Privacy Policy

What we store

• Your account: your name, email address and a securely hashed password.
• Your event: the details you enter — names, date, venue, texts, schedule and design choices.
• Your guests: the names, phone numbers, groups, tables and notes you add, and the answers guests give (coming or not, how many people, a message).
• Photos and music you upload for your invitation.
• Technical logs: basic request information (such as time, page and error codes), kept for a short time to run the service securely.

Where it is stored

Account, event and guest data are stored in a Supabase (PostgreSQL) database hosted in the European Union region chosen by the operator. Photos and music are stored in Cloudflare R2, and the website runs on Cloudflare’s network.

Who can see it

• Your guest list and your guests’ answers are visible only to you (and anyone you give access to your account). Guests see the invitation and their own answer — never the list.
• An invitation is open to anyone who has its link, but it is marked noindex so search engines don’t show it. Personal links contain a random code that only that guest receives.
• A small number of authorised staff can access data when it is needed for support or to keep the service secure.

WhatsApp messages

When you send invitations or reminders from your own phone, the message goes through your own WhatsApp. When you send through KAL Events (Premium), messages are delivered by the WhatsApp provider configured by the operator (Meta’s WhatsApp Business Platform, or Twilio), which receives the guest’s phone number and the message text for that purpose only.

Please only add guests who expect to hear from you.

What we don’t do

• We don’t sell your data or your guests’ data.
• We don’t use it for advertising.
• We don’t send marketing messages to your guests.

Cookies

We only use essential cookies: a session cookie that keeps you logged in to your account. There are no advertising or tracking cookies, and invitations don’t track your guests.

Keeping and deleting your data

Your data is kept while your account is active. From your account settings you can export your guest list, and delete an event or your whole account at any time. Deleted data is removed from our systems; backup copies are overwritten within a short period.

Your rights

You can ask to see, correct or delete your personal information. Guests who want their details removed can contact the event owner or write to us, and we will help.

Changes

If we change this policy in a meaningful way, we will update the date at the top and let account holders know by email.