Pending legal review. This text describes how InviteKeep works today in plain English; highlighted items in [brackets] are still to be filled in.
Sub-processors
Last updated 23 October 2026
We use the providers below to run InviteKeep. Each is bound by a contract that limits its use of personal data to providing its service to us. We will update this page at least 14 days before adding a new sub-processor; planners with a DPA can ask to be notified by email at privacy@invitekeep.com.
Current list
| Provider | Purpose | Personal data | Location |
|---|---|---|---|
| Supabase Inc. | Database, sign-in, file storage and realtime updates | All account, event, guest, RSVP and album data | AWS ap-south-1 (Mumbai, India) |
| Cloudflare, Inc. | Website hosting, content delivery, DDoS and abuse protection | Requests to our pages (IP address, browser details); pages in transit | Global edge network |
| Dodo Payments | Checkout, payments, tax collection and refunds (merchant of record) | Purchaser name, email, billing country, payment details (we never see card numbers) | See provider policy |
| Twilio Inc. | Text messages with one-time sign-in codes | Phone number and the code sent to it | United States and other Twilio regions |
| Google LLC | "Continue with Google" sign-in (only if you choose it) | Name, email and profile picture shared by Google at sign-in | United States and other Google regions |
Not used
WhatsApp invitations are sent from your own phone with click-to-send, so Meta does not receive your guest list from us. We use no advertising networks, analytics vendors or data brokers.