Privacy policy

dawaty (دعوتي) is a service for creating digital invitations, sending them to guests on WhatsApp, collecting replies and checking guests in at the door. This policy explains what personal data we handle when you use it, whether you are a host with an account, a guest who received an invitation, or a visitor to this website.

We keep this document short and specific. If anything is unclear, contact us through the contact page.

Who this policy covers

Hosts create an account, set up events, upload guest lists and send invitations. Hosts decide who is invited and what the invitation says.

Guests receive a personal invitation link. Guests do not create an account. Their personal data is provided to us by the host and processed on the host's behalf.

Visitors browse this website without signing in.

What we collect

Account data. Your name, email address, a hashed password if you use one, and the sign-in methods you enable, such as passkeys or two-factor codes. We record when and from where you sign in for security purposes.

Event data. The event title, date, time zone, venue, an optional note to guests, the design and opening you choose, and an optional cover photo you upload.

Guest data, provided by the host. Guest names, mobile numbers, the number of seats allocated to each guest, hall assignments and tags. When a host pastes or imports a list, the text is parsed on our servers to extract names and numbers; nothing is stored until the host reviews and confirms the list.

Guest replies and attendance. Whether a guest accepted or declined, the number of seats confirmed, the time of the reply, and the time each ticket was scanned at the door.

Messaging records. For each WhatsApp message we send on the host's behalf, we keep the delivery status returned by the messaging provider, so the host can see which invitations arrived.

Payments and credits. Purchases of credits, the balance, and a record of each credit spent. Card details are entered directly with our payment provider and never reach our servers.

Technical data. Server logs containing IP addresses, request paths, timestamps and error reports, used to keep the service running and secure.

Cookies and device storage. A session cookie that keeps hosts signed in, a cookie that remembers your language, and a cookie that records your answer to the analytics prompt. Analytics cookies are set only if you accept them. The invitation page stores a small note in the guest's browser so the opening animation plays once, and the door screen stores the guest list on the device so it can work without signal. None of this is used to track you across other websites.

How we use it

• To provide the service: create events, send invitations, collect replies, issue tickets and check guests in.
• To send reminders the host schedules, within the sending hours the host's messaging provider allows.
• To bill credits and issue receipts.
• To keep accounts secure, detect abuse and diagnose faults.
• To understand how the product is used, only if you accept analytics cookies.
• To respond when you contact us.

We do not sell personal data and we do not use guest lists for advertising.

Guest data and the host's responsibility

A host who uploads a guest list is responsible for having the right to contact those guests about their event. We process guest data only to deliver what the host asks for: the invitation, the reminders, the reply and the ticket.

A guest who no longer wishes to receive messages about an event can reply to the host or contact us. We mark the number as suppressed and no further messages are sent to it for that event.

Who we share data with

We use service providers to run dawaty, each bound to handle data only on our instructions:

• A hosting provider for our servers and database.
• A WhatsApp Business messaging provider that delivers invitations and reminders.
• A payment provider that processes card payments for credits.
• An email provider that sends account emails such as verification and sign-in links.
• An error-monitoring service that receives technical error reports.
• An analytics provider, only for visitors who accept analytics cookies.

We may disclose data when the law requires it, or to protect the rights and safety of our users and of dawaty.

How long we keep it

• Account data is kept while your account is active and deleted when you close it, apart from records we must keep for accounting.
• Event and guest data is kept while the event exists in your account. When you delete an event, it is hidden immediately and its guest data is removed on a schedule after the event date. Attendance records are kept for the host's own records until the event is deleted.
• Messaging delivery records are kept for as long as the event they belong to.
• Payment records are kept for the period required by tax and accounting law.
• Server logs are kept for a limited period and then deleted.

Security

Data is encrypted in transit. Passwords are stored as one-way hashes. Invitation links and tickets are signed so they cannot be forged, and a host can invalidate every link for an event at any time. Access to production data is restricted to the people who operate the service.

Your rights

Under the Personal Data Protection Law of the Kingdom of Saudi Arabia and comparable laws elsewhere, you may ask to access the personal data we hold about you, to correct it, to delete it, or to object to a particular use of it.

Hosts can edit or delete their events and guest lists directly from their account. Guests can exercise these rights by contacting the host who invited them or by contacting us; where the host is the controller of the data, we will pass the request on and assist.

To make a request, use the contact page. We may ask you to verify your identity before we act on it.

Children

dawaty is intended for adults organising events. We do not knowingly collect personal data from children. Hosts must be at least 18 years old to create an account.

International transfers

Some of our providers operate outside the country you live in. Where personal data leaves its country of origin, we rely on the provider's contractual commitments to protect it to an equivalent standard.

Changes to this policy

When we change this policy we update the date at the top of this page. For material changes we notify hosts by email.

Contact

Questions and requests about privacy can be sent through the contact page.