Privacy Policy

Controller identity

Ilovite is a service operated in Finland by Hilal Gerçek (“Ilovite”, “we”, “us”). Where we determine the purposes and means of processing personal data, Hilal Gerçek is the data controller. Privacy enquiries can be sent to privacy@ilovite.com.

Who this policy applies to

This policy applies to Ilovite account holders and guests who open an invitation or submit an RSVP response.

For account, authentication, service administration, security and Ilovite's own operational purposes, Ilovite acts as controller.

For event-specific guest information, Ilovite's role depends on the nature of the event and the processing activity. Where an organiser acts as a data controller and uses Ilovite to process guest information on its behalf, Ilovite acts as a processor under the organiser's instructions.

Some guest data may be entered or imported before a guest opens the invitation — for example when importing a guest list. In those cases, the organiser is responsible for having a lawful basis to provide the data to Ilovite. Guest information that was not provided directly by the guest is generally obtained from the event organiser or a planner authorised by the organiser.

What we store

Some account information is required to create and use an account. RSVP fields may be required or optional depending on how the organiser configures the event.

• Account data: name, email address, profile picture (when signing in with Google), and authentication data.
• Invitations: subdomain, event title, date, published content, and settings.
• Guest RSVP data: guest name, email, phone number, optional dietary restrictions, attendance choices, additional guests, messages, and custom RSVP responses.
• Operational data: transactional email delivery logs and limited security or abuse-prevention records.

Dietary restrictions: This field is optional. Dietary information may reveal sensitive information, such as health or religious details, and therefore may require additional protections under data protection law. Organisers should enable this field only when needed for the event and collect only the information necessary for that purpose. Where consent is required, it must be obtained before the information is processed and guests must be able to withdraw it. Dietary answers are visible to the organiser (and any planner acting for that event) for arranging the event and are retained under the same account and event retention rules as other RSVP data.

Legal bases for processing

Where Ilovite acts as controller, we process personal data on the following GDPR legal bases depending on the activity:

• Performance of a contract or pre-contractual steps: creating and managing an account, invitations and related service communications where this processing is necessary to provide the service requested by an account holder.
• Legitimate interests: protecting the service, preventing abuse, maintaining limited operational logs, and improving reliability — balanced against your rights.
• Legal obligation: when we must retain or disclose data to comply with applicable law.
• Consent: where consent is the applicable legal basis — for example, where we act as controller and rely on explicit consent for special-category information, or if we later introduce non-essential cookies or marketing communications. We do not send marketing emails at this time.

Where Ilovite acts as a processor for guest data, the organiser (as controller) is responsible for identifying and documenting the lawful basis for collecting that guest data. Ilovite does not select the legal basis for guest data processed solely on the organiser's instructions.

Recipients and international transfers

We use service providers to operate, store, authenticate, and deliver the service. An up-to-date list is on the Service providers and subprocessors page.

Some of our service providers may process personal data outside the European Economic Area. Where required, appropriate safeguards are used to protect personal data in accordance with applicable data protection law.

Retention

Account data is retained while your account remains open. You can request deletion of your account and personal data at any time.

Invitation and guest data are retained while needed to provide the service and for a limited period afterwards, after which they are deleted when no longer necessary. Deleting an invitation, or deleting your account on request, removes the related production data. Your account may remain for future events unless you ask us to delete it.

Your rights

Where the GDPR applies to our processing of your personal data, you may have the right to:

• access your personal data;
• request correction of inaccurate or incomplete data;
• request erasure in certain situations;
• request restriction of processing;
• receive or transfer your data, where the right to data portability applies;
• object to processing based on legitimate interests;
• withdraw consent at any time where processing is based on consent; and
• lodge a complaint with a supervisory authority.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

In Finland, the supervisory authority is the Office of the Data Protection Ombudsman.

You can exercise your rights regarding Ilovite by emailing privacy@ilovite.com. We may ask for information necessary to verify your identity or identify the relevant account, invitation, or RSVP response.

For event-specific guest data where the organiser is the controller, guests should normally contact the organiser directly. If you contact Ilovite instead, we will assist the organiser or forward the request as appropriate.

Cookies

We currently use only essential first-party cookies, and third-party embeds load only after you choose them. See the Cookies page for names, purposes, and durations.

Contact

Privacy questions or data requests: privacy@ilovite.com