Privacy Policy

Last updated: August 25, 2026

The short version: Easy Evite collects the information needed to provide accounts, invitations, RSVPs, and optional Guest Messaging. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it for third-party advertising. We use one privacy-respecting analytics tool to understand how the site is used, described below.

Who we are

This service is operated by Quietcraft, a company organised under the laws of Vietnam with its registered office in Hanoi, Vietnam. Quietcraft is the controller of the personal data described in this policy, except for guest data, which is covered in “Hosts, guests, and who is responsible” below. Easy Evite is a product of Quietcraft.

You can contact us about anything in this policy at hello@easyevite.us. That is the address for every access, correction, deletion, objection, or complaint request described here.

Scope

This policy covers the Easy Evite website, the Easy Evite mobile apps, and the other brands under which Quietcraft offers the same platform. It applies to hosts who create an account, to guests who receive an invitation or submit an RSVP, and to visitors to our public pages. It does not cover any third-party site you reach from a link in an invitation.

What we collect, and why

Data	Why
Your email address, name, login credentials, and Terms acceptance record	To create and secure your account, recognize you when you return, and document signup consent.
Events you create (title, date, location, image)	So we can render your invitation.
Guest contacts you add (name, optional email/phone, notes)	So we can generate each guest's RSVP link and, if you opt in, text it to them.
RSVPs your guests submit (yes/no, party size, message)	So you can see who is coming.
Messages you send through the product, and their delivery status	To deliver invitations and reminders, show you what happened, honour opt-outs, and meet carrier and legal requirements.
Support and chat messages you send us	To answer you and improve our help content.
Technical and usage data (IP address, approximate country derived from it, device and browser information, request paths, feature interactions, and errors)	To operate, secure, troubleshoot, and improve the service, to prevent abuse and fraud, to apply rate limits, and to show the terms that apply in your region.

We ask for the minimum we need. We do not ask for, and you should not enter, government identifiers, payment-card numbers, health information, or other sensitive categories of data — see Section 6 of the Terms.

What we do not do

We do not sell, rent, or share your data or your guests' data with marketers, data brokers, or advertising networks.
We do not share personal information for cross-context behavioural advertising, and we do not run advertising or retargeting pixels.
We do not send marketing messages to your Guests.
We do not use your content or your guests' data to train advertising models, and we do not make decisions about you by purely automated means that produce legal or similarly significant effects.

Hosts, guests, and who is responsible

When you create an event and add guests, you decide who is invited and what information about them we receive. Under data-protection law that makes you the controller of your guests' personal data, and us your processor for that data: we process it on your instructions, only to run the invitation, RSVP and messaging features you use, and as described in this policy. We remain an independent controller for your own account data and for the security, abuse-prevention and operational records we keep about use of the service.

Practically, that means: if you are a guest and you want your details removed from an event, the fastest route is to ask the host who invited you. You can also email us at hello@easyevite.us and we will act on it or pass it to the host, and we will always honour a request to stop being contacted. Section 7 of the Terms sets out the host's obligations, including having a lawful basis before providing us with anyone's details.

Legal bases for processing

Where the EU or UK GDPR, or a comparable law, applies to our processing, we rely on the following bases:

Purpose	Legal basis
Creating and running your account; rendering invitations; collecting RSVPs	Performance of a contract with you (Art. 6(1)(b))
Sending invitations and reminders on your instruction	Performance of a contract with you; for guests, the host's own lawful basis, with us acting as processor
Security, abuse and fraud prevention, rate limiting, debugging, service analytics, improving the product	Our legitimate interests in running a safe and functioning service (Art. 6(1)(f)), balanced against your rights
Optional features you switch on (Google Contacts import, SMS)	Your consent (Art. 6(1)(a)), which you can withdraw at any time
Analytics and other non-essential cookies, where consent is required in your country	Your consent
Keeping records to meet legal obligations and to establish, exercise or defend legal claims	Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f))

You may object to processing based on legitimate interests at any time by emailing us; we will stop unless we have compelling legitimate grounds that override your interests, or we need the data for legal claims.

Third-party services we use

We share personal data with service providers only to the extent they need it to perform a service for us, under contracts that require them to protect it and to use it for no other purpose.

Google, only if you choose "Sign in with Google." Google sees that you signed in to Easy Evite. Subject to Google's privacy policy.
Google Contacts, only if you choose "Import from Google" on your guest list, and only after you grant permission on Google's own consent screen. We request read-only access (contacts.readonly) and use it for one thing: showing you a list of your contacts so you can pick which ones to invite. Only the contacts you tick are saved, as guests on that event. The rest are discarded. We hold the list in memory for up to 10 minutes to draw the picker, then drop it. We never request a refresh token, so the permission cannot be reused later without you starting the import again. We do not use this data for advertising, we do not sell it, we do not share it with anyone, and no human at Easy Evite reads it. You can revoke access any time at myaccount.google.com/permissions.
Google Analytics, which we use to measure how our pages are used (visits, pages viewed, approximate location, device and browser type) so we can improve them. It sets its own cookies and receives your IP address. We use it for measurement only: we do not enable its advertising or audience-targeting features, and we do not use it to build advertising profiles. You can opt out with Google's browser add-on, by blocking cookies, or by sending a Global Privacy Control signal, which we honour where the law requires. See the Cookies section below.
Hosting and infrastructure providers, which run the servers and storage the service depends on and may process any data in the table above in the course of doing so.
Let's Encrypt, provides our HTTPS certificate. They don't see your data.
Email provider, receives the email address and message content needed to deliver account verification and service emails.
SMS provider, if you use Guest Messaging, receives each Guest's phone number and the message content needed to deliver the text and comply with carrier rules.

We may also disclose personal data: to comply with a law, regulation, subpoena, court order or lawful request from a public authority; to enforce our Terms; to detect, prevent or address fraud, security or technical issues; to protect the rights, property or safety of Quietcraft, our users, or the public; and, if Quietcraft is involved in a merger, acquisition, financing, reorganisation or sale of assets, to the parties to that transaction, subject to this policy continuing to apply. Where we are legally able to, we will tell you before disclosing your data in response to a government request.

Limited Use of Google user data

Easy Evite's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use Google Contacts data only to provide the guest-import feature you asked for, we do not transfer it to others except as necessary to provide that feature, we do not use it for advertising, and we do not allow humans to read it except with your explicit permission, for security purposes, or to comply with applicable law.

How long we keep your data

We keep personal data only as long as we need it for the purpose it was collected for, and then delete or de-identify it.

Account and event data: while your account is active. Deleting an event removes it and its guest list; deleting your account removes your account data.
Google Contacts import: the contact list is held in memory for up to 10 minutes and then dropped. Only the contacts you tick are stored, as guests.
Message and delivery records: kept for as long as needed to run the feature, show you what happened, and meet carrier and legal requirements.
Opt-out and suppression records: kept indefinitely. We have to remember that someone asked not to be contacted in order to keep honouring it.
Security, abuse and diagnostic logs: kept for a limited period appropriate to the purpose, then deleted or de-identified.
Backups: deleted data can persist in routine backups for a short retention window before being overwritten.

We may retain limited records for longer where reasonably necessary for security, fraud prevention, legal compliance, dispute resolution, enforcement of our Terms, or backup recovery.

Where your data is processed, and international transfers

Quietcraft is established in Vietnam, and our servers and most of our service providers are located in the United States. Your personal data is therefore transferred to, stored in, and processed in the United States and accessed from Vietnam, and may be processed in other countries where our service providers operate. Those countries may have data-protection laws that differ from those in your own country.

Where we transfer personal data out of the EEA, the United Kingdom or Switzerland, we rely on appropriate safeguards — principally the European Commission's Standard Contractual Clauses (and the UK Addendum or the UK International Data Transfer Agreement, as applicable) with our processors, together with the technical and organisational measures described under “Security”. You can ask us for more information about these safeguards at hello@easyevite.us. Where a transfer out of Vietnam requires an impact assessment or filing under Decree 13/2023/ND-CP, we maintain it.

Your rights

Wherever you live, you can:

Export your guest list and RSVPs as CSV from any event's page.
Delete an event or your entire account at any time from the product.
Email hello@easyevite.us to request access to, a copy of, correction of, restriction of, objection to, or deletion of your personal data, or to withdraw a consent you have given.

We answer requests without undue delay and, where a deadline applies, within the period the law sets (30 days under the GDPR, extendable by two further months for complex requests; 45 days under California law, extendable once by a further 45 days). We do not charge for this, and we will not treat you differently for exercising a right. We may need to verify your identity before acting — usually by asking you to confirm from the email address on the account — and we may decline or limit a request where the law allows, in which case we will tell you why. If you ask us to delete data that belongs to an event created by someone else, we will pass the request to that host, since they control it.

Terms for your region

You appear to be connecting from United States, so the United States block below is marked as the one that applies to you. Some countries give you extra rights. All of the blocks below are part of this policy; the one for your region adds to, rather than replaces, everything above.

European Economic Area, United Kingdom and Switzerland

If the EU GDPR, the UK GDPR or the Swiss FADP applies to you, you have the right to: access your personal data; have it corrected; have it erased; restrict or object to its processing (including a general right to object to processing based on legitimate interests); receive it in a portable, machine-readable format and have it transmitted to another controller where technically feasible; and withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

We do not carry out automated decision-making that produces legal or similarly significant effects on you, and we do not profile you for advertising.

Complaints. You have the right to lodge a complaint with your national data-protection supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk); in Switzerland, the FDPIC; in the EEA, the authority for your country, listed at edpb.europa.eu. We would appreciate the chance to resolve it first: hello@easyevite.us.

Transfers. See “Where your data is processed” above. Personal data is transferred outside the EEA/UK under Standard Contractual Clauses and the UK Addendum.

Cookies. Because your law requires consent before non-essential cookies are set, we do not set analytics cookies for visitors in the EEA, the UK or Switzerland. Google Analytics is configured to run without analytics storage for these regions, so no analytics cookie is written and no analytics identifier is stored on your device.

United States

This block applies to residents of U.S. states with comprehensive privacy laws, including California (CCPA as amended by the CPRA), Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and others as they take effect.

Categories of personal information we collect (using the California categories): identifiers (name, email, phone number, IP address, account identifiers); customer records (contact details you supply); commercial-adjacent information (records of the events and messages you create); internet or network activity (browsing and interaction data on our own site); coarse geolocation inferred from IP address; and the content of communications you choose to send through the service. We collect these from you, from your device automatically, and from a sign-in or contact-import provider if you choose to use one. We use and disclose them for the purposes described in this policy, and we disclose them to the categories of service provider listed above.

We do not sell personal information, and we do not share it for cross-context behavioural advertising — including the personal information of anyone we know to be under 16. We do not use or disclose sensitive personal information for any purpose other than those permitted without a right to limit under the CCPA.

Your rights: to know what we collect, use and disclose; to access a copy in a portable format; to correct inaccurate information; to delete your personal information; to opt out of sale/sharing and of targeted advertising (we do neither, so there is nothing to opt out of); to limit use of sensitive personal information; and not to be discriminated or retaliated against for exercising any of these. Exercise any of them by emailing hello@easyevite.us. You may use an authorised agent, who must provide written proof of authorisation. Where a state gives you the right to appeal a refusal, reply to our decision email and a different reviewer will consider it and respond within the statutory period.

Global Privacy Control. We honour GPC and similar browser opt-out preference signals where the law requires it.

Notice of financial incentive: none. The service is free and we offer no incentive in exchange for personal information.

Shine the Light (California Civil Code §1798.83): we do not disclose personal information to third parties for their own direct-marketing purposes.

Canada, Australia and New Zealand

Canada. We handle personal information in accordance with PIPEDA and applicable provincial privacy laws (including Quebec's Law 25). You may access and correct your personal information, and withdraw consent subject to legal or contractual restrictions, by emailing hello@easyevite.us. Personal information is stored and processed outside Canada, principally in the United States, and is therefore subject to the laws of those jurisdictions and accessible to their courts and authorities in accordance with those laws. You may complain to the Office of the Privacy Commissioner of Canada or to your provincial commissioner.

Australia. We handle personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth). You may request access or correction, or complain about a breach of the APPs, at hello@easyevite.us; we will respond within a reasonable period, and if you are not satisfied you may complain to the Office of the Australian Information Commissioner. We disclose personal information to overseas recipients, principally in the United States and Vietnam.

New Zealand. We handle personal information in accordance with the Privacy Act 2020, including its rules on overseas disclosure. You may request access or correction at hello@easyevite.us, and may complain to the Office of the Privacy Commissioner.

Vietnam

Quietcraft is established in Hanoi and processes personal data in accordance with Decree 13/2023/ND-CP on Personal Data Protection, the Law on Cybersecurity, the Law on Protection of Consumer Rights, and other applicable Vietnamese law. As a data subject you have the rights that decree gives you, including the rights to be informed, to consent and to withdraw consent, to access, to correct, to erase, to restrict processing, to object to processing, to receive your data, to complain, to denounce and to initiate legal proceedings, and to claim compensation for damage caused by a violation. Exercise them at hello@easyevite.us; we respond within 72 hours of a valid request where the decree requires it. We maintain the personal-data processing impact assessment and, where applicable, the cross-border transfer dossier the decree requires, and we notify the competent authority of a personal-data breach within the period it prescribes.

Everywhere else

If you are outside the regions listed above, the rights described under “Your rights” apply to you as a matter of our policy, whether or not your local law requires them, and any additional right your local law gives you applies as well. Email hello@easyevite.us and we will honour it.

Cookies and similar technologies

We use two kinds:

Strictly necessary. A session cookie set when you sign in, so you don't have to sign in on every page; a small number of preference cookies (for example your language); and cookies used for security and rate limiting. These cannot be switched off without breaking the service.
Analytics. Google Analytics cookies, which count visits and show us which pages are used. These are not advertising cookies, they are not used to build a profile of you across other websites, and we do not enable Google's advertising or audience-sharing features on them. They are not set for visitors in the EEA, the UK or Switzerland — see below.

You can block or delete cookies in your browser at any time; blocking the strictly necessary ones will stop you from staying signed in. For visitors in the EEA, the United Kingdom and Switzerland we do not set analytics cookies at all — Google Analytics is configured with analytics storage denied for those regions, so no analytics cookie is written unless and until consent is given. We honour Global Privacy Control signals where the law requires. We do not use advertising or retargeting pixels, and we do not track you across other companies' websites.

Children

Easy Evite is not directed to children under 13, and we do not knowingly collect personal information from children under 13. In the EEA and the UK, the minimum age is 16, or the lower minimum age of digital consent set by your country, unless a parent or guardian consents. A host must not add a child's details as a guest without the consent of that child's parent or guardian where the law requires it. If you believe a child has given us personal information, email hello@easyevite.us and we will delete it.

Security

We use reasonable administrative, technical, and organisational safeguards designed to protect personal information, including encryption in transit (HTTPS), one-way hashing of passwords so they are never stored in readable form, access controls limiting who can reach production data, and monitoring for abuse. No internet service is completely secure and we cannot guarantee absolute security, so please do not put highly sensitive information into invitations or RSVP messages. If a personal-data breach occurs that is likely to result in a risk to your rights, we will notify you and the competent authorities within the period the applicable law requires.

Changes to this policy

We may update this policy. When we do, we will change the “Last updated” date at the top, and for a material change we will give notice by email or in the product before it takes effect. Continuing to use the service after a change takes effect means you accept the updated policy, except where the law requires your express consent, which we will ask for.

Contact

Questions, requests, or complaints: hello@easyevite.us. The service is operated by Quietcraft, Hanoi, Vietnam.