InviteMagic Privacy Policy

1) Information We Collect

We collect the following categories of information:

1. Account and authentication information
   • Phone number used for OTP sign-in.
   • Account identifiers (for example, user ID).
2. Invite/project content you provide
   • Bride/groom names, family surname, hashtag, venue, event dates/times/locations.
   • Photos you upload (for example, bride/groom reference photos).
   • Event text and optional PDF files submitted for event extraction.
   • Custom ceremony descriptions and prompts.
3. Generated media and project outputs
   • Generated face options, scene images, cover/schedule/closing card images, scene videos, stitched videos, and generated PDF invites.
   • Project metadata and status (draft/generation/review state, selected events, asset URLs).
4. Billing and credits information
   • Credit ledger/balance, generation job charges/refunds.
   • In-app purchase records (for example, SKU, transaction ID, purchase token/order ID, verification metadata).
   • We do not receive your full payment card number from app stores.
5. Device and security/fraud signals
   • App-generated device ID and client platform.
   • Technical request metadata (for example, IP-based rate-limit signals).
   • Fraud review records (for example, device linkage and risk flags).
6. Support and communications
   • Information you provide when contacting support.

2) How We Collect Information

We collect information:

• Directly from you (account sign-in, uploads, form fields, support contacts).
• Automatically from app and backend operations (device IDs, job status, security/rate-limit telemetry).
• From app store billing and verification workflows.

3) How We Use Information

We use personal information to:

• Authenticate users and secure accounts.
• Create, personalize, and deliver invitation images/videos/PDFs.
• Process credits, verify purchases, and prevent fraud/abuse.
• Operate, maintain, debug, and improve reliability/performance.
• Comply with legal obligations and enforce our terms.

We do not sell personal information for money.

4) AI Processing and Face/Photo Data

To provide core features, uploaded images, prompts, and related project context may be processed by third-party AI providers.

• Face/photo data is used to generate invitation media you request.
• You must have authority and consent to upload photos or information about other people.
• Do not upload unlawful, non-consensual, or sensitive content you are not authorized to provide.

InviteMagic does not use uploaded photos for identity verification, law-enforcement profiling, or unrelated advertising purposes.

5) How We Share Information

We share data only as needed to operate the Service, including:

• Cloud auth/database/storage providers (for account, project, and media storage).
• AI/media generation providers (for requested generation and transformation workflows).
• App store/billing infrastructure (purchase verification and fraud prevention).
• Service providers supporting operations, security, and legal compliance.
• Authorities/law enforcement when required by law.

We require service providers to handle data consistent with contractual and legal requirements.

Current key processors/sub-processors may include:

• Supabase (authentication, database, storage).
• Google services (Gemini generation workflows and Google Play billing verification, where applicable).
• Kie AI video/image APIs (where enabled).
• Apple App Store billing systems (where applicable).

6) Data Retention

We retain data for as long as needed for the purposes in this Policy, including account operations, fraud prevention, legal/tax compliance, and dispute resolution.

Current operational retention behavior includes:

• Project/media/account records: retained until deletion request, account closure, or operational/legal need ends.
• Temporary processing artifacts: short-lived where possible (for example, temporary signed files and transient cache entries).
• Async pipeline job snapshots: time-limited operational records.
• Billing/ledger and anti-fraud records: retained longer where required for accounting, audit, or abuse prevention.

7) Security

We use technical and organizational safeguards, including transport encryption, access controls, signed media URL access patterns, row-level data access controls, and abuse-rate controls.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security.

8) Your Choices and Rights

Depending on your location, you may have rights to:

• Access personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your personal information.
• Request a portable copy of certain data.
• Appeal a denied privacy request where required by law.

To exercise rights, contact: sajjan@thoughtfulstudios.ai.

We may need to verify your identity before fulfilling requests.

9) California Privacy Disclosures

If you are a California resident, you may have rights under the CCPA/CPRA, including rights to know, delete, correct, and limit certain uses of sensitive personal information. You may also have rights related to sale/sharing; InviteMagic does not sell personal information for money.

To submit a California privacy request, contact sajjan@thoughtfulstudios.ai with the subject line "California Privacy Request".

10) Children’s Privacy

InviteMagic is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child provided personal information, contact us and we will investigate and delete where required.

11) International Data Transfers

Your information may be processed in countries other than your own. Where required, we implement safeguards for cross-border data transfers.

12) Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a revised effective date.

13) Contact

Privacy contact: sajjan@thoughtfulstudios.ai

If you are a regulator or law-enforcement authority, include "Privacy Legal Request" in the subject line.