Privacy policy

InviteByLink is operated by Become Group LLC, a Delaware limited liability company, 2915 Ogletown Rd, Newark, DE 19713, USA. We decide how the information described here is used. You can reach us at invitebylink@gmail.com.

This page explains what we do with personal information — both for the people who build a baby shower website with us, and for the guests who open one. Our Terms of service explain the agreement itself.

We've written it in plain language. If anything here isn't clear, email us and we'll explain it.

Who this applies to

• Hosts — people who build and publish a baby shower website.
• Guests — people who open a website someone shared with them, and who may reply to an invitation.
• Visitors — anyone who browses our own website, invitebylink.com.

Guests: the host chose what to publish on their website. We host it for them. If you'd like something removed, see "If you replied to an invitation" below.

What we collect

• Your account: your email address, whether you've confirmed it, and your sign-in sessions — a session token, your IP address, your browser, and the dates. You never create a password.
• Your website's content: everything you type — the names you're celebrating, the title, the date, time and time zone, the venue and address, your message, your registry link, your RSVP deadline, and the public contact you choose to show.
• RSVP replies: what a guest fills in — their name, whether they're coming, how many people they're bringing (up to 12 per reply), an optional note, and short theme-specific answers such as a favorite snack. We don't ask guests for an email address or a phone number.
• Payment: handled by Stripe. We keep the status of your payment, the dates, and Stripe's identifiers. We never see or store your card number.
• Support: whatever you send us by email.
• Email delivery records: which emails we sent you, when they were sent, and whether they arrived.
• Technical logs: our hosting provider records requests, including IP addresses.
• Product usage events: five moments in the four steps of building a website — generator started, theme selected, preview viewed, checkout started, purchase completed. Some of these are linked to your account or your website, so we don't describe them as anonymous.
• Visits to our website: the pages you view, the website or campaign that sent you, what you click, how fast the pages load, errors the site runs into, and your browser, type of device, screen size, language and time zone. PostHog collects this for us, without cookies unless you accept them (see below).
• If you accept cookies: a recording of your visits to our website, and your answers if we ask you a short survey (see below).

While you're building, your draft stays on your own device until you reach the payment step.

Why we use it, and on what legal basis

• Creating your account, signing you in, building and hosting your website, taking payment — performing our contract with you.
• Collecting RSVP replies and showing them to the hosts — our legitimate interest, and the hosts', in running their event.
• Keeping the service secure (sign-in logs, blocking spam and fraud) — our legitimate interest in protecting accounts.
• Understanding how people use InviteByLink and where they get stuck — our legitimate interest.
• Using cookies to recognize your browser from one visit to the next, recording your visits and asking you a survey — your consent, which you can withdraw at any time.
• Keeping payment and accounting records — a legal obligation.

We briefly count requests to the RSVP form to block spam. We don't keep the IP address.

How we measure the service

We record the five product usage events listed above, to see where people get stuck while building a website. Some of them are linked to your account or your website, so we don't describe them as anonymous.

We also measure visits to our website with PostHog, an analytics service whose servers are in the European Union (Frankfurt, Germany). When you first arrive, we ask whether we can use cookies.

Until you accept, and if you decline, PostHog stores nothing on your device: no cookie, no local storage. To count visitors, PostHog's servers combine your IP address and browser details with a random value that changes every day, keep only the result and drop the IP address, so a visitor can't be recognized from one day to the next.

If you accept, PostHog stores a cookie and a few values in your browser so it can recognize your browser from one visit to the next, and keeps an anonymous profile of it: where your first visit came from, your browser and your type of device. It also records your visits: what appears on the screen, where you move, click and scroll, and the pages you go through. Everything you type into a field is hidden in these recordings, and while you build a website every word on the screen is hidden too. If we run a short survey, PostHog may show it to you and keep your answers. PostHog doesn't keep your IP address, and none of this is linked to your name, your email address or your account.

While you build a website, we remove the page's text from these records before they leave your browser, with anything that could name you or your event: the names, address and message you enter never reach PostHog. PostHog also receives three of the events above — generator started, theme selected (with the theme) and preview viewed — and nothing that links them to your account or your website.

You can change your answer at any time with "Cookie settings" at the bottom of every page. If you decline, PostHog stops recording and goes back to counting visits without cookies.

We don't use advertising trackers. We don't measure guests on a published invitation, and PostHog records nothing on your dashboard or the sign-in page.

If your browser sends a Do Not Track or Global Privacy Control signal, PostHog isn't loaded at all, and we don't ask about cookies.

Who else sees it

• Neon — hosts our database — your account, your website's content, RSVP replies.
• Resend — sends our emails — email addresses and message content.
• Stripe — processes payments, receipts and disputes — your name, email, payment details and billing country. Stripe decides how it uses payment data as its own controller.
• Vercel — hosts and delivers the website — technical request logs, including IP addresses.
• Google (Gmail) — our support inbox — anything you send us by email.
• PostHog — measures visits to our website, from servers in the European Union — the pages you view, what you click, page speed, errors, and your browser and device details; if you accept cookies, the recordings of your visits and your survey answers.

We don't sell or share your personal information, and we never have.

Your website itself is public to anyone who has its link. We ask search engines not to list it, but a link is not a password: anyone who receives it can open it and pass it on.

Where your information goes

Most of our providers are in the United States, so your information is processed there. PostHog keeps our website statistics on servers in the European Union. We rely on the European Commission's standard contractual clauses, or on a provider's certification under the EU–U.S. Data Privacy Framework, to protect it.

How long we keep it

• Your published website stays online for at least one year after your shower date. We email the hosts at least 30 days before we take it offline, and we delete the replies within 30 days after that. The hosts can keep their own copy of the replies; what they do with it afterwards is up to them. Deleted replies can stay in our provider's backups for a short time before they are overwritten.
• Sign-in links expire after 10 minutes and can be used once.
• Support emails: 24 months.
• Unfinished drafts and accounts that were never confirmed: 90 days, then we delete them.
• Product usage events: 6 months, and sooner if the account or website they relate to is deleted.
• Visits to our website: PostHog keeps them for one year. They hold no IP address. Without cookies, nothing identifies you once the day of your visit is over.
• Recordings of visits: 30 days.
• PostHog's cookie: one year from your last visit, unless you decline or clear it. Your answer to the cookie question stays in your browser until you change it or clear it.
• Payment records: as long as tax and accounting law requires.

Your rights

You can ask us to show you the personal information we hold about you, correct it, delete it, or send you a copy. You can also ask us to limit how we use it, or object to our using it.

Email invitebylink@gmail.com. We answer within 30 days. We may ask you to confirm you control the email address concerned, so we don't hand someone else's information to the wrong person.

You can also complain to your local data protection authority.

If you replied to an invitation

If you replied to an invitation and want your reply removed, email invitebylink@gmail.com with the link of the invitation. You can also ask the host directly.

The host chose what to publish on their website. We host it for them.

If a host named you on their website, they gave us that information. You can ask us or the host to remove it.

Children

InviteByLink is for adults. You must be 18 or older to create a website. We don't knowingly collect personal information from children under 13. A baby or child named on an invitation is information the host chose to publish; the child isn't a user of InviteByLink.

Your California privacy rights

We don't sell or share your personal information, and we never have. You have the rights described above, whatever state you live in.

We don't track you across other websites. If your browser sends a "Do Not Track" or Global Privacy Control signal, we don't load PostHog, our website analytics.

Security

We protect your information with the measures we consider appropriate, including encrypted connections, sign-in links that expire, and access limited to what's needed to run the service. No service can promise perfect security, and we won't pretend otherwise.

If your personal information is ever exposed, we'll tell you and the authorities as quickly as the law requires.

Cookies

Three things are stored on your device whatever you answer, because the site needs them to work:

• A sign-in cookie, so you stay signed in and we know it's you when you manage your website.
• Your draft, saved in your browser while you build a website, so you don't lose your work if you close the tab. It stays on your device until you reach the payment step.
• Your answer to the cookie question, so we don't ask again on every page.

Because they are strictly necessary to provide what you asked for, we don't ask your permission for them.

PostHog's cookie and the values it keeps in your browser are only stored if you accept cookies. We ask with a banner when you first arrive, and "Cookie settings" at the bottom of every page lets you change your answer. Declining is as easy as accepting, and the site works the same either way.

Blocking spam on the RSVP form stores nothing on a guest's device.

Changes to this page

If we change this page in a way that matters, we'll email the hosts, and the date at the top always tells you when the current version took effect.

Contact

Email invitebylink@gmail.com.