Privacy Policy

Effective 11 September 2026

This Privacy Policy explains how Daawat (“Daawat”, “we”, “us”), a sole proprietorship based in Indonesia and operating getdaawat.com, collects, uses and protects your personal data. Questions? Email support@getdaawat.com.

We keep data collection to the minimum needed to run the service. We do not use advertising or analytics trackers, and we never sell your personal data.

1. Who we are (data controller)

Daawat is operated by an individual (sole proprietor) in Indonesia. For any privacy request, contact us at support@getdaawat.com; a postal address is available on request for formal notices.

2. What we collect

Account data — your name, email address, an encrypted (hashed) password, and optionally a WhatsApp number you choose to add.
Invitation content — details you enter to build an invitation: couple and family names, event dates, venues, a message/verse, photos you upload, and music links you add.
RSVP & guest data — when your guests respond, we store the name, attendance and any message they submit. You (the couple) decide who receives your invitation link.
Your guest list — if you use “Send on WhatsApp”, the guest names and optional WhatsApp numbers you add. Only you can see them. We never message your guests ourselves and we delete the list when you delete the invitation.
Payment data — payments are handled by our payment provider (see §5). We do not receive or store your full card details.
Technical data — standard server logs (e.g. IP address, browser type) kept briefly by our hosting provider for security and reliability.

3. How and why we use it

To create your account and let you build, preview and publish invitations.
To send you essential service emails (e.g. email verification) — not marketing.
To process a payment when you choose to publish.
To collect and show RSVPs and wishes for your invitation.
To keep the service secure and prevent abuse.

Where the EU/UK GDPR applies, our legal bases are: performance of a contract(running your account and invitations), legitimate interests (security, service improvement), and consent where you provide it (e.g. optional details). Where Indonesia’s Personal Data Protection Law (UU No. 27/2022) applies, we process on the lawful bases it recognises, including your agreement and the performance of our service to you.

4. Cookies

We use only essential cookies needed to keep you signed in and to run the site. We do not use advertising or analytics cookies. Embedded content (e.g. a YouTube video you add as music) may set its own cookies when played; we load it in privacy-enhanced mode. See our Cookie Policy.

5. Service providers we share data with

We use a small number of trusted providers to run Daawat. They process data on our behalf under their own security and privacy terms:

Supabase — database and file storage.
Resend — sending transactional email (e.g. verification).
Vercel — website hosting and delivery.
Blink — secure payment processing, including the purchase and billing details. We do not receive or store your full card details.
YouTube (Google) — only if you add a YouTube link as music/video.

We do not sell your personal data or share it for advertising.

6. International transfers

Because these providers operate globally, your data may be processed on servers outside your country. We rely on our providers’ safeguards (such as standard contractual clauses) for such transfers where required.

7. How long we keep data

Account data — while your account is active; deleted on request.
Published invitations — kept live for around one year, then archived or removed.
RSVPs & wishes — deleted together with the invitation they belong to.
Server logs — kept only briefly for security.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, export, restrict or object to the processing of your personal data, and to withdraw consent. California residents have rights under the CCPA/CPRA (including the right to know and delete, and not to be discriminated against for exercising them; we do not “sell” or “share” personal information as those terms are defined). To exercise any right, email support@getdaawat.com. You may also complain to your local data-protection authority.

9. Guests’ data

When you build an invitation and share it, you decide what guest information to collect and who to invite. For that content you are the controller and Daawat processes it on your behalf. Please only add details you are entitled to use.

10. Security

Passwords are stored hashed, the site is served over HTTPS, and access to data is restricted. No online service can be guaranteed 100% secure, but we take reasonable measures to protect your information.

11. Children

Daawat is intended for adults (18+) planning events. It is not directed at children.

12. Changes

We may update this policy; we will post the new effective date here and, for material changes, notify you where appropriate.

13. Contact

Daawat — support@getdaawat.com. This policy is governed by the laws of the Republic of Indonesia.