Invytly

Privacy Notice for the Invytly Platform (Customers)

Last updated: October 26, 2026

1. Scope of Application

This Privacy Policy applies exclusively to Customers of the Invytly web application (the “Platform”), namely professionals or legal entities using the Platform for event management purposes.

This Privacy Policy does not apply to the personal data of event guests, which are governed by separate privacy notices provided by the Customer acting as Data Controller.

2. Data Controller

Damiano Carradori
Via Antonio Milani, 19 – 37124 Verona (Italy)
Email: privacy@invytly.com

3. Categories of Personal Data Processed

a) Customer account data

For the creation and management of the Customer account, the Provider processes:

  • email address
  • password (stored and processed exclusively in encrypted form)
  • any additional identification data associated with the account

Authentication services are provided through Firebase Authentication.

The Provider also processes, even before the account is created, the email address, agreed with the Customer, to which it sends the personal Project creation link, together with the Project settings prepared for that Customer.

b) Authorized Users and collaborators

The Customer may invite Authorized Users (e.g. staff members or members of the couple) to access specific Projects with limited permissions.

In such cases, the Provider processes the data necessary to manage access (e.g. email address).

c) Data entered by the Customer during use of the Platform

While using the Platform, the Customer may enter data related to managed events, including:

  • names of the couple
  • names and contact details of guests
  • messages and content intended for guests
  • images or other files attached to communications

Such data may include personal data of third parties and is processed in accordance with Section 6 below.

d) Technical and usage data

The Provider may process technical and usage data such as:

  • IP address
  • access logs
  • browser, device, and operating system information
  • date and time of actions performed on the Platform

This data is processed exclusively for security, operational, and maintenance purposes.

e) AI Assistant conversations

Where the AI Assistant has been enabled for a Project, the Provider processes the conversations of the users who use it, including:

  • messages written by the user
  • answers generated by the AI Assistant
  • conversation titles and summaries
  • approval decisions on the proposed changes
  • usage counters

Conversations are processed through the large language models of the providers listed in Section 8 and are visible only to the user who created them and, for support purposes, to the Provider’s authorized personnel. Guest data appearing in conversations is processed on behalf of the Customer in accordance with Section 6 below.

4. Purposes of Processing

Personal data is processed for the following purposes:

  • provision and management of the Invytly Platform
  • creation and administration of Customer accounts
  • enabling collaboration between Authorized Users within Projects
  • providing the AI Assistant, where enabled for a Project, and keeping accountability records of the changes it applied
  • sending service-related communications (e.g. registration confirmations, collaboration invitations, Project creation links)
  • ensuring Platform security, stability, and abuse prevention
  • compliance with legal obligations
  • protection of the Provider’s rights in the event of misuse or unlawful activity

5. Legal Basis for Processing

Processing of personal data is based on:

  • performance of a contract
    (Article 6(1)(b) GDPR), for the provision of the Platform, including the AI Assistant
  • legitimate interest of the Provider
    (Article 6(1)(f) GDPR), in ensuring security and preventing abuse
  • compliance with legal obligations, where applicable
    (Article 6(1)(c) GDPR)

Contract performance applies where processing is necessary to perform a contract with the individual concerned. The processing of Authorized Users’ data and the keeping of security and accountability records rely, where applicable, on the Provider’s legitimate interest in administering access, providing the service and documenting its operation (Article 6(1)(f) GDPR).

Customer consent is not required.

6. Personal Data of Event Guests

GDPR roles

With regard to the personal data of event guests entered by the Customer into Projects:

  • the Customer acts as Data Controller
  • the Provider acts as Data Processor, processing such data solely on behalf of and according to the documented instructions of the Customer

Customer responsibilities

Use of the Platform for communications with event guests is subject to the Customer’s acceptance of a specific Guest Contact Data Usage Notice, which must be approved by the Customer upon creation of each Project.

By accepting such notice, the Customer declares, inter alia, that they:

  • have lawfully collected the guests’ personal data
  • have informed the data subjects that event-related communications may be sent, including via email and WhatsApp
  • have obtained valid consent where required
  • assume full responsibility in the event of complaints or claims by data subjects

The Provider does not verify the existence or validity of the consent declared by the Customer.

AI Assistant

Where the Customer requests the AI Assistant for a Project, guest data is processed through it on the Customer’s instructions, as described in the Data Processing Agreement, by the sub-processors listed there. Every change proposed by the AI Assistant to guest data, RSVP configuration or communication drafts is approved by one of the Customer’s users before it is applied.

7. Communications

The Provider uses third-party services to deliver communications, including:

  • Twilio SendGrid for transactional email delivery
  • WhatsApp Business API for guest communications, processed strictly on the Customer’s instructions

The Provider does not use personal data for its own marketing purposes.

8. Data Recipients and Service Providers

Personal data may be processed by third-party service providers appointed as Data Processors, including:

  • Google Cloud EMEA Limited / Google LLC (Firebase, Google Cloud: authentication, infrastructure, security services)
  • Twilio Ireland Limited (SendGrid) (email delivery services)
  • Meta Platforms Ireland Limited (WhatsApp Business API services)
  • OpenAI Ireland Ltd / OpenAI, L.L.C. (large language models for the AI Assistant)
  • Neon, Inc. (audit log database)
  • Vercel Inc. (hosting of the website and of the operator console)
  • hosting and cloud storage providers

The complete list of sub-processors, with their location and transfer safeguards, is set out in Article 7 of the Data Processing Agreement.

Personal data is not disclosed to the public.

9. Transfers Outside the European Union

Some service providers may be located outside the European Union. In particular, OpenAI, Twilio SendGrid, Vercel and Neon process, or may process, data in the United States.

Transfers to the United States rely on the European Commission’s adequacy decision for recipients certified under the EU-US Data Privacy Framework, within the limits of their certification, or on the Standard Contractual Clauses adopted by the European Commission together with any necessary supplementary measures. Information on the mechanism applicable to each provider, and copies of the safeguards, can be requested at privacy@invytly.com.

10. Data Retention

  • Customer account data is retained for the duration of the contractual relationship.
  • Project creation link records (the email address and the Project settings prepared for the Customer) are retained for the duration of the contractual relationship.
  • Project-related data (including images and communications) is returned or deleted within 30 days of the Project’s deletion or expiry, as set out in Article 12 of the Data Processing Agreement. Invytly keeps only delivery records without message content and access and security audit records without document or message content, as controller and for up to 24 months each, to demonstrate the performance of the service, handle complaints and investigate incidents, plus any data the law requires it to keep.
  • AI Assistant conversations are retained until the user deletes the conversation or the Project is deleted.
  • Deleting a conversation removes its messages; the records of changes applied through the AI Assistant and the drafts it saved are retained until the Project is deleted.
  • Upon request for account deletion, all personal data is permanently erased, except where retention is required by applicable law.

11. Customer Rights

Customers may exercise their rights under Articles 15–22 of the GDPR (including access, rectification, erasure, restriction, objection, and data portability) by contacting:
privacy@invytly.com

Customers also have the right to lodge a complaint with the competent Data Protection Authority.

12. Technologies used (cookies and similar tools)

For information on the use of cookies and technically equivalent technologies within the Admin Area of the Invytly platform, please refer to the Cookie Notice for the Invytly Platform, which should be read together with this Privacy Policy.

13. Amendments to this Privacy Policy

The Provider reserves the right to amend this Privacy Policy. Any changes will be communicated to Customers by email and published within the Platform.