Privacy Policy

1. Overview

This Privacy Policy explains how Graevents collects, uses, and protects information when you use our digital invitation platform during our Philippines beta. It covers both your information as an account holder, and information collected from your guests when they RSVP or check in to your event.

Graevents is operated from the Philippines for customers in the Philippines. It can be used from other countries as a courtesy; if you use it from elsewhere, your information is handled as described in this policy, including being stored and processed outside your own country (see "Third-party service providers" below). We handle personal information in line with the Philippine Data Privacy Act.

2. Information we collect

When you create a Graevents account and use the platform, we collect:

• Account information: your name, email address, and password (stored securely, never in plain text).
• Event details you enter: event title, date, venue, and other invitation content.
• Content you upload: photos and other media used to personalize your invitation. Photos you add to an invitation are automatically resized and compressed when uploaded, which also removes embedded metadata such as location (GPS) data. Photos uploaded earlier, and other uploads such as profile pictures or a gift QR code, are stored as provided.
• Anonymous activity counts for your invitations, for example how many times an invitation was viewed, whether a view came from a QR code scan or a direct link, and how many RSVPs, shares, and card downloads there were. We show these counts to you as the host. They are not tied to an individual guest's identity.
• If you join the referral program as a partner: the payout details you provide (for example a bank or e-wallet account) so we can pay your commissions, and a record of the referrals and commissions attributed to you.
• Payment-related information when you purchase a package or plan. See “Third-party service providers” below for how it's currently handled.
• Basic usage information (such as device and browser information) to keep the service secure and working correctly.

3. Information about your guests

When your guests open your published invitation, RSVP, or check in via QR code, we collect the information they submit (such as name, RSVP status, number of guests, and check-in time) and make it available to you, the event host. As the host, you control this information and are responsible for using it appropriately and in line with applicable law.

For guest RSVPs and check-ins, the host decides what to collect and why, and is responsible for having permission to collect it. Graevents holds and processes that information on the host's behalf, to provide the service to them, and does not use it for its own purposes. The one exception is marketing email from Graevents, which is separate and sent only to guests who opted in, as described below.

A published invitation can be viewed by anyone who has its link or QR code, including the printable QR invitation card you can download. Scanning the QR code simply opens the invitation and does not identify the person scanning. Guests are asked for information only if they choose to RSVP.

Separately, the RSVP form may include an optional, unchecked-by-default checkbox asking whether a guest would like to receive occasional marketing email directly from Graevents (not from you, the host). We only ever email a guest for marketing if they explicitly checked that box. Providing an email address to RSVP never subscribes anyone on its own. Every marketing email includes an unsubscribe link that permanently removes that address from future sends.

If you turn on payment review for a registration event, the registration form also asks guests for the payment reference number from their receipt, a screenshot or PDF of it as proof of payment, or both. We keep the reference number and any file in private storage that only the event host can open (through a short-lived link), we use them only so the host can check the payment, and we delete the uploaded file 30 days after the event date. We never ask guests to enter card or bank account details.

If you turn on “Guest list only” for an event, you add your guests' names (and, if you choose, a short note beside each name) to that event, and a guest who opens your invitation finds their own name with a search. This search runs on our servers: what a guest types is compared with that event's list only to show the matching names and notes (never email addresses or phone numbers), and we do not keep what was typed. We keep a technical record of the connection (such as its IP address) only to limit how many searches can be made and to prevent abuse. Anyone who has your invitation link can use the search and see the notes, so please don't put private details in a note. As the host who created the list, you are responsible for your guests' information: for having the right to share it with Graevents and to use it for your event, and for what you choose to include.

If you turn on the Digital Guest Photobook for an event, guests who scan its QR code or open its link can share photos from the event, with an optional name and a short caption, without creating an account. We save each photo again, which removes hidden details such as the location a phone can store in a photo, and keep it in private storage. Until you approve a photo, only you and your team can see it; only approved photos appear on the live slideshow, which anyone with your private slideshow link can open. Guests who share photos see how many moments have been shared and the photos their own device sent; to match a device to its own photos we keep a random identifier on the guest's device and with each photo, not their name. Guests cannot browse each other's photos. As the host, you are responsible for the photos you choose to show and for letting your guests know that photos they share are visible to others who have the link.

4. How we use information

We use the information above to:

• Provide, operate, and maintain the Graevents platform.
• Render and host your published invitations for your guests.
• Process payments for packages and subscription plans.
• Communicate with you about your account, purchases, and important service updates.
• With a guest's explicit opt-in at RSVP, send that guest occasional marketing email about Graevents: see “Information about your guests” above.
• Help you when you ask us to: at your request, our support staff may open and edit your invitation (for example to fix a detail or adjust its look). Only authorized Graevents admin and support staff can do this, the editor shows that it is being used on your behalf, and each such edit is recorded in an audit log.
• Keep the platform secure and prevent abuse.

5. Third-party service providers

We rely on trusted third-party providers to operate Graevents, including:

• Supabase, for account authentication and database/file storage.
• Vercel, which hosts the Graevents website and application.
• Content loaded into published invitations: Google Fonts, to load the typefaces used by invitation themes, and, only when the host adds them, a Google Maps venue map, a YouTube or Facebook video, and a Spotify or YouTube music player. When a guest opens an invitation that includes these, their browser connects to those providers, which can see the guest's IP address and device information and may set their own cookies, under their own privacy policies.
• During this beta, payments are made manually (bank transfer, GCash, and similar methods) and any proof of payment you choose to upload (optional, though it helps us verify faster) is reviewed by our team. We do not currently route payments through an automated payment gateway. This may change as the product evolves.
• Facebook Messenger, operated by Meta under its own privacy policy: our help chat on this website (Grae) answers common questions on the page itself, and what you tap or type there is not stored or sent anywhere. Its “Chat on Messenger” button opens a conversation with our Facebook Page, and nothing is sent to Meta unless you click it.
• Meta Platforms (Facebook), for advertising measurement, only if you accept advertising cookies on our website: the Meta Pixel and Meta's Conversions API tell us which of our ads led to a visit, a sign-up or a purchase. See “Cookies and similar technologies” below for exactly what is shared.
• An email delivery provider, to send account and event-related notifications, and (only to guests who opted in) occasional marketing email.

These providers only receive the information necessary to perform their function and are bound by their own privacy and security obligations. The list above is the current list of services that handle information for Graevents; we update it when it changes.

Where your information is stored and processed

Our providers store and process information in data centers outside the Philippines, in countries that vary by provider. If you use Graevents from outside the Philippines, that means your information is also handled outside your own country. By using Graevents you understand that your information is transferred to and handled in those places. We choose providers with their own security and privacy commitments and we send them only what they need to do their job.

6. Data retention

Your event date can be changed until the event's date and time have passed, and other details can be corrected for the rest of the event day. From the next day the invitation is read-only and is marked completed. Its public link stays active for a post-event access period, which by default is one year after the event date, and after your event you can deactivate the link sooner from your event page. When that period ends, the invitation is marked expired and the public link is disabled. Once a further invitation expiration period elapses, the event is archived. These windows are configurable and may differ by organization or event.

Archiving disables public access and editing, but does not delete your data: your invitation content and guest RSVP/check-in data remain stored in our systems. Account and event data is otherwise retained for as long as your account remains active. You can request an export or closure and eventual deletion of your organization's data at any time from Settings → Privacy & Data. See "Your rights and choices" below. Records we're required to retain by law, such as billing records, are kept regardless.

If you create an account but never confirm your email address, we review it after 10 days (20 days if you were invited to join someone else's organization) and may delete it, which removes the name and email address you gave. Nothing is deleted automatically: a member of our team reviews each account first, and we never remove an account that has been confirmed or used, or that has events, payments or referral records.

Proof-of-payment files that guests upload to a registration event are the exception to the above: they are deleted automatically 30 days after the event date. The payment reference number and the host's approval decision stay with the guest's registration record.

Photos that guests share to an event's photo album are another exception: they are deleted automatically 90 days after the event date, together with their previews. We email the event host once, about 3 days before, so they can download the photos first. If a host asks for more time, we can extend that period for their event. A host can also delete any photo at any time, and deleting an event removes its photos.

7. Cookies and similar technologies

We use a small number of first-party cookies and browser storage entries to keep the platform working, and, only if you accept them, advertising cookies from Meta to measure our own ads. We do not sell your information. Specifically:

• Authentication cookies (set by Supabase, our authentication provider) keep you signed in between visits. Strictly necessary — without them, you'd have to log in again on every page.
• Referral attribution cookie (gv_ref) — set only if you arrive via a referral link, so we can credit the right referrer if you later sign up or make a purchase. Expires after 30 days and is never set otherwise.
• Your cookie choice (gv_cookie_consent) — remembers whether you accepted or declined advertising cookies, for six months, so we don't keep asking. Strictly necessary.
• Meta Pixel cookies (_fbp, _fbc) — only if you press Accept on our cookie banner. They are set by Meta and let us measure which ads bring visitors to Graevents.
• Promotional banner dismissal — browser session storage, not a cookie. Remembers that you closed a promotional banner for the rest of that browser session only.
• Theme preference (light/dark) — browser local storage, not a cookie. If you're signed in, this preference is also saved to your account so it follows you across devices.

Advertising measurement with Meta

The Meta Pixel measures page views only on our public website and sign-in pages (not on your guests' invitations), and only after you press Accept. If you accept, Meta receives the pages you view on our website along with your browser's IP address and device information. Once you have an account, the Pixel does not record which pages you visit inside it; it only reports three actions to Meta: that you created an account, that you started a checkout, and that a payment was confirmed (with its amount and currency). These are reported from your browser and may also be sent from our servers, in which case we send your email address in hashed form (a one-way scrambled value) so Meta can match it to its own users and tell us which ad led to the action. We do not send guest information, event details, or the contents of your invitations. If you decline, or never answer, none of this is sent. Meta uses the information under its own privacy policy.

You can change your choice at any time with the “Cookie settings” link at the bottom of our website pages. Declining or withdrawing stops the Pixel and removes Meta's cookies from your browser. A sign-up, checkout or payment that was already reported while you had accepted cannot be taken back from Meta by us.

One exception to keep in mind: content embedded in a published invitation (maps, videos, music, and fonts, described under “Third-party service providers”) is served by those providers, who may set their own cookies when a guest views the invitation. We don't control those cookies; see each provider's own policy.

Your browser's settings also let you block, delete, or be notified about cookies and clear local/session storage at any time. Doing so may sign you out, reset your theme preference, or clear a pending referral attribution.

8. Your rights and choices

You can update your account information at any time from your account settings. From Settings → Privacy & Data, an organization owner can request an export of the organization's data, or request closure of the organization, which submits a request to close and eventually delete its data (except records we're required to retain by law, such as billing records). These requests are handled manually by our support team, who will follow up by email. Wherever you live, you can also ask us at any time to give you a copy of the personal information we hold about you, to correct it, or to delete it, by emailing support@graevents.com. We will reply to every request, and aim to do so within 30 days, subject to records we're required to keep by law. Guests wishing to have their RSVP information removed should contact the event host directly, as hosts control the guest data collected through their own events. A guest who opted in to marketing email can unsubscribe at any time using the link in any marketing email they've received. This permanently removes their address from future sends and does not require contacting the host.

9. Children's privacy

Graevents is not directed at children, and we do not knowingly collect personal information from children.

10. Security

We use industry-standard safeguards, including encrypted storage and access controls, to protect the information you and your guests share with us. No method of storage or transmission is completely secure, but we work to protect your information appropriately.

11. Changes to this policy

We may update this Privacy Policy from time to time. We'll update the "Last updated" date above when we do, and material changes will be communicated to active account holders.

12. Contact us

Questions about this Privacy Policy? Reach us using the contact details at the bottom of this page.