Privacy policy

• Your account: your name, email address and, if you give it, your phone number; the people you add to your team; when you sign in. Passwords are stored only in scrambled form by our sign-in provider. If you sign in with Google, Google tells us your name and email address.
• Your events: the names, dates, venues, words and designs of your invitations, and the photographs you upload for them.
• Your guests: the names, email addresses and phone numbers you add, the replies guests give (who is coming, and anything the invitation asks), the messages they leave, and the photos they add to your album.
• How invitations are opened: which guest’s link was opened, when, and how many times — so you can see who has seen your invitation. We do not record guests’ locations.
• Payments: what you bought, the amount, how and when you paid, and the payment reference. Card and wallet details are handled by Safepay, for customers in Pakistan, or by Paddle, elsewhere; we never receive or keep your full card number.
• Messages to us: what you send through Feedback, with any screenshots you attach, and what you write to us on WhatsApp if you ask us to make your invitation for you.
• If you ask for a quote: your name, email address, phone number and what you tell us about your event. We keep only a scrambled form of your internet address, to stop the form being misused.

• To run your account and your invitations, and to deliver them to the guests you choose.
• To make the pictures and opening films you ask our studio for.
• To take payment, issue invoices and keep the accounts the law requires.
• To keep the service secure, to stop misuse, and to fix what goes wrong.
• To answer you when you write to us.

We do not sell anyone’s information, we do not show advertising, and we do not use your guests’ details for anything but your event.

These companies process information for us, only to provide their part of the service:

• Supabase — our database, sign-in and file storage. Servers in Tokyo, Japan.
• Vercel — hosts the website and runs it. Servers in Mumbai, India, with a worldwide network that serves pages close to you.
• Resend — sends our emails, including your invitations. Servers in Tokyo, Japan.
• OpenRouter — passes requests to the AI models that make our studio’s pictures and films (such as Google’s and ByteDance’s) and our Urdu drafts. When you ask for a picture or a film, the photos you chose and the description of your event go to the model that makes it; when you ask for an Urdu draft, your invitation’s words do.
• Meta (WhatsApp) — delivers invitations sent automatically on WhatsApp, and the replies guests send back.
• Safepay — takes card and wallet payments from customers in Pakistan, together with the banks and wallets involved.
• Paddle — the merchant of record and payment processor for purchases made outside Pakistan. Paddle collects your name, email address, billing country and payment details to take the payment, work out and pay the tax, and send your receipt, and it keeps them under its own privacy notice. We receive the details of your order — what you bought, the amount and currency, when you paid, and the references that identify the payment — and use them to give you what you bought and to keep our accounts.

Some of them are outside Pakistan, so your information may be stored or processed in other countries. We choose providers who protect it, and we send them only what their part needs.

Your host added your details to invite you, and is responsible for having your permission to do so. We use them only for that invitation and its album. A message you leave for your hosts appears on their blessings wall at the event only if you choose that. You can stop automatic WhatsApp messages by replying STOP, and you can ask your host — or us — to remove your details.

We use only the cookies the service needs, and no advertising or tracking cookies:

• a sign-in cookie that keeps you signed in;
• a referral cookie, kept for 90 days, when you arrive through a friend’s referral link;
• a device cookie when you add photos to an album from the venue’s QR code, so you can find your own photos again;
• two preference cookies, kept for a year, that remember the language and text size you chose for invitations.

Your browser also remembers small preferences, such as the name you gave when adding photos.

• Your account and events stay while your account is open.
• When you ask us to delete an event, its guest list, replies, photos and creations are deleted. When your account is closed, all of its events go with it.
• Payment records and invoices are kept for as long as tax and accounting law requires — in Pakistan, currently six years after the end of the tax year — even after an account is closed.
• Emails and messages to guests are kept with their event, so you can see what was sent.

Guest links are private and hard to guess, photos are stored privately and shown through short-lived links, and only the people on an account — and our own staff, when they need to help — can open it. No system is perfectly secure, but we take care, and we will tell you if something goes wrong that affects you.

You can ask to see the information we hold about you, to correct it, to delete it, or to stop us using it for a purpose. Hosts can change or remove most of it themselves in their account. Some things we must keep, such as invoices; we will tell you if that applies.

Accounts are for adults. A guest list may include children’s names, which the host adds and is responsible for.

We will update this page when what we do changes; the date at the top shows when. For any question, or to make a request, use Feedback in your account or email us at rumi@ruminationlabs.com. Who we are is on our ownership page. Read this with our terms of service.