Privacy Policy

1. Who We Are

Insendy Ltd ("Insendy", "we", "us") is the data controller for personal data collected when you create an Insendy account. For events organised by corporate or individual hosts using Insendy, the host is the data controller and Insendy is the data processor for the guest data they upload. Our registered address is Insendy Ltd, Manchester, United Kingdom.

2. Information We Collect

Account holders: name, email address, phone number, optional company name, password (hashed), authentication tokens, and billing details processed by Stripe (we never store card numbers).

Event data: event details (name, date, venue, dress code, agenda, menu, branding), invite designs, and any free-text descriptions you enter.

Guest data: name, email, phone number, dietary requirements, RSVP status, optional message, plus-one count, and EA forwarding email addresses where supplied.

Technical data: IP address, browser type, device type, and basic usage logs needed for security and abuse prevention. We do not use advertising or tracking cookies.

3. Lawful Basis for Processing

We rely on the following lawful bases under UK GDPR / EU GDPR Article 6:

• Contract, to provide the Insendy service to account holders and to deliver invitations / track RSVPs as instructed by the host.
• Legitimate interest, for security, fraud prevention, and improving the service.
• Legal obligation, to comply with tax, accounting, and other regulatory requirements.
• Consent, where required (e.g. optional marketing emails). You may withdraw consent at any time.

4. How We Use Your Information

To deliver invites, track RSVPs, process payments, send essential service notifications, prevent abuse, and improve the platform. We never use guest contact details for our own marketing.

5. AI-Generated Invites

Insendy uses third-party AI services (such as Anthropic Claude and OpenAI) to generate invitation designs from your brief. We do not send guest personal data (names, emails, phone numbers, dietary info, or RSVP responses) to AI providers. Only event-level information you choose to enter, event name, date, venue, branding, tone, menu, agenda, is sent. AI providers do not train on data submitted via their APIs.

6. Guest Data & Hosts

When a host adds guests to an event, the host is the controller of that data and is responsible for having a lawful basis to upload it (typically legitimate interest or consent). Insendy stores it on their behalf. Guest data is used only to deliver invitations and track RSVPs for the specific event and is automatically deleted 90 days after the event date unless the host extends retention.

7. Sub-processors

We share personal data only with the following sub-processors, each of whom is contractually bound to UK GDPR / EU GDPR standards:

• Google Firebase / Firestore, hosting, authentication, and data storage (EU region available)
• Stripe, payment processing
• Twilio, SMS delivery to guests
• Microsoft Azure (Outlook API), sending email invitations on behalf of corporate hosts who connect their Outlook account
• SendGrid / Postmark, transactional email delivery
• Anthropic, AI invite generation (event-level data only, no guest personal data)
• OpenAI, AI invite generation (event-level data only, no guest personal data)
• Cloudflare, DNS, DDoS protection, and CDN

An up-to-date list is available on request from privacy@insendy.com.

8. International Transfers

Some of our sub-processors are based outside the UK / EEA. Where data is transferred internationally, we rely on Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or equivalent adequacy decisions to ensure your data remains protected.

9. Data Security

We use TLS/HTTPS encryption for all data in transit and at-rest encryption for stored data. Access to personal data is restricted to authorised personnel under role-based access controls. Passwords are hashed (never stored in plain text). We log administrative access and review security regularly.

10. Data Retention

• Account data: retained while your account is active, deleted within 30 days of account closure.
• Event & guest data: automatically deleted 90 days after the event date (or sooner if the host deletes it).
• Invoices & payment records: retained for 7 years to meet UK accounting law.
• Server logs: retained for up to 30 days for security purposes.

11. Your Rights (UK GDPR / EU GDPR)

You have the right to:

• Access, request a copy of the personal data we hold about you
• Rectification, correct inaccurate or incomplete data
• Erasure ("right to be forgotten"), request deletion of your data
• Restriction, limit how we process your data
• Portability, receive your data in a machine-readable format
• Object, to processing based on legitimate interest
• Withdraw consent, where processing is based on consent
• Lodge a complaint, with the UK Information Commissioner's Office (ico.org.uk) or your local EU supervisory authority

To exercise any of these rights, visit our Data Request page or email privacy@insendy.com. We will respond within 30 days.

12. Data Breaches

If we become aware of a personal data breach, we will notify the Information Commissioner's Office within 72 hours where required and notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

13. Cookies

We use essential cookies only, for authentication, security, and session management. These cookies are necessary for the site to function and cannot be disabled. We do not use advertising, analytics, or third-party tracking cookies.

14. Children

Insendy is not intended for use by anyone under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact privacy@insendy.com and we will delete it.

15. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated to account holders by email. The "Last updated" date at the top reflects the most recent revision.

16. Contact & Data Protection

For privacy-related enquiries or to exercise your rights, contact: privacy@insendy.com, or write to: Insendy Ltd, Manchester, United Kingdom. UK supervisory authority: Information Commissioner's Office, ico.org.uk.

Data Request

Use this form to exercise your data protection rights. We respond to all requests within 30 days, free of charge. We may ask you to verify your identity before processing the request.

Terms & Conditions

1. Service Overview

Insendy provides a digital invitation creation and delivery service. We generate custom digital e-vites based on your input (uploaded photo or description), manage guest lists, deliver invitations via SMS, and track RSVP responses.

2. Account Registration

You must be at least 18 years old to create an account. You are responsible for maintaining the security of your account credentials and for all activity under your account.

3. Pricing & Payments

Design previews cost £1.49 and include up to 3 edits. Previews are watermarked until you go live. When you go live, the £1.49 is deducted from your chosen plan price. All prices are in GBP and inclusive of VAT where applicable. Payments are processed securely via Stripe.

4. Refund Policy

The £1.49 design preview fee is non-refundable once a design has been generated. For live event payments (Starter/Pro), refunds are available within 24 hours of purchase if no SMS invitations have been sent. Contact [email protected] for refund requests.

5. Acceptable Use

You agree not to use Insendy to send unsolicited messages (spam), create invitations containing offensive or illegal content, or attempt to circumvent our systems. We reserve the right to suspend accounts that violate these terms.

6. Intellectual Property

Designs generated by Insendy are licensed to you for the specific event they were created for. You may share and distribute your e-vite to guests. The Insendy platform, brand, and underlying technology remain our property.

7. SMS Delivery

We make every effort to deliver SMS invitations promptly, but delivery depends on network providers and recipient devices. We cannot guarantee delivery to all numbers. SMS delivery is available for Pro plan users only.

8. RSVP Tracking

RSVP tracking is active for 20 days after your event date (60 days for Planner/Enterprise). After this period, tracking data is archived and the public RSVP link is deactivated.

9. Limitation of Liability

Insendy is provided "as is". We are not liable for missed RSVPs, undelivered messages, or any damages arising from the use of our service. Our total liability is limited to the amount you paid for the specific event in question.

10. Changes to Terms

We may update these terms from time to time. We will notify you of significant changes via email. Continued use of the service after changes constitutes acceptance.

11. Governing Law

These terms are governed by the laws of England and Wales. Any disputes will be resolved in the courts of England and Wales.

12. Contact

For questions about these terms, contact us at [email protected] or write to: Insendy Ltd, Manchester, United Kingdom.

Help & Support

Got a question or want to talk about a corporate event? Fill in the form below and we'll get back to you within one business day.