Privacy policy · Invite In

Who we are

Invite In is an app and website for sending event invitations and checking guests in at the door. It is made and run by De Bruine Solutions, a sole proprietorship (eenmanszaak) in Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 97437921, VAT number NL005270681B48. In this policy, "we" and "us" mean De Bruine Solutions.

For questions about your data, email info@debruinesolutions.com.

Who is responsible for which data

Invite In has two kinds of users.

Organizers have an account in the app. They create events, add guests and send invites. Co-hosts and door helpers are organizers who joined someone else's event through a team link.
Guests do not need an account or the app. They get a personal invite from an organizer and open it in a web browser.

We are the controller for the personal data in Invite In, including the guest details that organizers enter: we decide what Invite In stores, how it uses the data and how long it keeps it.

The organizer decides whom to invite and which details to add. A private person inviting friends and family to a private event does that as a household activity, to which the GDPR does not apply. An organizer who is not acting privately, such as a business or an association, is responsible together with us for adding guests and inviting them. In that case we provide this information to guests, answer requests to exercise privacy rights and keep the data secure, and the organizer makes sure it may contact the people it adds. Guests can contact either of us.

What we keep about organizers

Email address, when you sign in with an email link, or the address Apple or Google gives us when you use their sign-in. If you hide your email with Apple, we only get the address Apple creates for you.
Name, if you enter one or Apple passes it to us when you first sign in. It is optional.
Sign-in identifiers from Apple or Google, if you use their sign-in.
Settings: your language and whether you want notifications for replies and arrivals.
Sign-in links: when you ask for one, we store your email address, a hash of the link's code, the language and when the link expires. The code itself is only in the email.
Sessions: one access token per phone you are signed in on, labelled with the type of phone (iPhone or Android), and when it was last used.
Push tokens: the notification token of each phone that allows notifications, and whether it is iOS or Android.
Your message balance: how many messages for WhatsApp and text updates you have, with a line for every bundle you bought (the store's transaction ID), every message used, and any messages we gave you, which cannot be changed afterwards.
Purchases: for each size you bought for an event, the store's transaction ID and product, and, if we gave you Pro, until when. We never receive card or bank details.
Your events: title, date, time and time zone, venue name and address, description, language, cover photo, your own invite design if you upload one (when you import a design file, the SVG or PDF itself and the pictures taken from it, read on our server and kept with the event), the event's settings, and the messages you send to guests (the text, the group it went to and when).
Your guest book: everyone you added as a guest or walk-in, with the name, email address, phone number and tags you entered, so you can invite them again.
Door activity: every scan and check-in at your events, which team member did it, and walk-ins added at the door.

What we keep about guests

Guest details come from the organizer who invited you, except what you send us yourself. Every invite page and every email we send to guests links to this policy.

What the organizer enters

Your name. If the organizer gives each person in a party their own QR code, each person's name.
Your email address and phone number, if the organizer adds them. Both are optional. The organizer can pick you from their phone's contacts; the app then fills in the name, one email address and one phone number of the contact they picked, and nothing is saved until they confirm. The organizer can also import guests from a spreadsheet file (CSV): the app reads the file on their phone and sends us only each guest's name, email address, phone number, party size and tags, never the file itself.
Tags the organizer gives you, such as "family", and the size of your party.
A personal message to you, if the event uses them.
The language of your invite page and emails, if the organizer picks one for you.
Whether your invite is a link with a reply form or an image to show at the door.

When an organizer adds a guest in the app, the guest's name, email address, phone number and tags are also saved in that organizer's guest book, so they can invite the same person to a later event.

What is recorded when the invite is used

A personal invite link with a random code. Your QR code contains this link.
Each email we send you about the event (the invite, a message from the organizer, a reminder the day before, a change, a cancellation, a place opening up from the waitlist, or an answer to your request to join): the type, the address it went to and when.
Whether that email was delivered or bounced, and the bounce reason, as reported by our email provider.
The first and last time your invite page was opened.
That the organizer shared your invite themselves, for example on WhatsApp, if they mark it as sent.
Your reply (going, maybe or can't), how many of you are coming, when you replied, whether the organizer set the reply for you, and whether you are on the waitlist.
If the organizer asks: your answers to their questions and the names of the people coming with you. Only the organizer and their co-hosts see them. Answer only what you are comfortable sharing; questions are optional unless the organizer marked one as required.
When you were checked in, for how many people, and the name of the team member who scanned you.
If you add your invite to Apple Wallet: the identifier Wallet gives your phone and its push token, so we can update the pass. If you add it to Google Wallet: that you did, so we can update it there. See Wallet passes.

What you send us yourself

Your reply on the invite page.
A report about an invite, with the reason you pick and any details you write.

Walk-ins

If you arrive without an invite and the organizer adds you at the door, we store your name, the number of people with you, and a phone number or email address if the organizer enters one. Organizers can require one of the two for walk-ins. Walk-ins are also saved in the organizer's guest book.

People who ask to join through a sign-up link

An organizer can share an open sign-up link for an event. If you use it, you type your name, your email address and how many of you are coming. Until the organizer answers, we keep these as a request, which only the organizer and their co-hosts see. We send you no email when you ask. The organizer gets a push notification that includes the name you typed.

If the organizer approves, you become a guest of the event like anyone the organizer adds: you get your personal invite email with your QR code, and your name and email address go into the organizer's guest book. The request itself then keeps no name or email address.
If the organizer declines, we send you one short email saying so, and delete the name you typed. We keep your email address for that event only, so asking again does not bother the organizer; we do not use it for anything else.
If the organizer removes the request, it is deleted and nothing is sent.

If you did not ask to join, you can ignore the email. To have your details removed, email us at info@debruinesolutions.com.

WhatsApp and text message updates

If you replied Going or Maybe, your invite page can offer to send you updates on WhatsApp. It is optional and off until you sign up. When you do, you type your mobile number (we fill in the number the organizer entered, if there is one, and you can change it) and agree to the text next to the button, which names Invite In and says what you will get. We do not send a message to confirm it.

What you get: the reminder the day before, a change of time or place, a cancellation, and messages the organizer sends to their guests (including a thank-you). Each names the organizer and has a button or link to your personal invite page. We never send the invite itself, or the "will you come?" reminder, this way.
How: on WhatsApp from "Invite In". If your number is not on WhatsApp, as a text message (SMS) from "InviteIn", or from a number in countries where a sender name is not possible. This works for mobile numbers in the Netherlands, Belgium, Germany and the United Kingdom only; guests elsewhere get email.
What we store: your number (and the user ID WhatsApp gives it, which lets us match a Stop to your number), the event, when you agreed, the exact text you agreed to and its version, whether we use WhatsApp or SMS for you, and for each message when it was sent, which kind and channel it was, and whether WhatsApp delivered it. The text of a message is kept only until WhatsApp confirms it was delivered or the attempt fails; after that the record keeps no text. The organizer sees on your timeline that you signed up, which messages were sent and whether they were delivered, but never your number. The organizer pays for each message from a balance they bought; you pay us nothing (your phone company's normal rates apply to text messages).
A code for another number: if you type a number other than the one the organizer entered, we first send a 6-digit code to that number, by WhatsApp or SMS, to check that it is yours. Until you enter it, that number gets nothing else from us. We keep the number and a keyed hash of the code (never the code itself), the time and how many tries were made, until you enter the code, or for at most one day; the code works for 10 minutes. We limit how many codes can be sent to one number, invite, event, organizer and internet address per day, and for that we count codes sent and tries made. These codes are not messages and use no balance.
How to stop: switch it off on your invite page (this stops it for that event only; the link in a text message opens that page), or reply "Stop" to any WhatsApp message from Invite In. "Stop" ends all messages from Invite In to your number, for every event, at once, and we answer once to confirm. Replying "Start" allows them again. "Remove my details" on your invite page deletes your number and your sign-up.
The stop list: so that a "Stop" is still honoured after details are removed, we keep a one-way code (a keyed hash) of the number and the date, never the number itself. It stays until you ask us by email to remove it. Because the number can in principle be recreated by someone who tries all numbers and holds our key, we treat the list as personal data.

Why we use it, and on what basis

Running organizer accounts, events and purchases: To provide the service an organizer signed up for. Basis: performance of a contract (Article 6(1)(b) GDPR).
Sending invites, messages from the organizer, reminders, changes and cancellations to guests: So the organizer's invitation reaches the guest and the guest hears when the event changes. Basis: the legitimate interests of the organizer and of us in delivering the invitation (Article 6(1)(f) GDPR). Guests are not party to a contract with us, so this is not based on a contract.
Requests to join through a sign-up link, and the emails about them: So a person who asks for a spot gets an answer from the organizer, and the organizer can approve or decline each one. Basis: legitimate interests of the organizer, of the person asking and of us (Article 6(1)(f) GDPR). We keep a record of each decline email, without its text, to cap how many we send and to see whether it bounced.
WhatsApp and text message updates: To send the reminders, changes, cancellations and organizer messages you asked for on your invite page. Basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time by switching the updates off or replying "Stop"; withdrawing does not affect anything before. Also what WhatsApp's business policy requires of us.
Replies, waitlist and check-in at the door: So the organizer knows who is coming and only invited guests get in. Basis: legitimate interests (Article 6(1)(f) GDPR).
The guest book: So an organizer can invite the same people again without typing their details twice. Basis: legitimate interests (Article 6(1)(f) GDPR).
Delivery and bounce status of emails, and invite page opens: So the organizer can see whether an invite arrived and follow up with guests who did not get it. Basis: legitimate interests (Article 6(1)(f) GDPR).
Wallet passes: So a guest who asks for it can keep their QR code in Apple Wallet or Google Wallet, and the pass stays current when the event changes. Basis: legitimate interests (Article 6(1)(f) GDPR).
Push notifications to organizers: To tell organizers about replies and arrivals, only on phones where they allowed notifications. Basis: performance of a contract (Article 6(1)(b) GDPR).
Reports and take-downs: To act on spam, abuse, impersonation and illegal content. Basis: our legal obligations as a hosting service under the Digital Services Act (Article 6(1)(c) GDPR) and our legitimate interest in keeping the service safe (Article 6(1)(f) GDPR).
Security and error logs: To keep the service running and find faults. Basis: legitimate interests (Article 6(1)(f) GDPR).

Where we rely on legitimate interests, you can object at any time (see Your rights). We do not make automated decisions about people, and we do not build profiles for advertising.

Invite page visits

Emails we send to guests contain no tracking images, so we do not know whether you opened one. When your invite page is opened, we record the first and the most recent time. Apps that fetch a page to show a link preview, such as WhatsApp, iMessage, Slack and Telegram, are not counted. Here too we store only the times.

The organizer and their co-hosts see these times in your timeline, together with whether your email was delivered, your reply and your check-in.

Cookies

The website sets two cookies, both needed for it to work:

invite-in-session keeps your visit together between pages, for example to show a confirmation after you reply. It expires after two hours.
XSRF-TOKEN protects the reply, report and remove forms against forged requests. It expires after two hours.

For each visit, the server keeps a session record with your IP address and browser type until the session expires. There are no analytics, advertising or third-party cookies, and the pages load no scripts from other websites. The app contains no analytics or advertising software. The app and our server do send reports of crashes and errors to Sentry, described below.

Within Invite In

The organizer and co-hosts see the guest list, each guest's details and timeline, and the door activity. They can save the guest list to their phone as a spreadsheet file (CSV) with, for each guest, the name and party name, email address, phone number, tags, reply and seats, the names of the people coming along, the answers to the organizer's questions, when the invite was first opened, and how many came and when. The phone makes that file from the guest list; once they save or share it, it is outside Invite In.
Door helpers see guests' names and whether they are checked in when they scan or search at the door. Their phone keeps the names, seats and replies of the event's guests so the door works without internet, but they do not see the guest list.
Guests see the event details and the organizer's name. Emails to guests come from the organizer's name "via Invite In", and replies to those emails go to the organizer's email address, so a guest who replies sees it.
The organizer and co-hosts also see the names and email addresses of everyone on the event's team. Someone opening a team link sees the name of the person who invited them.
We handle reports. Our moderation screen shows events with their organizer's email address and the reports sent about them.

Service providers that process data for us

Each of these works under a data processing agreement with us and may only use the data to provide its service.

Hetzner Online GmbH, Germany: Hosts our server and database in Falkenstein, Germany. All data on this page is stored there, including uploaded photos.
Amazon Web Services (Amazon SES, Amazon S3 and AWS End User Messaging SMS), Frankfurt, Germany: Sends our emails: sign-in links and guest emails. It receives the recipient's address and the content of the email, and tells us whether it was delivered or bounced. It also sends the text messages to guests who signed up for updates and whose number is not on WhatsApp, and receives the number and the text. It also stores our nightly backups, encrypted with a password only we hold.
Meta Platforms Ireland Limited (WhatsApp Business Platform): Delivers WhatsApp messages to guests who signed up for updates. It receives your number and the message: your first name, the organizer's name, the event's title, date and place, and for a message from the organizer its text. It tells us whether a message was delivered or failed, tells us your WhatsApp user ID, and passes on replies such as "Stop". WhatsApp's own terms and privacy policy apply to your use of WhatsApp itself.
Google (Firebase Cloud Messaging): Delivers push notifications to organizers' phones, through Apple's notification service on iPhones. It receives the phone's push token and the notification text, which contains the event title and a guest's name, for example "Noor is going".
RevenueCat: Keeps track of the sizes you buy for your events in the App Store and Google Play. It receives your Invite In account number and your purchase history from the store. We do not send it your name or email address.
Sentry (Functional Software, Inc.): Receives reports when the app crashes or the app or server runs into an error, so we can fix it. A report contains what went wrong and where in our code, the app version, the type of phone and its system version, and the address of the page or request that failed. We do not send it names, email addresses or your account, and Sentry is set not to store IP addresses.

Cloudflare provides the domain name service for invitein.app. Your visits do not pass through Cloudflare, and it receives no personal data from us.

Apple and Google

When you buy a size for an event, Apple (through the App Store) or Google (through Google Play) sells it to you and handles the payment, under their own terms and privacy policies. The same applies when you sign in with Apple or Google. For that data they are responsible themselves.

Wallet passes

On your invite page and in the invite email you can add your invite to Apple Wallet or Google Wallet. The pass shows the event's title, date, time and venue, its cover photo, the organizer's name, your name (or the name on your QR code), the number of seats and your QR code.

Apple Wallet: your phone downloads the pass from us. While the pass is in Wallet, your phone registers with us for updates and we keep the device identifier and push token it sends. When the event changes or is cancelled, or your invite is replaced or removed, we send a notification through Apple's push notification service that contains only that push token and no other data; your phone then fetches the new version of the pass from us.
Google Wallet: when you add the pass, we send its content to Google, which keeps it in your Google account. When the event changes we send Google the new details, and when your invite is replaced or removed, or the event is cancelled or deleted, we mark the pass as no longer valid.

Apple and Google handle Wallet under their own terms and privacy policies. A pass you added stays in your Wallet until you remove it.

We do not sell personal data and do not use it for advertising.

Outside the European Economic Area

Our server and email sending are in Germany. Some providers are based in the United States, so data they receive can be processed there:

Google LLC and Amazon Web Services are certified under the EU-US Data Privacy Framework, which the European Commission has found to give adequate protection. So is Sentry (Functional Software, Inc.), which stores error reports in the United States.
Meta Platforms (WhatsApp) may process WhatsApp messages in the United States and other countries. We rely on the safeguards in WhatsApp's business data processing terms.
Transfers to RevenueCat are covered by the European Commission's standard contractual clauses in its data processing agreement.
Apple handles App Store purchases in the EU through Apple Distribution International in Ireland, and is responsible for its own transfers.

How long we keep data

Events are deleted 6 months after they end, with their guests, timelines, replies, door activity, photos, design files and reports. An event without an end time counts as ended 12 hours after it starts. Before that, the organizer can delete a guest or the whole event at any time.
Sign-up requests are deleted with their event. A declined request keeps only the email address, to stop the same address from asking again; an approved or removed request keeps no name or email address.
Sign-ups for updates (number, WhatsApp user ID, consent and its text) are deleted with their event, or at once when you use "Remove my details". The record of each message sent (kind, channel, time, delivered or not, no text) is kept for 90 days after it was sent and then deleted. If the event is deleted sooner, the record stays until then without any link to the event or the guest, so that the organizer can still be charged correctly for a message WhatsApp reports on later. Verification codes are deleted when entered and in any case after one day. The stop list's one-way codes stay until you ask us to remove them.
Guest books are kept until the organizer deletes an entry or the account.
Reports are kept until the event they are about is deleted.
Sign-in links stop working after 15 minutes or once used, and are deleted within a day after that.
Push tokens are removed when you sign out of the app, when Google reports that the token no longer works, or when you delete your account.
Wallet registrations (the device identifier and push token of a phone with your pass in Apple Wallet) are removed when you remove the pass from Wallet or when Apple reports that the token no longer works. When the organizer removes you from the event, or the event or the organizer's account is deleted, your pass is marked as no longer valid first. So that your phone can show that, we keep a void version of the pass, with only the event's title, date and venue and no details about you, together with the device identifiers of the phones that keep it. It is deleted once the pass is removed from Wallet on every phone, and after 30 days at the latest.
Door copies: so the door keeps working without internet, a phone in door mode keeps a temporary copy of the event's guests: each guest's name and party name, seats, reply, whether they are on the waitlist or their QR code was replaced, and when they were last checked in, with a one-way code (a hash) of each invite's QR code instead of the code itself. It never holds email addresses, phone numbers or the names of team members. The app deletes the copy when door mode is closed after the event, and otherwise the first time the app is opened or brought back more than 6 hours after the event ends. It also deletes it when the event is no longer in your list of events, and when you sign out.
Scans made without internet stay on the phone until they are sent, including the phone number or email address of a walk-in if one was typed in. Before you sign out, the app tries to send them; if some can't be sent, it tells you how many and you choose whether to sign out and delete them. If your session ends another way, they stay on the phone and are sent after you sign in again.
Website sessions expire after two hours and are then cleared from the server.
Logs: our web server keeps no log of visits. Error logs, which can contain the IP address of a request that failed, are kept for 14 days. Error reports at Sentry are deleted after at most 90 days.
Backups: every night we make an encrypted backup of the database and uploaded images. Each backup is kept for 14 days and then deleted, so data you delete is gone from the backups within 14 days as well. A backup is only used to restore the service after a fault.

Removing your details as a guest

At the bottom of your invite page, "Remove my details" removes from your invite:

your email address and phone number, also from the record of every email we sent you and from your timeline,
the personal message to you,
your phone number and WhatsApp user ID for WhatsApp and text updates, and your sign-up for them,
the times your invite page was opened,
your answers to the organizer's questions and the names of the people coming with you.

It also removes your email address and phone number from the organizer's guest book entry for this invite. Your name, your reply and the fact that emails were sent stay, so the invite still works at the door. Without an email address you get no more emails from Invite In about this event.

It does not touch other events where the same organizer added you separately. To have your details removed there too, or to have your invite deleted completely, email us at info@debruinesolutions.com or ask the organizer. The same goes for a request to join that you made through a sign-up link.

Deleting an organizer account

You can delete your account in the app under Account, Delete account. This deletes your account, your events with their guests, timelines, replies and door activity, the cover photos and designs uploaded for them, your guest book, your team links and memberships, and your push tokens and sessions. Guests' invite links stop working.

Without the app, you can ask us to delete your account by emailing info@debruinesolutions.com from the address on your account. We delete it within one month.

Your rights

You can ask us for access to your data, to correct it, to delete it, to restrict its use, or to receive it in a common file format, and you can object to its use based on legitimate interests. Email info@debruinesolutions.com. We answer within one month; if a request is complex we can extend that by two months, and we tell you so within the first month. We may ask you to confirm that the data is yours.

Organizers can see, change and delete their own events, guests and guest book in the app. Guests can also ask the organizer who invited them, since the organizer can change or delete their details directly.

You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or the authority in the EU country where you live.

Children

You must be 16 or older to create an organizer account. Invite In does not ask guests for their age. An organizer who invites children is responsible for being allowed to add their details, for example as their parent or with their parent's agreement.

Security

All traffic to invitein.app is encrypted with HTTPS.
Each invite link contains a random 24-character code.
Sign-in links work once, expire after 15 minutes, and are stored only as a hash.
Signing out of the app ends the session on that phone.
Only accounts we mark as administrators can open the moderation screen.

Changes to this policy

When we change this policy, we change the date at the top of this page. Before a significant change takes effect, such as a new purpose, a new kind of recipient or a new transfer outside the European Economic Area, we email organizers at least 30 days in advance.

Contact

De Bruine Solutions
Hoptille 301
1102 PE Amsterdam
the Netherlands
+31 6 2480 0527
info@debruinesolutions.com