QRinvites
Privacy policy
Last updated: September 14, 2026
Controller
Using QRinvites involves processing some personal data: this policy explains what data, why and on what legal basis, under the GDPR. You can delete your account and all of its content yourself, from your dashboard, at any time.
Data we process
Account: your Google email when signing in. Invitations: the texts you write (names, dates, venues, story). Guest replies: name, attendance, plus-ones, menu, notes and, only if the host enables it, allergies or intolerances. First-party analytics: usage events with a random local identifier, no third-party cookies and no cross-site tracking. Google Analytics (only if you accept the cookie notice): pseudonymous identifiers and technical usage data.
Allergies: health data
Allergies and intolerances are health data (a special category under the GDPR). They are only collected if the host enables that question and the guest chooses to answer it (explicit consent), they are used exclusively to organize the event, only the host sees them and they are deleted with the invitation.
Legal basis and purposes
Performance of the service (creating and displaying invitations and managing replies), explicit consent (allergies and, if you accept it, Google Analytics, revocable at any time) and legitimate interest (first-party analytics without identifying people, and service security).
Processors and recipients
We use providers acting as data processors: Supabase (database and authentication, EU-Ireland region), Cloudflare (hosting and delivery) and Google (sign-in and, if you accept the cookie notice, audience measurement with Google Analytics). We do not sell data or share it with third parties for advertising.
Retention
Deleting an invitation immediately and permanently removes the invitation and all its replies. Deleting your account (a visible option in your dashboard) removes your account, invitations and replies.
Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability by the most direct route: from your dashboard you can review and correct your data, and deleting your account immediately and permanently removes all of your content. You can also lodge a complaint with your data protection authority.
International transfers
Some processors (Cloudflare and Google) may process data outside the European Economic Area. Where that happens, the transfer relies on adequacy decisions or on the European Commission’s standard contractual clauses, which ensure an equivalent level of protection.
Measurement with Google Analytics (only if you accept it)
If you accept the cookie notice, we load Google Analytics 4 to see which pages are visited and from which channel, using pseudonymous identifiers; we do not use it for advertising or to build commercial profiles, and advertising signals are always switched off (Consent Mode). The legal basis is your consent, which you can withdraw at any time by clearing this site's data in your browser: the tool stops loading and the notice asks you again. The provider is Google Ireland Limited (Gordon House, Barrow Street, Dublin, Ireland), which may transfer data to Google LLC in the United States under the EU-U.S. Data Privacy Framework. Identifiers last a maximum of two years in your browser.