1. Introduction & Who We Are
Welcome to Invitation Studio (“we,” “our,” or “the Platform”), a commercial digital wedding invitation creation and RSVP management platform operated in Sri Lanka.
This Privacy Policy explains how we collect, store, process, and protect your personal data when you visit our website, register an account as a couple, personalize digital wedding invitations, process payments, and when wedding guests view hosted invitations or submit RSVPs.
We operate in full compliance with the Personal Data Protection Act No. 9 of 2022 (PDPA) of Sri Lanka and align our practices with international privacy standards including the General Data Protection Regulation (GDPR) for global guests.
2. Categories of Information We Collect
We collect information in three distinct categories depending on how you interact with our platform:
A. Registered Couple Data (Account Holders)
- Account Details: Full name, email address, and profile image authenticated via Clerk.
- Wedding Customization Details: Bride and groom names, wedding date, ceremony time, venue name, physical address, Google Maps location links, tagline, host messages, and custom Sinhala quotes.
- Media Uploads: Photos uploaded to your couple photo gallery and optional background music URLs.
- Custom URL Slug: The personalized web address requested for your invitation (e.g.,
amali-and-kasun).
B. Wedding Guest Data (Invitees)
- RSVP Form Responses: Guest full name, attendance confirmation (“attending”, “declined”, or “maybe”), and party size headcount.
- Optional Contact & Event Details (Only if enabled by couple): Guest phone number, guest email address, dietary restrictions/allergies, meal preferences, song requests, and heartfelt personal messages to the couple.
- Entry Source Indicator: Whether the invitation was opened directly via web link or scanned via a printed QR code (
ref=qr).
C. Payment & Technical Metadata
- Billing & Transaction Logs: Transaction ID, merchant reference, amount, currency (LKR/USD), timestamp, and payment status via PayHere. We never store credit card numbers, expiration dates, or CVVs.
- Technical Telemetry: Anonymized or hashed IP address (solely for spam defense and rate limiting), browser user agent, device model, and end-of-page scroll completion markers.
3. Purpose & Lawful Basis for Processing
We process personal information under the following legitimate and lawful bases:
- Contractual Performance: To host your wedding invitation, enable interactive mobile rendering, maintain your vanity link, generate high-contrast QR codes, and collect RSVPs on your behalf.
- Couple's Legitimate Interest: To enable couples to organize their wedding seating, catering headcounts, and guest logistics without manual spreadsheet tracking.
- Guest Consent: Provided voluntarily by wedding guests at the moment they fill out and submit the RSVP form.
- Legal & Financial Compliance: Retaining purchase transaction receipts for tax, billing reconciliation, and regulatory audit compliance.
4. Complete Confidentiality of Guest Data
We enforce a strict privacy boundary between the couple's private workspace and the public internet:
Our Confidentiality Commitment:
Guest phone numbers, emails, dietary information, and private messages are accessible ONLY to the authenticated couple via their password-protected dashboard and our system administrators for technical support. They are never rendered on public invitation pages, never indexed by Google or search crawlers, and never sold to third-party vendors or wedding advertisers.
5. Trusted Third-Party Infrastructure Providers
To maintain sub-second speed, 99.9% uptime, and financial-grade security, we partner with industry-leading infrastructure providers who process data strictly under our contractual instructions:
- Clerk Inc. (Identity & Authentication): Manages user registration, session tokens, multi-factor authentication, and password security.
- Convex Inc. (Reactive Cloud Database): Hosts encrypted invitation records, guest RSVPs, and real-time WebSocket subscriptions.
- PayHere (Payment Gateway): Central Bank of Sri Lanka authorized payment service provider. All credit/debit card transactions are processed on PayHere's PCI-DSS compliant hosted payment gateway.
6. Data Retention, Expiry & Erasure
Your invitation remains live and accessible until the designated invitationExpiryDate chosen during setup. After this date:
- The public link transitions to an inactive state (“Celebration Concluded”).
- Couples can export guest responses and attendance reports to CSV at any time prior to or following the event.
- Couples can request permanent erasure of their account, uploaded photos, and guest RSVP records by contacting our support team.
7. Your Rights Under Sri Lanka PDPA & Global Privacy Laws
As a couple or guest, you hold the following rights regarding your personal data:
- Right of Access: Request a full copy of all personal data held concerning you.
- Right of Rectification: Request correction of inaccurate names, telephone numbers, or guest counts.
- Right to Erasure (“Right to be Forgotten”): Request the permanent deletion of your RSVP response or account.
- Right to Withdraw Consent: Withdraw consent for optional communications at any time.
8. Contact Our Privacy Office
If you have any questions, concerns, or requests regarding this Privacy Policy or your data protection rights, please reach out to our dedicated privacy desk:
Invitation Studio — Data Protection Office
Email: [email protected]
Legal Jurisdiction: Colombo / Kandy, Sri Lanka
Official WhatsApp Support: Available on published dashboard