Privacy Policy

1. Introduction

Welcome to InviteQuick. InviteQuick is operated by Rui Codex, a registered enterprise in Belgium (enterprise number BE1033974468). Rui Codex is the controller of the personal data described in this policy. If you have any questions about this policy or our practices, contact us at info@ruicodex.com.

This Privacy Policy applies to all information collected through the InviteQuick mobile application, the invitation pages and web portal at invitequick.ruicodex.com, and related services (together, the "Services").

2. Information We Collect

The personal information we collect depends on how you use the Services:

• Account information: your name and e-mail address, your password (stored only as a one-way hash), and, if you add them, your phone number, profile photo, bio and social links. If you sign in with Google, we receive your name, e-mail address and Google account ID from Google. We also store your app language and time zone so that messages to your guests use the right language and time.
• Event data: the details of the events you create, such as title, description, dates and times, location, schedule, theme and the other invitation fields you fill in.
• Guest and RSVP data: the names, e-mail addresses and phone numbers of the guests you add to an event, and the answers guests give on the invitation page (attending or not, number of extra guests and a note).
• Wishes and photos: the wishes (name, e-mail address and message) and the photos that hosts and guests post on an invitation.
• Purchase information: your plan, your SMS credit balance and the purchase receipts of subscriptions and SMS packs bought through Google Play. We never receive your card details.
• Feedback and content reports: the feedback you send in the app, and reports about content on an invitation (what is reported, the reason, any note you write, the app version and, if you are signed in, your account ID).
• Technical data: your IP address and device or browser information in our server logs and in the activity log of your account (for example sign-ins, including the e-mail address entered, and events created), the push token of your device, and a record of each e-mail and SMS we send (recipient, subject or text preview, status).
• Usage analytics, only with your permission: see section 9.

3. Device Permissions

The InviteQuick mobile app may ask for:

• Push notifications: asked after you create your first event, to tell you about RSVP updates, event reminders and co-host activity. You can turn them off at any time in your device settings.
• Photos: the system photo picker opens when you choose an image for your profile, a custom invitation theme, an AI edit or an event's photo gallery. Only the image you pick is uploaded.

The app does not use your camera, microphone, contacts or location.

4. How We Use Your Information

• Accounts and sign-in: to create and secure your account.
• Invitations: to create invitation links and QR codes, deliver invitations, reminders and event updates to your guests by e-mail and SMS, and pass RSVP answers, wishes and photos back to you.
• Notifications and service e-mails: push notifications to you, and account e-mails such as password resets.
• AI features: when you use them, the text, prompts and images you submit are sent to the AI providers listed in section 6 to produce invitation text, invitation artwork or the event details read from an invitation. We do not use your content to train AI models.
• Plans and purchases: paid plans and SMS packs are bought in the app through Google Play and managed with RevenueCat (see section 6).
• Ads: to show ads to free plan users, including rewarded ads you choose to watch.
• Safety and support: to keep the Services secure, prevent abuse of free quotas and of the e-mail and SMS functions, review reported content and act on it, and answer your feedback.
• Improving the app: usage analytics, only if you allow it (section 9).

5. Legal Bases for Processing

Under the EU General Data Protection Regulation (GDPR) we rely on:

• Performance of our contract with you (Art. 6(1)(b) GDPR): creating and running your account, signing you in (including with Google if you choose it), storing your events, sending the invitations, reminders and updates you ask us to send, push notifications and account e-mails, the AI features you use, and managing your plan, SMS credits and purchases.
• Your consent (Art. 6(1)(a) GDPR): usage analytics with Google Analytics for Firebase, and, in the EEA, the UK and Switzerland, the ad choices you make in Google's consent form (such as personalised ads). You can withdraw consent at any time (section 9).
• Legitimate interests (Art. 6(1)(f) GDPR): processing the contact details of the guests a host adds, so that the invitations, reminders and updates the host requested reach them, and recording guests' answers, wishes and photos for the host; server logs, activity logs and records of e-mails and SMS sent, to keep the Services secure and working and to investigate delivery problems; preventing abuse; reviewing content reports; and showing ads to fund the free plan. You can object to this processing at any time (section 11).
• Legal obligations (Art. 6(1)(c) GDPR): where the law requires us to keep or disclose data, for example on an order of a competent authority.

6. Service Providers We Use

We share personal data only with the providers below, each for the purpose named and only with the data that purpose needs. They process it on our behalf under their data processing terms, except Google for advertising (AdMob), Google Play and Google Sign-In, which act as independent controllers under their own privacy policies. We do not sell your personal data.

• Google Cloud Vertex AI (Gemini): AI invitation text suggestions, reading event details from text or an invitation image you submit, and the backup for AI invitation artwork. Data: the text, prompts and images you submit.
• OpenRouter (OpenRouter, Inc., United States), which passes the request to OpenAI's image model: AI invitation artwork and edits of a photo you choose to have redesigned. Data: your artwork description and, for an edit, the photo you submit.
• Twilio (Twilio Inc., United States): sending SMS invitations and reminders to your guests. Data: the guest's phone number and the message text, which contains the event details and the invitation link.
• Google Firebase: Firebase Cloud Messaging delivers push notifications to your device (data: a device push token). Google Analytics for Firebase measures how the app is used, only if you allow it (data: app usage events, your account ID and device information).
• Google AdMob: showing ads to free plan users, including rewarded ads. Google collects device and advertising identifiers and ad interaction data for this purpose. In the EEA, the UK and Switzerland, Google's consent form asks for your choices before ads are shown, and personalised ads are shown only with your consent.
• RevenueCat (RevenueCat, Inc., United States): managing subscriptions and SMS credit packs. Data: your InviteQuick account ID and the purchase receipts from Google Play.
• Google Play (Google Play Billing): processing payments for plans and SMS credit packs. Google Play handles your payment details; we never see them.
• Google Sign-In: signing you in with your Google account if you choose it. Data: your name, e-mail address and Google account ID, which Google confirms to us.
• Google Drive: stores the off-site copy of our daily database backups, which we keep there for up to 15 days (section 8). Data: all of the data in our database.
• Our hosting infrastructure provider (United States): runs, on our behalf, the server that holds our database, uploaded photos and generated images, our logs, and the e-mail server (mail.ruicodex.com) that sends invitation, RSVP and account e-mails. Data: all of the data described in this policy.

7. International Transfers

Some of these providers process data outside the European Economic Area (EEA). We rely on the following safeguards:

• Google (Vertex AI, Firebase, AdMob, Google Play, Google Sign-In, Google Drive): Google LLC is certified under the EU-U.S. Data Privacy Framework; Google's data processing terms also contain the European Commission's Standard Contractual Clauses for cases the Framework does not cover.
• Twilio: Twilio's data protection addendum applies, in order, the EU-U.S. Data Privacy Framework, Twilio's Binding Corporate Rules and the Standard Contractual Clauses.
• OpenRouter: the Standard Contractual Clauses (controller-to-processor module) in OpenRouter's data processing agreement. OpenRouter sends image requests on to OpenAI in the United States as its sub-processor, under a written agreement that OpenRouter's data processing agreement requires to be no less protective.
• RevenueCat: the Standard Contractual Clauses in RevenueCat's data processing addendum.
• Our server (United States): our server and e-mail server are hosted in the United States. You can ask us at info@ruicodex.com for information about the safeguards for this transfer.

You can ask us for a copy of or more information about these safeguards at info@ruicodex.com.

8. Data Retention

• Your account, events, guests, RSVP answers, wishes, photos and notifications are kept as long as your account exists, so that you can open your past events. When you delete your account they are erased (see section 10).
• Items you delete inside the app (an event with its guest lists, guests, RSVP answers, wishes, photos and custom theme; or a single guest, wish, photo, notification or AI history entry) are hidden from the app at once and permanently erased, together with their uploaded files, 30 days after you delete them.
• Records of e-mails and SMS sent (recipient e-mail address or phone number, subject or message preview, status) and activity logs (IP address, device or browser information and, for sign-ins, the e-mail address entered) are kept to keep the Services secure and to investigate problems, and are deleted automatically 12 months after they were made. If you delete your account before then, they are unlinked from it.
• Content reports (a report about an invitation, a wish or a photo) are deleted automatically 12 months after we receive them.
• Other feedback you send from the app is unlinked from your account (and its contact e-mail is removed) when you delete your account; we have not yet set a fixed deletion period for it.
• AI-generated images (invitation artwork and AI photo edits) are stored on our server without your name or account details. They are deleted when you delete your account, and 30 days after you delete them from your AI history (an image one of your invitations still uses is kept with that invitation). An AI image that no longer belongs to any account or history entry is deleted after 30 days. The photo you send for an AI edit is passed to the AI provider and not stored by us.
• Server logs (technical records of requests and errors) are deleted automatically after 30 days.
• Backups: copies of our database are made every day and kept for up to 15 days: on our server for up to 14 days and in an off-site copy stored with Google (Google Drive) for up to 15 days. Deleted data can remain in a backup for that time. Before a software update we also take a one-off copy of the database and of the files on our server; these copies are deleted automatically 90 days after they were made.
• Usage analytics (only if you allowed it) are kept by Google Analytics for Firebase for the retention period set in our Google Analytics settings. Ad data is kept by Google under its own policies.
• Service providers: how long a provider keeps the data it processed for us is set by that provider's own terms.

9. Analytics, Ads and Withdrawing Your Consent

• Usage analytics runs only with your consent. Since app version 1.3.4 (November 2026), Google Analytics for Firebase is off until you allow it: the app asks once, and you can change your choice at any time in Profile > Usage analytics. When you turn it off, collection stops and the analytics data held on your device is cleared. The invitation pages and the web portal do not use Google Analytics.
• Ads: where Google's consent form applies (the EEA, the UK and Switzerland), you can change your ad choices at any time in Profile > Ad privacy choices. Withdrawing consent to personalised ads means you can still be shown non-personalised ads.
• Push notifications can be turned off in your device settings.

You can also withdraw consent by writing to info@ruicodex.com. Withdrawing consent does not affect processing that took place before you withdrew.

10. Deleting Your Account

• You can delete your account in the app under Profile, or on the web at invitequick.ruicodex.com/delete-account. Deletion is immediate: your account, events, guest lists, RSVP answers, wishes, photos, custom themes, notifications, plan and usage records, AI generation history, AI-generated images and your uploaded files are erased from our database and server at once.
• You can also e-mail a deletion request to info@ruicodex.com; we carry it out within 30 days.
• What remains after deletion is described in section 8 (unlinked logs and reports until their 12-month deletion, unlinked feedback, daily backups for up to 15 days and update backups for up to 90 days).

11. Your Rights

Under the GDPR you have the right to:

• access the data we hold about you and receive a copy;
• correct inaccurate data;
• have your data deleted;
• restrict processing;
• receive the data you gave us in a portable format;
• object to processing based on our legitimate interests;
• withdraw your consent at any time (section 9).

If you are a guest whose details were added to an event by a host, you can exercise these rights with us as well. To use your rights, write to info@ruicodex.com. We answer within one month.

You also have the right to lodge a complaint with a data protection supervisory authority. In Belgium this is the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données): gegevensbeschermingsautoriteit.be / autoriteprotectiondonnees.be. You can also complain to the authority of the country where you live or work.

12. Security of Your Information

Traffic between the app or your browser and our server is encrypted with HTTPS, passwords are stored only as one-way hashes, and access to the server and database is restricted. No transmission over the internet can be guaranteed 100% secure, so please use the Services in a secure environment.

13. Updates to This Policy

We may update this privacy notice from time to time. The updated version will be indicated by an updated "Last Updated" date and will be effective as soon as it is published on this page.