Privacy Policy

Invit3D ("we", "us", "our") operates the digital invitation platform at zirber.com (the "Service"). This Privacy Policy explains what personal data we collect, why we collect it, and the choices you have regarding your data.

By creating an account or using the Service, you agree to the practices described in this policy.

Account data: Your name, email address, and authentication credentials when you register.

Event data: Event titles, dates, locations, descriptions, themes, and media you upload (background images, music, highlight videos, banner designs, wine label designs).

Guest data: Guest names, email addresses, phone numbers, RSVP responses, party sizes, seating preferences, and photos that guests submit when responding to invitations.

AI reference data: Photos and descriptions you upload for AI-assisted invitation generation (e.g., celebrant photos for identity-preserving designs).

Payment metadata: Stripe transaction references and session IDs. We never receive or store your full card number, CVC, or banking details, payments are handled entirely by Stripe.

Usage data: IP addresses (hashed for storage), device type, and interaction logs used for security monitoring and abuse prevention.

We use your data to:

• Create, host, and deliver your digital invitations to your guests.
• Track RSVPs, manage seating, and send automated reminders and updates.
• Generate AI-assisted invitation designs, banners, and wine labels based on your inputs.
• Process one-time package payments and manage AI generation credits.
• Monitor for abuse, fraud, and unauthorized access to protect all users.
• Provide customer support and respond to your inquiries.

We share specific data with the following providers to operate the Service:

• Stripe — Payment processing. Receives payment details directly from you; we receive only transaction metadata. See Stripe's Privacy Policy.
• OpenAI — AI image generation. Receives text prompts and reference images you provide for invitation generation. See OpenAI's Privacy Policy.
• Twilio — SMS reminders to guests who opt in. Receives phone numbers and message content. See Twilio's Privacy Policy.
• Resend — Email delivery. Receives recipient email addresses and message content. See Resend's Privacy Policy.

We do not sell your personal data to any third party.

We retain your event data and guest records for as long as your account is active. AI generation records and credit ledger entries are retained indefinitely for audit and cost-reporting purposes.

You may request deletion of your event data, AI reference photos, and generated assets at any time by contacting us. We will process deletion requests within 30 days.

Depending on your location (e.g., GDPR/CCPA), you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data and account.
• Opt out of automated reminders (guests can toggle this per invitation).
• Withdraw consent for AI processing of your reference photos.
• Export your event and guest data.

To exercise any of these rights, contact us through the Contact page.

The Service uses browser local storage to maintain your session and remember interface preferences. We do not use third-party advertising cookies or tracking pixels.

We protect your data with encryption in transit (HTTPS), encrypted API key storage (AES-256-GCM), hashed IP addresses, row-level access controls, and an automated security monitoring system (ASOS) that detects and responds to abuse in real time.

AI provider API keys, if you previously connected one, are encrypted at rest and never exposed to the frontend or logs.

The Service is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Continued use of the Service after changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or your data, please contact us through our Contact page.