Privacy Policy

This policy applies to the Keemori website, our made-to-order event invitation design service, and the invitations created and shared through it.

For guest data in an invitation, the invitation owner decides what is collected; we process that data on the owner's behalf.

Consultation details: your name, email, phone number, the channel you contact us on (Zalo, Facebook Messenger, email), a description of your event and your design brief.

Account data: the account we create using the email you provide, plus a display name and phone number if any. The initial password is set by us and sent to you; once you change it, your password is stored only as a one-way hash that we cannot read.

If you sign in with Google or Facebook, we receive your email address and display name from that provider, plus an identifier to recognise you next time. We never receive your password for those services.

Invitation content: the host name, event time and venue, photos, logos, invitation wording and gift details (if any) that you provide or enter yourself.

Content submitted by guests: names and wishes in the guestbook; and names, whether they will attend and how many people are coming if the invitation has an RSVP section.

Technical data: IP address, browser type, access time, and a random viewer ID stored in guests' cookies to count how many people have viewed an invitation.

Payment data: amount, order code, time, and the sender's name and account number that the bank sends with the transaction. We never receive or store your card number.

To advise you, design your invitation to order and keep in touch while we work on it.

To create, store and show your invitation to people who open its link.

To authenticate sign-ins, keep sessions and protect accounts from unauthorised access.

To reconcile payments and match each order to the right invitation.

To send transactional emails: account details, password resets and payment receipts. We do not send marketing email unless you sign up for it.

To count how many people have viewed an invitation, so you know how far it has reached.

To detect abuse, fight spam and improve the service.

We use cookies to keep you signed in and to refresh your session when it expires.

Guests who open an invitation get a cookie containing a random viewer ID. It is not linked to anyone's identity; it only ensures that one person opening the invitation several times is not counted as several people.

We use Google Analytics to measure traffic to our marketing and pricing pages. It sets analytics cookies and gives us aggregate figures — sessions, traffic sources, devices — not who you are.

Your invitation page is outside that measurement: we deliberately do not load Google Analytics on invitation pages, so invitation links and the information on them are not sent to Google.

No cookies are used for personalised advertising, and we do not use third-party ad tracking.

Some forms are protected by reCAPTCHA to block automated submissions; this means your browser exchanges data with Google under Google's own policy.

We do not sell your personal data.

Data is only shared with providers that help us run the service, and only to the extent each one needs:

• Our server and database hosting providers.
• Resend — sending transactional email (account details, password resets, payment receipts).
• SePay — receiving and reconciling bank transfers.
• Cloudflare R2 — storing and serving the photos on invitations.
• Google and Facebook — only if you choose to sign in with them.
• Google reCAPTCHA — blocking automated form submissions.
• Google Analytics — measuring traffic to marketing pages, not invitation pages.
• Photon / OpenStreetMap or Google Places — address suggestions when entering an event venue.

Messages you send us on Zalo or Facebook Messenger pass through those platforms and are subject to their own privacy policies.

Google Maps Embed runs in a guest's browser when an invitation includes a map. In that case the guest's browser connects directly to Google under Google's own policy, without going through our servers.

We may disclose data when lawfully required by a competent state authority.

Anyone with an invitation link can see its content. Think carefully before including sensitive details such as a home address or personal bank account number.

Depending on the design, an invitation may have a guestbook — where guests leave their name and a wish — and an RSVP section, where guests say whether they will attend and how many people are coming.

Submitted wishes are held for approval and only appear on the invitation once the owner approves them. The owner can delete any wish. RSVP responses are never shown publicly; only the invitation owner can see them.

What guests enter belongs to the invitation owner; we store it on their behalf and use it for nothing else.

Photos are recompressed before storage, and all metadata is removed in the process — including the GPS coordinates phones usually embed.

This is deliberate: an invitation is a public link, and a photo that still carries coordinates would reveal where it was taken to anyone who opens the invitation.

Uploaded photos are served from hard-to-guess links that do not require sign-in. Anyone with a photo's link can see it.

When an invitation is deleted, its photo files are deleted from storage, not just hidden from the interface.

Connections to the service are encrypted with HTTPS. Passwords are hashed one-way before storage.

Keemori staff see your invitation content while designing, revising and supporting it. Internal access to data is limited by role and used only for those purposes.

No system is perfectly secure; change your initial password, use a strong password and do not share your account.

You have the right to view, correct or request deletion of your personal data.

You have the right to request a copy of your data, including your history of accepting legal documents, and to withdraw consent you gave earlier.

To exercise these rights, send a request through the support channels on our Contact page; we may need to verify your identity first.

The person ordering a design and the account holder must be 18 or older. We do not knowingly collect children's data; if we find any, it will be deleted.

This policy may be updated as the service or the law changes. The version and date of the latest update are always shown at the top of this page.

If you delete your account yourself under Account, your account data is permanently deleted, your email address is released and you can register again with it.

If we disable an account (for example, for breaching our terms), it loses sign-in access, related data is kept, and that email address cannot be registered again.

In both cases, orders and payment transactions are not deleted — accounting law requires us to keep these records.

Paid invitations and their photos are kept for as long as your account exists; no automatic deletion applies to them.

Your account is kept for as long as you want to use it: we do not delete accounts for inactivity.

Orders and payment records are not deleted along with an invitation or account — see section 12.

Admin activity logs are kept for 24 months from the date recorded, then deleted automatically.

Database backups are kept for at most 30 days and then deleted. Because a backup is a snapshot of all data at one point in time, content you asked us to delete may still exist in backups that have not yet expired — no later than 30 days after you delete it, that content no longer exists anywhere in our systems. We do not use backups to restore data deleted at your request.

Questions and requests to exercise your personal data rights can be sent to Keemori's support email or Facebook Messenger.

• Emailhotro@keemori.com