Privacy Policy
Last updated: September 25, 2026 · Previous versions
1. Who processes your data
Envite is a service of PENDIENTE, with its address at PENDIENTE. It decides how its customers' data is processed and is responsible for it. For any question about your data, write to us at PENDIENTE. That address goes directly to the person who handles it. If you are a guest at an event, please also read the section “If you are a guest”: your data is decided by whoever organises the event.
2. What data we collect
FROM THE PERSON WHO BUYS AND ORGANISES · Identification and contact details: name, email address and, if you choose to give it, telephone number. · Your account: your password, which is stored encrypted with a one-way algorithm and cannot be read by anyone at Envite. · Your events: the data you enter (event name, dates, venues, texts, photographs, chosen music) and the guest list you upload. · Your purchase: which plans you bought, the amount, the tax charged, the currency, the date, the payment identifier and the billing address, which is needed to calculate the IVU sales tax. Also the proof that you accepted the terms and this policy: which version, in which language, when, and the IP address and browser you used. · Your preferences: whether you want to receive offers and news from Envite. TECHNICAL DATA · To curb abuse (automated submissions, brute-force login attempts) we store an encrypted digest of the IP address, never the address itself. It lets us know that two requests come from the same source, not who you are. The only exception is your acceptance of the terms, described above: there we keep the IP address as it is, because it is the proof of the contract and must be possible to verify. · Like any web server, our hosting provider logs the IP address and browser of each request for a limited time, for security and diagnostics. · Technical cookies: see the Cookie Policy. WE DO NOT COLLECT card data: payment takes place entirely on Stripe. We do not build profiles, we do not make automated decisions about you, we do not use your data for advertising or sell it, and we do not use it to train artificial intelligence systems.
3. What we use it for
· To provide the service you purchased: creating your account and your events, publishing your invitation, collecting RSVPs and managing your album. · To take payment, issue receipts, calculate and report taxes (such as the IVU) and keep accounting records. · To send you the emails that are part of the service: your purchase confirmation, access to your account, the notice before an event is deleted and the acknowledgement of a cancellation. You cannot unsubscribe from them while you have an active purchase, because the service does not work without them. · To protect the platform and its users: limiting automated requests, detecting abuse and keeping a record of important operations, using only pseudonymised data and only what is strictly necessary. · To handle your requests, complaints and cancellations, to comply with the law and to be able to show which terms you accepted if a claim arises. · To send you offers and news from Envite, ONLY if you asked for them: with the optional box in the basket or from your profile. You can unsubscribe whenever you like, from your profile or with the link included in each of those emails, which also include our postal address. We will not use your data for a different purpose without telling you first.
4. If you are a guest
If you arrived here from an invitation: whoever organises the event decides what data to ask you for and why, and is responsible for it. Envite processes it on their behalf, as a service provider, only to provide the event's service. It does not use it for anything else or sell it. What data: whatever the host has entered about you (your name and, if they have them, your email or telephone number), your reply to the invitation (whether you are attending, how many people, your message and your answers to the host's questions) and, if you upload photos to the album, the photos and the name you choose to add. To prevent abuse we also store an encrypted digest of your IP address and your browser type. Who sees it: your answers, only the hosts. Album photos, the hosts and anyone who has the album link. The published invitation is visible to anyone with its link, but never shows the guest list or their answers. How long: up to 45 days after the event; after that they are permanently deleted. Your rights: you can ask the host to give you access to your data, correct it or delete it. You can also write to us at PENDIENTE: we will pass your request on or, where appropriate, handle it directly. If the host asks you about allergies or other health data, please also read the next section.
5. Guests’ health data
This section is our consumer health data privacy policy, for the purposes of Washington's My Health My Data Act and similar laws in other states. What data: only what a guest chooses to share when answering a question from the host, such as allergies, intolerances, dietary or mobility needs. Envite does not ask for health data on its own account or infer it from anything. What for: solely so that the host can organise the event (the menu, access to the venue). It is not used for advertising, it is not sold and it is not shared with anyone other than the event's hosts and the technical providers in section 6, who store it on our behalf. Your consent: answering is always voluntary. In the RSVP form we explain who will see your answer and why; if you answer, you agree to it being used for that purpose and nothing else. You can withdraw your consent whenever you like: ask the host to delete your answer or write to us at PENDIENTE. Your rights: to know what health data of yours we hold and who it has been shared with, to ask for a copy and to ask for it to be deleted. We will reply within 45 days at most. If we refuse your request, you can ask us to reconsider it and, if you still disagree, complain to your state's Attorney General. How long: the same period as the rest of the event's data.
7. Where it is stored
Our providers store the data in the United States or may access it from there. If you use Envite from another country, your data will be processed in the United States. If you are in the European Union, the European Economic Area or the United Kingdom, section 14 explains the safeguards for those transfers.
8. How long we keep it
· Your account: for as long as you keep it. If you ask us to delete it, we delete your personal data and that of the guests at your events; we only keep, blocked, what the law requires us to retain about your purchases. · An event's content (photos, invitation images, guests and their answers): up to 45 days after the event ends. We email you at least 7 days beforehand so that you can download anything you want to keep. · An event you delete: it stops being accessible immediately and its content is permanently deleted after 30 days. That margin exists only so that a mistake can be undone if you ask us. · Your purchases, your acceptance of the terms (with the IP address and browser you accepted from) and your cancellation requests: for the periods required by tax and commercial law, and for as long as liability arising from the contract can be claimed. · The encrypted IP digest we use to curb abuse: 24 hours. Audit logs: for as long as they are needed for the security of the service and to defend against claims.
9. How we protect your data
Each event is isolated at database level through row-level security policies: no other Envite user can query your events, your guests or their answers, even if they know their identifiers. Private links (personal RSVP, album, Save the Date) use 256-bit random codes that are impossible to guess. Everything travels encrypted (HTTPS), passwords are stored with one-way encryption, session cookies cannot be accessed from JavaScript and internal access is restricted and logged. If we suffered a security breach affecting your data, we will notify you without delay, explaining what happened and what you can do. If you live in Puerto Rico, we will also notify the Department of Consumer Affairs (DACO) within 10 days of detecting it, as required by Act 111-2005; if you live in another state, we will comply with its notification law. If it affected guests' data, we will also notify the hosts.
10. Your rights
Wherever you are, you can ask us to: · Tell you what data we hold about you and give you a copy. · Correct it if it is inaccurate. · Delete it. · Give it to you in a format you can take to another service. · Stop sending you news from Envite. Write to us at PENDIENTE or use the links under “Your data and your rights” in your profile. We will reply within 30 days at most, and we may ask you to prove your identity so as not to hand your data to someone else. You can act through an authorised agent, who will need to prove your authorisation. If you live in a state with its own privacy law (such as California, Colorado, Connecticut, Texas or Virginia), these rights are also legal rights. We will not treat you differently for exercising them. If we refuse a request, you can ask us to reconsider it by replying to our email; if you still disagree, you can complain to your state's Attorney General. In Puerto Rico you can also go to DACO.
11. “Do Not Track” and Global Privacy Control
Some browsers send the “Do Not Track” or Global Privacy Control signal to ask that the person not be tracked across sites. Envite does not track anyone across sites, does not allow third parties to do so from our pages and does not sell or share data for advertising. That is why the site works the same with or without those signals: what they ask for is always already the case.
12. Children
Envite is not directed at children under 13 and we do not knowingly collect data from children under 13. To create an account or make a purchase you must have the legal capacity to enter into a contract. If a host invites children, it is the host who decides what data about them to enter, and a child under 13 should RSVP through their parents or guardians. If we discover that we have collected data from a child under 13 without parental consent, we will delete it. If you are a parent or guardian and believe this has happened, write to us at PENDIENTE.
14. If you are in the EU, the EEA or the United Kingdom
If you are in the European Union, the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) or its UK equivalent also applies: · Legal bases: performance of the contract (Art. 6(1)(b)) to provide the service; compliance with legal obligations (Art. 6(1)(c)) for invoicing; our legitimate interest in the security of the service (Art. 6(1)(f)), which does not override your rights because we only use pseudonymised data; your consent (Art. 6(1)(a)) for news; and, for guests' health data, their explicit consent (Art. 9(2)(a)). · For guests' data, Envite is the host's processor (Art. 28). Clause 9 of the Terms of Service is that contract. · Transfers: our providers are in the United States. Transfers are based on the EU-U.S. Data Privacy Framework where the provider has joined it, or on the European Commission's standard contractual clauses (Art. 46). · In addition to the rights in section 10, you can object to processing, ask us to restrict it and withdraw consent without affecting what was done before. · If we suffered a breach affecting you, we would notify the supervisory authority within 72 hours where the law requires it. · You can complain to the data protection authority of your country (in Spain, the Agencia Española de Protección de Datos). · We have not appointed a data protection officer because, given our size and activity, it is not mandatory.
15. Changes to this policy
If we change this policy we will update the date at the top. If the change is relevant to you, we will let you know by email before it applies.