submit through their own invite link.
3. How we use information and our legal bases
| Purpose | Information | Legal basis |
|---|---|---|
| Create and run your account, events and event pages | Account, event and Guest Data | Contract (for Guest Data: on the Host's instructions) |
| Show Guests their invitation and record their RSVP and photos | Guest Data | Host's instructions |
| Show the Host who opened an invite and who replied | Link activity, RSVPs | Host's instructions |
| Take payments and manage plans, renewals and grace periods | Billing data | Contract; legal obligation (tax records) |
| Send account, security, billing and event-lifecycle emails (archive and deletion notices) | Email, plan and event data | Contract |
| Send event reminders and RSVP activity emails to Hosts | Email, event and RSVP data | Contract; you can turn these off |
| Send marketing emails about Inwyt | Email, name | Consent where required; otherwise legitimate interests, with an unsubscribe link in every email |
| Understand how the Service is used, find and fix errors, and improve it | Analytics and error data | Legitimate interests |
| Keep the Service secure and prevent abuse | Logs, hashed link activity | Legitimate interests |
| Meet legal obligations and defend claims | As needed | Legal obligation; legitimate interests |
We do not use personal information for automated decisions that have legal or similarly significant effects on anyone.
Dietary and accessibility notes may reveal information about health or religious belief. We use them only so the Host can see them and plan catering and access. We never use them for analytics or marketing.
4. Emails we send
- Account and billing emails (sign-in, security, payment receipts and reminders, failed payments, plan expiry, archive and deletion notices): needed to run your account, so you cannot opt out while you have one.
- Event reminders and RSVP activity emails to Hosts: you can turn these off in your email preferences or through the unsubscribe link.
- Marketing emails: sent only with consent where the law requires it. Every email has a one-click unsubscribe.
- Messages to Guests: invitations and reminders the Host chooses to send, from the Host's own WhatsApp or email app; Inwyt does not send them. Guests can opt out of a channel from the preferences link in their invitation.
We do not show advertising, use remarketing or retargeting services, or sell email lists.
5. Sharing
We do not sell personal information or share it for advertising. We disclose information only to:
| Recipient | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, file storage, content delivery, sign-in (Amazon Cognito) and emails to Hosts (Amazon SES) | Singapore; content delivery worldwide |
| Neon | Database hosting | Singapore |
| Paddle | Payment processing. Paddle is Merchant of Record and an independent controller of payment data under its own privacy policy | United Kingdom and other countries |
| PostHog | Cookieless analytics and error tracking | United States |
- To the Host: everything Guests submit through an invitation goes to the Host who invited them.
- To Guests: an event page shows what the Host chose to publish. A personal invite link shows only that Guest's own details, never other Guests'. Approved Guest Moments photos may be visible to other Guests or the public, as the Host chooses.
- Team members a Host invites can see that Host's event and Guest Data.
- For legal reasons: when required by law, court order or a valid request from authorities, or to protect people's safety or our rights.
- Business transfer: if Inwyt is sold or reorganised, to the new owner, who must honour this policy.
Messaging apps. Invitations and reminders to Guests are sent by the Host from the Host's own WhatsApp or email app. Those providers (such as Meta for WhatsApp, or the Host's email provider) handle the message under their own privacy policies. Inwyt keeps only the message text the Host prepared and a record that it was sent.
Images on our website. Some photos on our marketing website are loaded directly from Unsplash, which receives your IP address and browser details when your browser requests them.
6. Cookies, analytics and Do Not Track
- Essential cookies: a sign-in session cookie on the dashboard, and on event pages a signed cookie valid for six hours that lets a Guest upload photos to Guest Moments. These are needed for the Service and do not track you.
- No analytics cookies: we use PostHog to count visits, see which pages help and catch errors on our website, the dashboard and event pages. It runs in cookieless mode: it sets no cookies and stores nothing on your device, so there is nothing to accept or reject. Instead of a cookie, PostHog estimates unique visitors from a hash of your IP address and browser details, made with a value that changes every day, so it cannot follow you from one day to the next or across other websites. We do not identify you in it, record your screen or collect what you type. On event pages, the personal code in a Guest's invite link is removed before anything is sent, and page titles (which can show a Guest's name) are not sent at all. We have not turned on any advertising features.
- Do Not Track: browsers' Do Not Track signals have no common standard, so we do not respond to them. Because we do not track you across websites, sell or share your information, there is nothing for such a signal to switch off.
- Other than PostHog as described above, which works for us only, we do not allow third parties to collect information about your online activities over time and across websites when you use the Service.
7. International transfers
Inwyt is based in Sri Lanka. Our database, files and servers are in Singapore; analytics are processed by PostHog in the United States, and payment data by Paddle under its own policy. We use providers that protect data under their contract terms, and transfer data only as the PDPA permits.
8. How long we keep information
Guest Data and event content are kept only while the event exists. Every event is live, then archived, then deleted:
| Plan | Events stay live | Then |
|---|---|---|
| Free | 30 days from when you choose Free | Archived; permanently deleted 14 days later |
| Celebration (one-time) | 12 months from purchase; buy again for another 12 months | Archived; permanently deleted 14 days later |
| Studio (subscription) | While the subscription is paid. A failed payment or cancellation gives a 14-day grace period with events live | Archived; permanently deleted 14 days later. Paying again within those 28 days restores everything |
| Any plan, refunded | Ends at once | Archived; permanently deleted 14 days later |
- A Host can delete an event at any time. Deleted events, their Guest Data and uploaded photos are removed from our live systems within one day. We keep no archive copies. Residual copies in automatic database backups and logs are overwritten within 30 days.
- Account data is kept while your account is open and deleted within 30 days of closing it.
- Hashed link-activity records are deleted with their event.
- Payment and invoice records are kept for as long as tax and accounting law requires, even after an event or account is deleted. Paddle keeps its own records under its policy.
- Waitlist emails are deleted once we have told the waitlist that Inwyt is open, unless you create an account.
- Marketing preferences (including unsubscribes) are kept so we keep honouring them.
9. Security
All traffic uses HTTPS (TLS). Data is encrypted at rest by our hosting providers. Each Host's data is isolated from other Hosts'. Each Guest's invitation link is a long random token that shows only that Guest's information. Passwords are handled by Amazon Cognito. We store hashes rather than raw IP addresses for link activity. No system is perfectly secure. If a personal data breach is likely to affect your rights, we will notify you and the relevant authorities as the law requires.
10. Your rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you and get a copy, including in a portable format;
- correct inaccurate information;
- delete your information;
- restrict or object to certain uses, including at any time to direct marketing;
- withdraw consent where we rely on it, without affecting earlier processing;
- complain to a data protection authority.
Hosts can view, edit, export and delete most of their data in the dashboard (account details in settings, Guest Data in each event). For anything else, email privacy@inwyt.link. We will verify your identity, normally by confirming access to your account email, and answer within one month; we may extend this where the law allows and will tell you why.
Sri Lanka. Under the PDPA you may request access, correction, completion, erasure, and to withdraw consent or object to processing, and to have automated decisions reviewed. If you are not satisfied with our response you may appeal to the Data Protection Authority of Sri Lanka.
Elsewhere. If you live outside Sri Lanka and your local law gives you other privacy rights, email us and we will respond as that law requires.
11. Guests' rights
Guest Data belongs to the Host who invited you. To see, correct or remove your details, contact the Host first. You can opt out of being contacted on a channel from the preferences link in your invitation. If you cannot reach the Host, email privacy@inwyt.link with the event's web address; we will pass your request to the Host and, where the law allows or requires, act on it ourselves.
12. Children
Inwyt is not directed to children. Hosts must be at least 18. We do not knowingly collect personal information directly from children under 13. Hosts sometimes list children as Guests, for example on a family invitation; that information is Guest Data that the Host is responsible for, and the Host confirms they have permission from the child's parent or guardian. If you believe a child has given us information directly, email privacy@inwyt.link and we will delete it.
13. Changes to this policy
We will post changes here and update the "Last updated" date. For material changes we will email Hosts at least 14 days before they take effect and, where the law requires, ask for consent again.
14. Contact
- Inwyt: Colombo, Sri Lanka · privacy@inwyt.link
- Data Protection Officer (PDPA): dpo@inwyt.link