Privacy Policy

1. Introduction

SCRIPTTHEMARKET LLC ("Company," "we," "us," or "our") operates RSVPlinks (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services. Please read this privacy policy carefully. By using our Service, you consent to the data practices described in this policy.

2. Information We Collect

2.1 Personal Information

We may collect personally identifiable information that you voluntarily provide when using our Service, including:

• Name, email address, and (where a host's RSVP form asks for it) phone number
• Account credentials
• Payment and billing information (processed securely through Stripe — we do not store full card numbers on our servers)
• Event details you create (titles, dates, locations, descriptions, banner images, custom fonts and palette choices)
• Guest information and RSVP responses (including guest counts, the names of other people in a party when the host asks for them, dietary or other custom-question answers, and any sign-up list contributions)
• Public host profile information you choose to publish at /u/[your-handle] (display name, bio, avatar, social links)
• Follower and following relationships, and saved/favorited events on the Community feed
• Email and notification preferences (per-category opt-in/opt-out settings)
• Peer-to-peer payment handles you choose to share with guests for the RSVP Fee add-on (your Venmo, Zelle, PayPal, Cash App, Alipay, LINE Pay, WeChat Pay usernames or IDs). We do not process these payments — see Section 11.
• Table assignments and seating-chart layouts you build with the Table Management add-on
• Survey responses you submit through public /survey/[slug] forms
• Mailing addresses: a guest's postal address when a host turns on the mailing-address field on their RSVP form, and the recipient names and addresses a host adds to their address book for Postcards
• Postcard designs you create (the text and photos printed on the card) and the status of each card you mail
• If you ordered postcards as a guest, without an account: the email address you gave at checkout, which we use for your receipt and updates about that order and not for marketing, together with the design and recipient addresses of the order. A postcard you design before signing in stays in your browser, photos included, and reaches us only when you sign in to continue

2.2 Automatically Collected Information

When you access our Service, we may automatically collect:

• Device information (browser type, operating system)
• IP address and location data
• Usage data (pages visited, features used, time spent)
• How you reached us: the referring site, the first page you landed on, and any campaign tags in the link, for your first and latest visit. If you create an account, this is saved with it so we can see which channels bring hosts
• Cookies and similar technologies, including your browser's local storage — see our Cookie Policy
• Email delivery events for messages we send on a host's or our own behalf: whether a message was delivered, bounced, or reported as spam, and whether an invitation's link to the event page was clicked. Hosts see these as a status beside each person they emailed, and we stop emailing addresses that bounce or report spam.
• Error reports: if a page fails to load in your browser, the error and the page it happened on are recorded in our server logs
• If you turn on phone or browser alerts: the push address your browser gives us for that device and its browser name, used only to send you RSVP alerts. A device's address is deleted when you turn its alerts off, when the browser retires it, or with your account

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Service
• Process transactions and send related information
• Send you event reminders, RSVP notifications, follower-activity alerts, and other transactional updates
• Print and mail the postcards you order to the recipients you choose, and show you each card's delivery status
• Generate AI-assisted content you request (event banners, descriptions, social-media drafts, blog drafts) by sending the relevant prompts to our AI providers — see Section 12
• Deliver host-authored Marketing Email campaigns to recipients on the host's guest list, subject to the recipient's opt-out preferences
• Respond to your comments, questions, and customer service requests
• Communicate with you about products, services, and events
• Monitor and analyze usage trends to improve user experience
• Detect, prevent, and address technical issues and fraud, including reviewing event pages and other content for scams, phishing, and other violations of our Terms of Service
• Comply with legal obligations

4. Information Sharing and Disclosure

We may share your information in the following situations:

• With Event Hosts and Co-Managers: If you RSVP to an event, your RSVP, contact information (including a mailing address if the host asks for one), sign-up list contributions, and any answers to host-defined custom questions are shared with the event's host and any managers they have invited.
• With Other Guests (limited): Hosts may publish a public, guest-searchable seating chart through the Table Management add-on. If your host enables this, your name and table assignment may be visible to anyone with the event link.
• With Followers: If you publish a public host profile at /u/[your-handle], your profile and any events or polls you publish to it are visible to anyone with the link, and people who follow your profile are emailed when you publish a new event and see your events and polls in their Community feed.
• With Marketing Email Recipients: Hosts using the Marketing Email add-on send email campaigns from their account to RSVPs and recipients on their guest list. The host (not RSVPlinks) is the sender of those messages and determines the recipient list. Each message includes an unsubscribe link managed by us on the host's behalf.
• Service Providers: We share data with third-party vendors who assist us in operating our Service, including Stripe (payments), Supabase (authentication and database), Resend (transactional and marketing email delivery), Vercel (hosting, cookie-free page-view analytics, and custom domains, including registering domains bought through us), Upstash (rate limiting and caching), Anthropic (AI-assisted text), OpenAI (AI-generated images and automated content checks on postcards, guest photos and thank-you card comments), Lob (postcard printing, mailing, and address verification), and Google (Maps, Analytics, and Ads).
• Guest Photos: When a host turns on Guest Photos, a photo a guest adds is resized and stripped of its location and camera data before it is stored, and a small copy is checked by an automated content-moderation service. The guest's name, if they give one, appears beside an approved photo. Hosts approve, hide or delete photos; ask the host, or us, to remove one.
• Thank-You Page: When a host publishes a thank-you card, anyone who can open it may see its comments and reactions. A comment stores the name you type (or, if you came from the host's email, the name on your RSVP) and its text; it is checked by an automated content-moderation service and shows on the card, and the host can hide or delete it. Reactions and comments also store a hashed IP address, used only to limit abuse and cleared after 90 days. Photos added to a thank-you card are handled the same way as Guest Photos. If a host emails you the card, the email carries a personal link and a one-click link to stop emails from that event.
• Party Games: When a host runs a game, the names of its players (from RSVPs or typed by the host or by the players themselves), wishlists and links, and the votes, predictions, bingo claims and entries people submit are stored for that game. Secret Santa matches and other private assignments are emailed only to the player they belong to and shown only on that player's own game page; a host who plays does not see the matches. Anyone who can open the event page may see results the host chooses to show, such as winners, a leaderboard or teams. Votes and joins also store a hashed IP address, used only to limit abuse and cleared after 90 days.
• Sign-up sheets and meal trains: When you take a spot on a sign-up sheet, we store the name, email and note you give and which spot you took. Everyone who can open the sheet sees names and notes; only the organizer (and an event's host and co-hosts) sees emails. We email you a confirmation, a reminder the day before your slot and a link to change or cancel. A meal train's address, phone and drop-off notes are shown only to people who took a spot, and the organizer. An organizer who gives an email gets their organizer link and a daily summary there; it is never shown to anyone. Names and notes are checked by an automated content-moderation service. Sign-ups also store a hashed IP address, used only to limit abuse and cleared after 90 days.
• Group cards: When you sign a group card, we store the name and message you type, the photo you add (if any) and which card it is on. Anyone who can open the card sees names, messages and photos; the organizer (and an event's host and co-hosts) can hide, approve or delete any post. Photos are resized and stripped of their location and camera data, and messages and photos are checked by an automated content-moderation service; a flagged post waits for the organizer. The organizer can give the recipient's email address so we can email the card, and their own email address so we can send their organizer link and a daily summary of new posts; neither is ever shown to people who sign. Recipient emails carry a personal link that opens the card. Posts, reactions and edits also store a hashed IP address, used only to limit abuse and cleared after 90 days.
• Domain Registration: When a host buys a domain through us, the name, postal address, email and phone number they give at checkout are sent to the domain registrar (through Vercel) as the domain's registrant, as domain registration rules require. Registries may publish some of it in WHOIS records unless their privacy rules redact it.
• Postcard Printing and Mailing: When a host orders postcards, each recipient's name and postal address and the card's text and photos are sent to Lob, which prints the cards and hands them to the postal service for delivery. Guest mailing addresses are visible only to the event's host and co-hosts with edit access; they never appear on a public guest list.
• Legal Requirements: We may disclose information if required by law or in response to valid legal requests.
• Business Transfers: In connection with any merger, sale, or acquisition of company assets.
• With Your Consent: We may share information for other purposes with your explicit consent.

5. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. When you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it for legal or regulatory purposes. Photos guests add and photos a host adds to an event page are kept while the event exists. A guest photo is deleted from our storage when the host deletes it, and both are deleted when the host deletes the event or their account (a photo the host also uses on another of their events stays with that event). A thank-you card, its photos, comments and reactions are kept while the event exists; the hashed IP addresses on reactions and comments are cleared after 90 days. Party Games players, wishlists, votes and results are kept while the event exists, and the hashed IP addresses on votes and joins are cleared after 90 days. A sign-up sheet on an event is kept while the event exists; a standalone sheet is deleted 30 days after its last date, or 90 days after its last activity when it has no dates, with every sign-up on it. The hashed IP addresses on sign-ups are cleared after 90 days. A standalone group card that was never unlocked is deleted 12 months after its last post or edit, with its posts and photos; an unlocked card is kept until the organizer deletes it, and an event's card is kept while the event exists. The hashed IP addresses on group card posts and reactions are cleared after 90 days. When we remove content or ban an account for violating our Terms of Service, we keep the account's email address and the records of the violation for as long as we need them to enforce the ban and prevent fraud.

7. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information:

• Access: Request access to your personal information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information
• Portability: Request a copy of your data in a portable format
• Opt-out: Opt out of marketing communications at any time

To exercise these rights, please contact us at support@rsvplinks.com.

8. Public Host Profiles, Followers, and Community

You can opt to publish a public host profile at /u/[your-handle]. When published, the profile's display name, avatar, bio, social links, and any events or polls you choose to attach are visible to anyone — including unauthenticated visitors and search engines. Other signed-in users can follow your profile, and your followers will receive notifications (in their Community feed and, depending on their preferences, by email) when you publish a new event; polls you post appear in their Community feed. You can make your profile private or unpublish individual events at any time from your account settings.

9. Email Communications and Preferences

We send two categories of email: transactional messages (RSVP confirmations, password resets, event reminders, payment receipts, and other messages tied to your use of the Service) and marketing messages (product announcements, follower activity digests, and host-authored Marketing Email campaigns sent through the Service).

You can manage per-category email preferences from the email preferences page linked in the footer of every email we send, or from your account settings. Opting out of a category suppresses future messages in that category for the email address you opt out with. We may continue to send essential transactional messages required to operate your account.

10. Surveys

From time to time we publish optional surveys at /survey/[slug]. Participation is voluntary. Your responses are stored with the survey and may be used to improve the Service. Some surveys offer a one-time-use coupon as a thank-you; redeeming the coupon associates your account with the survey response only to the extent necessary to enforce the one-time-use limit.

11. Peer-to-Peer Payments (RSVP Fee Add-on)

The RSVP Fee add-on lets hosts collect contributions from guests through external peer-to-peer payment providers (Venmo, Zelle, PayPal, Cash App, Alipay, LINE Pay, WeChat Pay, or cash at the door). RSVPlinks does not process, hold, or have visibility into these payments. We display the host's chosen payment handles and confirmation codes the host issues to guests. Your interactions with those payment providers are governed by their own terms and privacy policies. Disputes about peer-to-peer payments must be resolved between the guest and the host.

12. AI-Assisted Content

When you use AI features (such as generating event banners, descriptions, social-media drafts, or admin blog drafts), the prompts and context you provide are transmitted to our AI providers (currently Anthropic for text and OpenAI for images) for processing. We do not knowingly send personally identifiable information beyond what you choose to include in your prompts. Before a postcard is printed, its text and photos are also checked by an automated content-moderation service (currently OpenAI). AI-generated outputs may be inaccurate; you are responsible for reviewing and editing them before publishing.

13. Children's Privacy

Our Service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

14. Third-Party Links

Our Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.

16. Contact Us

If you have any questions about this Privacy Policy, please contact us: