Privacy Policy

Studio privacy & analytics

The following describes the current Studio. The published company policy follows below; older invitations continue to use the original service.

Optional analytics

Analytics are off until you choose to allow them. We count page views and create-button clicks on marketing pages, pricing and Studio setup. A random browser identifier links consenting visits and their first marketing source to drafts and server-confirmed purchases for up to 90 days. This does not identify people across devices. Full URLs, guest tokens, names, email addresses and invitation content are not analytics fields. These first-party records are not sent to advertising platforms.

Your choice is saved in this browser. You can change it using the analytics control below. Do Not Track and Global Privacy Control preferences keep optional analytics off. If browser storage is unavailable, analytics stay off unless you explicitly allow them for the current page.

Optional advertising measurement

Advertising measurement is a separate choice and is off by default. If allowed, Meta Pixel receives marketing-page views, checkout starts and server-confirmed first plan purchases, including the plan identifier, currency, value and a random event identifier. A server confirmation can also send a SHA-256 hash of your account email and Meta matching cookies after an explicitly consented checkout. Its event identifier matches the browser event to prevent double counting. Meta can receive the page URL, browser/device and network information, and use its cookies to match an ad click or view. Automatic form collection and advanced matching are disabled. We do not send invitation text, guest names, replies, photos or recordings.

Measurement runs on marketing pages and the host checkout flow, not guest invitation or private preview pages. Free drafts, guest RSVPs, plan upgrades and extra guest-detail packs are not reported as acquisition purchases. Refusing measurement does not affect editing, payment or publishing. Use Privacy choices to withdraw permission. Browser privacy signals keep both optional purposes off. Meta processes events under its own privacy and cookie policies; withdrawing permission stops future events but does not erase events already received by Meta.

Reply confirmation emails

When enabled by a host, we send a confirmation to the email address recorded for the replying household and a notification to the host. Confirmations include only that household’s invited events and the hosts’ event timezone. Personal links remain private. Delivery jobs retry for up to 23 hours; accepted delivery payloads are removed after seven days. Signed provider notifications record delivery, bounces and complaints. We retain address hashes to prevent sending to permanently bouncing or complaining addresses. Provider acceptance does not guarantee inbox delivery.

Your guests and uploads

Our anonymous page-view analytics do not run on personal invitations, private previews or host dashboards. The separately chosen ad measurement can run in the host checkout flow. Guest names, replies, dietary notes, photos and recordings are not analytics fields. Studio needs invitation, account and response records to provide the service; authorised staff can inspect account profiles, saved invitations and their progress to provide support and improve the product. Staff access is restricted and does not grant another customer access to your invitation.

Personal draft uploads are private to their owner. In a business workspace, managers can access the uploads and guest records for its client events. Invited clients can see only their own invitation and the media used in its draft, and can leave feedback or approve a version. The business owner controls manager access; the team controls client access. Invitation links expire after seven days, can be used once, and can be revoked. Review records contain the reviewer’s account identity, name, response, version and timestamp. Media used by a published invitation can be read by people who can access that published media. Unpublishing removes that anonymous access. Event visibility and reply permissions continue to depend on each guest’s personal invitation.

Authorised staff can also review draft uploads for support.

Product diagnostics and editor progress

We retain limited operational diagnostics for saves, uploads, checkout and publishing: the account and invitation identifiers, operation result, a fixed error category and duration. These help staff investigate failed actions. They do not contain form text, guest details, raw error messages or uploaded files.

With your analytics permission, we also record which editor section you opened, previews, successful link copies, checkout closures and browser-side checkout or photo preparation failures. These observations are linked to your invitation and include a coarse phone, tablet or desktop category. They are not session recordings and are not sent to advertising platforms. Refusing analytics, Do Not Track or Global Privacy Control stops these optional observations. Missing activity is not treated as proof that you abandoned your invitation.

Diagnostic and editor-event records expire after 90 days and are removed when your account is erased. Changing consent stops future optional collection; invitation, payment and operational records remain available to provide the service.

Storage and retention

Daily totals and consented browser events are stored in the Studio database. Scheduled maintenance removes totals older than 90 calendar days. Your consent preference stays in this browser until you change it or clear browser storage. Essential sign-in cookies support your account session. Hosting and payment providers may maintain their own operational records.

Changing your analytics choice stops future optional events. Previously aggregated totals remain; individual browser records expire after 90 days. Unresolved delivery jobs expire after 30 days.