Data processing
addendum

This Data Processing Addendum ("DPA") describes how InviteBird, operated by SKYPOP DESIGNS ("InviteBird," "we," "us"), processes personal data on behalf of an event host who uses the service.

With respect to the guest information a host enters and collects through the service, the host is the controller — the party that decides why and how that data is used — and SKYPOP DESIGNS is the processor, acting on the host’s documented instructions. We process guest data only to provide the service and as described in our Privacy Policy.

This DPA supplements and is incorporated into our Terms of Service. It applies where a host uses InviteBird to process personal data of individuals in connection with an event, including for business or organizational use where data protection law requires a controller-processor agreement. If a separate signed agreement between the host and SKYPOP DESIGNS conflicts with this DPA, that agreement controls.

Data subjects: a host’s guests and invitees, and other individuals whose information a host chooses to include.

Categories of data: names; contact details (email addresses and phone numbers); RSVP responses, meal choices, plus-one names, and messages; photos, voice notes, and other content a host or guest uploads; and limited technical data such as IP address and device/browser information used for security.

Purposes of processing: to deliver invitations, reminders, and updates; collect and manage RSVPs; enable host-to-guest communication; power optional creative features the host uses; and secure and support the service.

• Process guest data only to provide the service and on the host’s instructions, not for our own independent purposes.
• Do not sell guest data and do not use it for cross-context behavioral advertising.
• Require personnel with access to keep the data confidential.
• Use subprocessors only under terms consistent with this DPA, and remain responsible for their performance.
• Assist the host, taking into account the nature of processing, with responding to individual rights requests and with security and breach obligations — including telling the host without undue delay if we become aware of a personal data breach affecting their guest data.

We use the following subprocessors to help provide the service. Each receives only the data needed for its function and is bound by its own data protection obligations. We keep this table current on this page; the date at the top reflects the latest change.

We maintain technical and organizational measures appropriate to the risk, including encryption of data in transit (HTTPS/TLS), hashing of account passwords, access controls that limit who can reach production data, authentication and session controls, and network security provided through our hosting and CDN partners. No method of transmission or storage is perfectly secure, but we work to protect data against unauthorized access, loss, or misuse.

We help hosts respond to guest requests to access, correct, or delete personal data. Guests may contact their host directly, or email support@invitebird.com and we will assist and, where appropriate, route the request to the host.

On a host’s instruction — including when a host deletes an event or account — we delete the associated guest data and uploaded files, such as photos, voice notes, and songs. (Account deletion runs after a seven-day grace window the host can cancel.) Operational message logs are deleted with the event or account they belong to, and backups follow the retention timelines in our Privacy Policy, after which residual copies age out.

Guest data may be processed in the United States, in Germany (where our hosting is located), and in other countries where our subprocessors operate. Where required, we rely on appropriate safeguards for cross-border transfers and apply the same core protections to everyone regardless of location.