This is a translation provided for convenience. The Spanish version is the official one and prevails in case of any discrepancy.
The party responsible for processing your personal data is Cocosharon, a business registered in the Republic of Korea (no. 578-03-04209), which operates invitoo. For any privacy matter (including exercising your rights), write to us at .
From you: your phone number or your email (to sign in) and the content of your invitation (names, date, place, photos and texts you write). From your guests: their name and the number of people attending. Their phone number only if you turn on the “Ask for phone number” option, and always as optional for them. If you turn on the guest book or the shared album, also the message they leave and the photos they upload. Usage: aggregate visit statistics (which pages are opened), without cookies and without identifying you, through Vercel Analytics. If you accept analytics cookies, we also record your path through the site (pages, clicks, scrolling and time) with Microsoft Clarity; what you type in forms stays hidden. Payment: none. Payments are processed by Paddle; we never see or store your card details.
Purposes necessary to provide the service to you: creating and publishing your invitation, showing you your guests’ RSVPs, processing the one-time payment for your plan and replying when you write to support. We do not do profiling, and we do not sell or transfer your data to third parties for commercial purposes. If you accept advertising cookies, we use Google Ads and Meta (Facebook and Instagram) to know whether your purchase came from one of our ads; we never send your name, your email or your event details. Even if you don’t accept them, Google Ads receives an anonymous, cookie-free signal for that same purpose.
Only with the providers we need to operate, and only with the data that is necessary: Supabase (database, accounts and photo storage), Vercel (site hosting), Paddle (payment processing and invoicing, as merchant of record) and Twilio (sending the SMS code if you sign in with your phone). If you choose to sign in with Google or Facebook, that account confirms your identity to us. These providers are located outside Mexico and process the data on our behalf, not for their own purposes.
RSVPs are visible only to you, the organizer. The photos in the shared album are seen by whoever you decide: everyone who has the link, only those who RSVP’d, or only you. Your guests don’t need to create an account, and their data is used exclusively for your event. You decide what you ask them for, so it is also up to you to tell them what you will use their data for and not to ask for more than necessary.
You can request Access to your data, its Rectification if it is inaccurate, its Cancellation (deletion), and state your Opposition to our using it. You can also withdraw the consent you gave us at any time. From your profile you can view and correct your data and delete your account yourself. If you prefer to request it in writing, write to from the email you signed up with or stating your phone number; we usually reply within 72 hours and, in any case, within the deadlines set by the applicable law.
We keep your data while your account is active. The photos in the shared album are the exception: they are deleted when that invitation’s availability period ends, even if your account is still active. You can download them before then, or extend the availability period to keep them. To delete your account you must not have any active invitations: if one is still published and within its availability period, you will have to wait for it to end or delete it first. This protects your guests, who might have the link open. After a deletion we keep only the payment records that tax law and our payment provider require us to keep.
If we change this notice, we update the date shown at the top of the page and publish the new version right here. If the change significantly affects how we use your data, we will notify you through your account’s contact method before applying it.