Privacy Policy

1. Who we are

This Privacy Policy explains how RSVPme.xyz, also referred to as "we," "us," or "our," collects, uses, discloses, stores, and protects personal information when people use our website, event pages, host dashboard, RSVP forms, email features, and related services.

Questions or privacy requests can be sent to privacy@rsvpme.xyz.

2. Scope

This Privacy Policy applies to hosts who create and manage events, guests who view event pages or submit RSVPs, visitors to RSVPme.xyz, and people who communicate with us.

Event pages are private by link, but they are not secret or encrypted invitations. Anyone with an event link may be able to view the event page. Hosts should not put sensitive or confidential information on an event page.

3. Our role for host and guest data

For host account information and our website operations, RSVPme.xyz generally acts as the business or controller of personal information.

For RSVP information submitted to an event created by a host, the host may be the primary business or controller of that RSVP information, and RSVPme.xyz processes that information to provide the service. RSVPme.xyz may also use limited RSVP information as an independent business or controller for service operations, security, abuse prevention, legal compliance, debugging, and support.

3A. AI agents and automated tools

RSVPme.xyz is designed to allow authorized AI assistants, large language model agents, agentic bots, API clients, MCP connectors, CLI tools, and similar automated tools to interact with the service for a human user.

If you instruct or authorize a third-party AI tool to create an event, read event details, submit RSVPs, manage your dashboard, send messages, or otherwise use RSVPme.xyz, the information available to that tool may include account information, event information, guest RSVP information, messages, and other data the authorizing user is permitted to access.

Third-party AI tools are not operated by RSVPme.xyz unless we clearly say otherwise. If you choose to use a third-party AI tool with RSVPme.xyz, that tool provider may collect, store, use, disclose, or train on information according to its own terms and privacy policy. You should review those terms before connecting or sharing event or RSVP information with the tool.

If RSVPme.xyz provides a first-party API, connector, MCP server, CLI, or similar integration, we will process personal information through that integration according to this Privacy Policy and any additional terms or notices for that integration.

RSVPme.xyz does not currently use guest RSVP information to train AI models. If that changes, we will update this Privacy Policy and provide notice or obtain consent where required by law.

Hosts are responsible for making sure any AI agent or automated tool they authorize has permission to access guest RSVP information and uses that information only for event-related purposes allowed by our Terms and applicable law.

4. Personal information we collect

We may collect the following categories of personal information:

• Account information, such as host name, email address, login credentials, organization information, and account settings.
• Event information, such as event title, description, date, time, address, directions, map link, cover image, RSVP settings, potluck settings, event status, and messages sent to guests.
• Guest RSVP information, such as guest name, email address, phone number, attendance status, guest count, guest names, what the guest is bringing, notes, and submission timestamps.
• Uploaded content, such as event images or event photos, if those features are used.
• Communications, such as support requests, legal requests, feedback, and other messages you send to us.
• Technical information, such as IP address, browser type, device information, pages viewed, referring URLs, authentication cookies, session information, log data, and diagnostic data.
• Payment information, if paid features are offered, such as purchase records, billing email, payment status, and limited payment details. Full card numbers are handled by payment processors, not by RSVPme.xyz.

5. Sensitive information

RSVPme.xyz is not designed to collect sensitive personal information such as Social Security numbers, government ID numbers, medical information, financial account numbers, precise geolocation, biometric information, or information about race, religion, union membership, sexual orientation, or criminal history.

Event addresses, phone numbers, dietary notes, accessibility notes, or free-form notes may sometimes reveal sensitive information if a host or guest chooses to enter it. Please do not submit sensitive information unless it is necessary for the event and you have the right to share it.

6. How we collect information

We collect information from:

• You, when you create an account, create or edit an event, upload content, send messages, submit an RSVP, or contact us.
• Hosts, when they create event pages, invite guests, manage RSVPs, or send event messages.
• Guests, when they open event pages or submit RSVP forms.
• Authorized AI agents, API clients, MCP connectors, CLI tools, or similar automated tools that act for a host or guest.
• Your browser or device, through cookies, logs, and similar technologies needed for security, authentication, and service operation.
• Service providers, such as authentication, hosting, database, email, payment, security, and support providers.

7. How we use personal information

We use personal information to:

• Provide, operate, maintain, and improve RSVPme.xyz.
• Create host accounts and authenticate users.
• Create, display, publish, close, cancel, and manage event pages.
• Collect, store, display, export, and manage RSVPs for hosts.
• Send RSVP confirmations, event messages, password reset emails, account emails, and service notices.
• Provide support, respond to requests, troubleshoot issues, and debug errors.
• Protect the service, prevent fraud, enforce our Terms, and detect abuse or security issues.
• Process payments and maintain billing records if paid features are offered.
• Comply with legal obligations, preserve legal rights, and respond to lawful requests.
• Analyze how the service is used so we can improve it.

8. Legal bases for processing

If GDPR, UK GDPR, or similar law applies, our legal bases may include:

• Contract, to provide the service you requested.
• Legitimate interests, such as operating, securing, improving, and supporting the service.
• Consent, where required, such as for certain optional communications or cookies.
• Legal obligation, to comply with law, tax, accounting, fraud prevention, or lawful requests.
• Vital interests or public interest, only where legally appropriate and necessary.

9. How we disclose personal information

We may disclose personal information to:

• Hosts, who can see RSVP information submitted for their events.
• Guests or invitees, to the extent information appears on an event page or in event-related messages.
• Authorized AI agents, API clients, MCP connectors, CLI tools, or similar automated tools that you or another authorized user choose to use with RSVPme.xyz.
• Service providers and processors that help us operate RSVPme.xyz.
• Payment processors, if paid features are offered.
• Professional advisers, such as lawyers, accountants, auditors, insurers, and security consultants.
• Law enforcement, regulators, courts, or other parties when we believe disclosure is required or appropriate to comply with law, enforce our Terms, protect rights, or prevent harm.
• A buyer, successor, or other party in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets.

We do not sell personal information. We do not currently share personal information for cross-context behavioral advertising as those terms are used under California privacy law.

10. Service providers and data processors

We use service providers to run RSVPme.xyz. Current or expected providers may include:

• Supabase, for database hosting, authentication, storage, and related backend services.
• Resend, for email delivery.
• A website hosting or deployment provider, such as Vercel or another hosting provider.
• A payment processor, such as Stripe or another processor, if paid features are added.
• Google Maps or similar map services, when a user clicks a map or directions link.
• Security, logging, analytics, customer support, and professional service providers, if and when used.

These providers may process personal information on our behalf or as independent controllers for limited purposes described in their own terms and privacy policies.

Third-party AI tools are not our service providers unless we have a separate agreement with them to process personal information for RSVPme.xyz.

11. Cookies and similar technologies

RSVPme.xyz may use cookies, local storage, and similar technologies for authentication, session management, security, preferences, debugging, and analytics. Some cookies are necessary for the service to work. If we later use optional analytics or advertising cookies, we will update this policy and provide choices where required by law.

12. Event emails and communications

Hosts may send event-related messages to guests who RSVP, especially guests who said they are attending. These messages are intended for event logistics and updates, not unrelated marketing.

We may also send transactional and service emails, such as account notices, password resets, RSVP confirmations, security notices, billing notices, policy updates, and support responses.

13. Data retention

We keep personal information for as long as reasonably necessary to provide the service, maintain accounts, manage events, comply with legal obligations, resolve disputes, enforce agreements, prevent abuse, and maintain business records.

Hosts may remove RSVPs or events through available product features. Some information may remain in backups, logs, audit records, email records, billing records, or legal records for a limited period. We may retain de-identified or aggregated information that no longer identifies a person.

14. Security

We use administrative, technical, and organizational safeguards designed to protect personal information. No website, database, email system, or internet transmission is completely secure, so we cannot guarantee absolute security.

You are responsible for keeping your account password secure and for controlling who can access event links and dashboard access.

15. International data transfers

RSVPme.xyz is operated from the United States. Personal information may be processed in the United States and other countries where we or our service providers operate. These countries may have privacy laws that differ from the laws where you live.

Where required, we rely on appropriate transfer mechanisms, such as contractual protections, adequacy decisions, or other lawful transfer methods.

16. Your privacy choices

Depending on your location and the nature of the information, you may be able to:

• Access personal information we hold about you.
• Correct inaccurate or incomplete personal information.
• Delete personal information, subject to legal and operational limits.
• Object to or restrict certain processing.
• Request portability of certain information.
• Withdraw consent where processing is based on consent.
• Opt out of certain marketing communications, if any are offered.

To make a request, contact privacy@rsvpme.xyz. We may need to verify your identity before responding. If your request relates to RSVP information for a specific event, we may direct you to the host or work with the host to respond.

17. GDPR and UK privacy rights

If you are in the European Economic Area, United Kingdom, or another jurisdiction with similar privacy rights, you may have rights to access, rectify, erase, restrict, object to processing, receive a portable copy of your data, and lodge a complaint with your local data protection authority.

When RSVPme.xyz acts as a processor for a host, we may forward your request to the host or ask you to contact the host directly. When RSVPme.xyz acts as controller, we will respond as required by applicable law.

18. California privacy notice

This section applies to California residents to the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to RSVPme.xyz.

In the past 12 months, we may have collected these categories of personal information:

• Identifiers, such as name, email address, phone number, IP address, account ID, and device identifiers.
• Customer records information, such as account information, billing-related information, and RSVP contact details.
• Commercial information, such as paid feature purchase records if paid features are offered.
• Internet or electronic network activity, such as log data, pages viewed, device information, and authentication data.
• Geolocation-related information at a general level, such as IP-derived location, and event addresses if a host submits one.
• Audio, electronic, visual, or similar information, such as uploaded event photos or images if those features are used.
• Inferences, such as basic service usage or event management preferences.
• Sensitive personal information only if a user voluntarily enters it, such as a home address used as an event address or sensitive information included in free-form notes.

We collect these categories from you, hosts, guests, your device, and service providers. We use them for the purposes described in this Privacy Policy. We disclose them to the categories of recipients described in this Privacy Policy, including hosts and service providers.

We do not sell personal information. We do not currently share personal information for cross-context behavioral advertising. We do not knowingly sell or share personal information of consumers under 16.

19. California rights

California residents may have the right to:

• Know what personal information we collect, use, disclose, sell, or share.
• Access specific pieces of personal information.
• Delete personal information, subject to exceptions.
• Correct inaccurate personal information.
• Opt out of sale or sharing, if we ever sell or share personal information as defined by California law.
• Limit use and disclosure of sensitive personal information, if applicable.
• Not be discriminated against for exercising privacy rights.

You or your authorized agent can submit a request by contacting privacy@rsvpme.xyz. We may ask for information needed to verify the request and the authority of any agent.

20. Other U.S. state privacy rights

Residents of certain U.S. states may have additional privacy rights, including rights to access, correct, delete, obtain a copy of personal information, and opt out of certain targeted advertising, sale, or profiling. To exercise rights available in your state, contact privacy@rsvpme.xyz.

21. Children

RSVPme.xyz is not directed to children under 13, and children under 13 may not create host accounts. We do not knowingly collect personal information directly from children under 13. If you believe a child under 13 has provided personal information directly to RSVPme.xyz without appropriate consent, contact privacy@rsvpme.xyz.

Hosts may create family events where children attend, and adults may submit RSVP information that mentions children or guest names. Hosts are responsible for having any required permission to submit that information.

22. Links to other websites

Event pages may include map links or other third-party links. We are not responsible for the privacy practices of third-party websites or services. Review their privacy policies before providing information to them.

23. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date. If changes are material, we may provide additional notice. Your continued use of RSVPme.xyz after an updated Privacy Policy becomes effective means the updated policy applies.

24. Contact

Questions, requests, or concerns about privacy can be sent to privacy@rsvpme.xyz.