Updated October 4, 2026. This notice remains a draft awaiting confirmation of the service operator, contact details, and applicable legal requirements.
Optional EzAI assistance
When you choose Ask EzAI, your request, invitation title, message, and selected theme are sent to OpenAI to generate suggestions. Host email, guest lists, and other event fields are not automatically sent. Information you include in the request or invitation wording is included. We request that API responses are not stored; provider abuse-monitoring retention may still apply. Suggestions change your draft only when you apply them and do not automatically publish it.
Accounts and sessions
Sign-in uses your email, or a phone number or provider profile when that method is enabled. Supabase processes authentication and session information. Session cookies keep you signed in. EzRSVP does not ask for your Google or Apple password.
Saved invitations
When you select Save to account or publish an invitation, we store its details and associate it with your verified account ID. Your account can access and manage those invitations across devices. Unsaved editor drafts may remain in this browser’s session storage. PDF files are generated on request and are not stored in your account.
Published invitations
Anyone who receives a published invitation link can view its event details, venue, invitation message, and host contact information. Invitation pages are marked not to be indexed, but this does not guarantee that recipients cannot copy or share them. Do not include sensitive information in a public invitation. Unpublishing prevents further access through the guest page; it cannot remove copies already made by recipients.
Guest responses
The RSVP form collects a guest’s name, attendance response, adult and child counts, and any email or message they choose to provide. Responses are stored for the invitation host and displayed only in the host’s private workspace. Hosts can export responses as CSV files and are responsible for how they use downloaded copies. Guest lists are not displayed publicly.
Updating an RSVP
Private browser cookies remember the response submitted from that browser so it can be updated. If you clear cookies or use a different browser, a new response may be created. Contact the host to correct duplicate responses or request removal. We store a hash of the response receipt rather than the raw cookie token.
Security and abuse prevention
We use account checks and ownership restrictions for host data. Public RSVP requests have input limits and rate limiting. To enforce limits, a hash derived from the requesting IP address, invitation, and time window is retained for up to 24 hours; the raw IP address is not stored in that rate-limit table. Hosting providers may separately process IP addresses and logs for service operation and security.
Service providers
Vercel hosts the website. Supabase handles authentication, and the connected database stores invitation and response records. These providers process information needed to deliver and secure the service under their own contractual and retention practices. Google, Apple, SMS providers, and Google Maps have their own policies when you use those integrations.
Retention and deletion
Invitation details and guest responses are retained while the host keeps the invitation. Deleting an invitation removes its response records from the active application database. Copies in backups, host CSV exports, guest email replies from older links, or hosting logs may have separate retention periods. Account closure requests currently go through the Contact page rather than an automated deletion tool.
Your choices and children
You can sign out, delete invitations you own, or contact us about account information. Guests can update an RSVP from the same browser or ask the host to remove it. Applicable access, correction, and deletion rights depend on your location. Host accounts are intended for adults; children’s event themes are for adult organizers.