1. Who is responsible
InviteKey is published by Adrian Tanasescu, sole proprietor (EI) registered in France (SIREN 529 157 810), 9 rue des Grisemottes, 69220 Belleville-en-Beaujolais, France. Contact: support@invitekey.app.
For guest lists, invitations and check-ins, the event organiser determines the purposes and means of processing: it is the controller, and InviteKey acts on its behalf as processor, under section 7 of the terms of use. For InviteKey accounts, billing, security and this website, InviteKey is the controller. Guests are also encouraged to read the organiser’s own privacy notice.
2. Data processed and purposes
Accounts and support: name, work email address, organisation and role, authentication data and support exchanges. Used to provide accounts, answer requests, and administer and protect the service. Legal basis: performance of the contract, our legitimate interest in running a secure service, or a legal obligation, as applicable.
Events and guests: event details and images, guests’ names, email addresses and categories, any other field the organiser enters, invitation and delivery status, pass identifiers, and the time, checkpoint and device of check-ins. This data is processed on the organiser’s instructions to create, send and verify access; the organiser is responsible for determining and explaining its own legal basis to its guests.
Email tracking: for each invitation email, our email provider records its delivery and, where the guest’s email client allows, its opening and clicks on its links. This tells the organiser whether the invitation arrived and allows invalid addresses to be handled.
Technical use: IP address, browser and device information, access and security logs, and essential session information, to run and secure the website, app and API. Legal basis: our legitimate interest in the security and reliability of the service.
Billing: orders, offers and transactions, if a paid offer is purchased, to manage the purchase and meet our accounting and tax obligations. The payment provider is identified before any payment.
No decision producing legal effects concerning you or similarly significantly affecting you is based solely on automated processing.
3. Recipients and service providers
We do not sell personal data or disclose guest lists to advertisers or partners unrelated to the service. Access is limited to the organiser’s authorised users, to people who need it for the service, and to the following providers:
Brevo sends invitation and account emails; it receives the email address and message content, and measures delivery, opens and clicks. Backblaze B2 stores event images in private storage. Railway hosts the API, background processing and database. Cloudflare delivers the website and app. Google: when a guest chooses “Add to Google Wallet”, the pass information — name, event, category, QR code — is sent to Google, which processes it under its own rules. Apple: when a guest chooses “Add to Apple Wallet”, the pass is downloaded directly to their device; InviteKey does not send its content to Apple. Apple services, such as iCloud, may then sync it across the guest’s devices under Apple’s rules.
For a pass added to a Wallet, see the Apple Privacy Policy or the Google Privacy Policy. They describe those companies’ processing; this page remains the notice for InviteKey’s processing.
The organiser may give access to its team and check-in devices. We may also disclose information where the law requires it or to protect rights or people’s safety, strictly as needed.
4. Transfers outside the European Union
Some providers, or their infrastructure, may process data outside the European Economic Area. Such transfers are then safeguarded by a recognised mechanism, such as an adequacy decision or the European Commission’s standard contractual clauses. Contact us to learn which safeguards apply to your data. Apple and Google may also process Wallet data under their own rules.
5. Retention periods
The retention period of an event’s data depends on the chosen offer; it is shown in the service and runs from the event’s start date. When it ends, access ends and the data is deleted from our active systems under our deletion process. Limited copies may remain temporarily in backups, security logs or our providers’ systems, under their own periods: we do not promise instant erasure of every copy at expiry.
Some copies are outside our control and may remain after access ends: exports downloaded by the organiser; the guest list (names, categories and, if the organiser enables it, email addresses) kept offline on check-in devices; passes saved in guests’ Wallet apps. The organiser is responsible for its exports and devices; a guest can remove a pass from their Wallet at any time. Apple and Google decide their own retention of Wallet data.
Account and support data is kept while the account exists and requests require it, then for a limited period where security, a dispute or a legal obligation requires it. Billing data is kept for the applicable accounting and tax periods. You can ask us for the period that applies to a particular piece of data.
6. Your rights
Depending on your situation and the processing concerned, you may ask to access, rectify or erase your data, restrict its processing or receive it in a portable format, object to its processing, and withdraw your consent where it is the basis. These rights may be limited by law. Write to support@invitekey.app; we may need to verify your identity before acting.
If you are a guest, the organiser is normally the first contact for any request about your invitation or attendance. You can also write to us: we will pass on or handle the request as appropriate.
You may lodge a complaint with the French data-protection authority, the Commission nationale de l’informatique et des libertés (CNIL), www.cnil.fr, or with the data-protection authority of your country of residence.
7. Security and storage on your device
We apply access controls and other technical and organisational measures intended to protect data. No online service can guarantee absolute security. Report any suspected misuse to support@invitekey.app.
The website stores your language and light or dark theme preference in your browser. The app uses an essential session cookie to keep users signed in and secure access, and the check-in app keeps on the device the event data needed for offline check-in. The interface’s fonts and images are served by InviteKey itself: nothing is loaded from a third-party font, analytics or advertising service. If optional analytics or marketing tools were ever added, this policy and any required consent choices would be updated first.
8. Changes and questions
We may change this policy as the service or the law evolves. The current version and its date appear at the top of this page. For any question or request: support@invitekey.app.