InviteCraft · Information

Privacy Policy

How NoorByte collects, uses, and protects your personal data when you use InviteCraft.

Last updated: 12 October 2026

1. Who we are

InviteCraft is operated by NoorByte ("we", "us", or "our"). This policy explains what personal data we collect, why we collect it, who we share it with, and the choices and rights you have.

2. Information we collect

We collect only what we need to run the service:

• Account details: your name, email address, and password. Passwords are stored only as a secure one-way hash, never in readable form.
• Invitation content: the event details, messages, and photos you add to your invitations.
• Guest responses: when guests reply to a published invitation, their name, response, the number of people attending, and, if they choose to give it, an email address or phone number.
• Payment records: the amount, the order status, and the order and payment references from Razorpay. You enter your card, UPI, or bank details directly with Razorpay; we never receive or store them.
• Technical data: your IP address, browser and device information, and request logs, which we use to keep the service secure and working.
• Messages you send us: the contents of support requests and abuse reports, and the contact details you include.

3. How we use your information

We use your personal data to:

• create and manage your account and keep you signed in;
• save, publish, and display your invitations, and deliver guest responses to you;
• process payments, confirm purchases, and handle refunds;
• protect the service and its users, including preventing fraud, abuse, and unauthorised access;
• respond to your requests and support messages;
• comply with our legal, tax, and accounting obligations.

4. Sharing your information

We do not sell your personal data, and we do not use it for advertising. We share it only:

• with Razorpay, to process payments and refunds;
• with our infrastructure providers, including MongoDB Atlas for database storage and Oracle Cloud Infrastructure for hosting and media storage;
• with Cloudflare, whose Turnstile check on the sign-in and sign-up forms uses your IP address and browser details to confirm that a person is signing in;
• with anyone who has the link to an invitation you publish, who can see the content you chose to publish;
• when required by law, or when needed to protect the rights, safety, or property of our users, the public, or us.

5. Guests and RSVPs

If you reply to an invitation, your response is shared with the host who created it, who can view and export it. Guest responses are never shown on the public invitation. For questions about how a host uses your response, contact the host directly. You can also ask us to remove your response.

6. Cookies and browser storage

We use only essential cookies: one keeps you signed in, and another protects your forms against cross-site request forgery. We do not use advertising or analytics cookies.

Before you sign in, your invitation drafts are saved in your browser's local storage for 7 days after your last edit. Clearing your browser's site data removes them.

7. How long we keep your data

We keep personal data only for as long as we need it:

• Account details: for as long as your account is open. Deleting your account revokes your sessions and immediately removes your name, email address, and password hash from the account record. An account identifier remains linked to retained payment records.
• Invitations and guest responses: deleting your account deletes them permanently at once. An invitation you delete on its own is blocked from guests straight away and becomes eligible for permanent cleanup 30 days after deletion. Archiving an invitation hides it from guests but does not schedule it for deletion.
• Photos: after account deletion, your photos are queued for removal at once and removed shortly after. Otherwise, invitation photos whose uploads completed more than 30 days ago may be removed if no saved invitation references them when cleanup checks. A photo used by another saved invitation is normally kept; a draft stored only in your browser does not reserve an uploaded photo.
• Sign-in sessions: until you sign out or the session expires.
• Payment records, including orders, purchased access, and payment processing events: retained separately for accounting and payment support, including after account deletion. They are not removed by automatic account cleanup.
• Technical logs: for a limited period, for security and troubleshooting.
• Browser drafts: 7 days after your last edit, on your device only. Account deletion does not erase drafts or downloads from your other devices.

These periods are cleanup thresholds, not guaranteed completion times. Scheduled processing, service interruptions, or activity already in progress when you delete your account can delay removal or require additional cleanup. Contact us if content remains available after deletion or you need help with a removal request. Copies in backups, where present, remain until the backups expire; copies downloaded or saved by recipients are outside our control.

8. Security

We protect your data with encrypted connections (HTTPS), hashed passwords, access controls, and limits on repeated requests. No online service can be completely secure, so please use a strong, unique password and tell us promptly if you suspect your account has been misused.

9. Your rights

Subject to applicable law, including the Digital Personal Data Protection Act, 2023, you may:

• ask for a summary of the personal data we hold about you;
• ask us to correct, complete, or update it;
• delete your account from your account page, or ask us to delete it and your personal data, unless we must keep some of it to meet a legal obligation;
• withdraw consent you have given, without affecting processing already carried out;
• nominate another person to exercise your rights in the event of your death or incapacity;
• raise a grievance with us and, if it is not resolved, with the Data Protection Board of India.

To exercise any of these rights, email us from the address linked to your account. We may need to verify your identity before acting on a request.

10. Children

InviteCraft is not intended for anyone under 18. We do not knowingly collect personal data from children without verifiable consent from a parent or guardian. If you believe a child has given us personal data, contact us and we will delete it.

11. Where your data is stored

Your data is stored with our hosting and cloud storage providers, who may process it in India or in other countries, subject to applicable law.

12. Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date above and, for significant changes, give notice on the site.

13. Contact and grievances

For privacy questions, requests to exercise your rights, or complaints, email us. We will respond within the time required by applicable law.

noorbyte.help@gmail.com