Privacy Policy

This policy explains what personal information Inwyt collects, why, who we share it with, how long we keep it, and your rights. It covers our website https://inwyt.link, event pages on *.inwyt.link, and the Inwyt dashboard. It includes the disclosures required by the EU and UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the California Online Privacy Protection Act (CalOPPA), and Sri Lanka's Personal Data Protection Act, No. 9 of 2022 (PDPA).

1. Who we are and our role

Inwyt is an independent solo venture owned and operated by Pasan Nissanka, an individual based in Sri Lanka, trading as "Inwyt". Contact: [privacy@inwyt.link].

• For Hosts' account and billing data, and website visitors' data, Inwyt is the controller (GDPR, PDPA) and the business (CCPA).
• For Guest Data (information about the people a Host invites, whether the Host enters it or the Guest submits it), the Host is the controller and Inwyt is the Host's processor (GDPR, PDPA) and service provider (CCPA). We use Guest Data only to provide the Service to that Host. Guests who want to exercise their rights should contact the Host first; we will help (section 11).

2. Information we collect

Guests do not create accounts. We do not collect information directly from Guests other than what they submit through their own invite link.

3. How we use information and our legal bases

We do not use personal information for automated decisions that have legal or similarly significant effects on anyone.

Dietary and accessibility notes may reveal information about health or religious belief. We use them only so the Host can see them and plan catering and access. We never use them for analytics or marketing.

4. Emails we send

• Account and billing emails (sign-in, security, payment receipts and reminders, failed payments, plan expiry, archive and deletion notices): needed to run your account, so you cannot opt out while you have one.
• Event reminders and RSVP activity emails to Hosts: you can turn these off in your email preferences or through the unsubscribe link.
• Marketing emails: sent only with consent where the law requires it. Every email has a one-click unsubscribe.
• Messages to Guests: invitations and reminders the Host chooses to send, from the Host's own WhatsApp or email app; Inwyt does not send them. Guests can opt out of a channel from the preferences link in their invitation.

We do not show advertising, use remarketing or retargeting services, or sell email lists.

5. Sharing

We do not sell personal information and do not "share" it for cross-context behavioural advertising (as those terms are defined in the CCPA), and have not done so in the past 12 months. We disclose information only to:

• To the Host: everything Guests submit through an invitation goes to the Host who invited them.
• To Guests: an event page shows what the Host chose to publish. A personal invite link shows only that Guest's own details, never other Guests'. Approved Guest Moments photos may be visible to other Guests or the public, as the Host chooses.
• Team members a Host invites can see that Host's event and Guest Data.
• For legal reasons: when required by law, court order or a valid request from authorities, or to protect people's safety or our rights.
• Business transfer: if Inwyt is sold or reorganised, to the new owner, who must honour this policy.

Messaging apps. Invitations and reminders to Guests are sent by the Host from the Host's own WhatsApp or email app. Those providers (such as Meta for WhatsApp, or the Host's email provider) handle the message under their own privacy policies. Inwyt keeps only the message text the Host prepared and a record that it was sent.

Images on our website. Some photos on our marketing website are loaded directly from Unsplash, which receives your IP address and browser details when your browser requests them.

6. Cookies, analytics and Do Not Track

• Essential cookies: a sign-in session cookie on the dashboard, and on event pages a signed cookie valid for six hours that lets a Guest upload photos to Guest Moments. These are needed for the Service and do not track you.
• No analytics cookies: we use PostHog to count visits, see which pages help and catch errors on our website, the dashboard and event pages. It runs in cookieless mode: it sets no cookies and stores nothing on your device, so there is nothing to accept or reject. Instead of a cookie, PostHog estimates unique visitors from a hash of your IP address and browser details, made with a value that changes every day, so it cannot follow you from one day to the next or across other websites. We do not identify you in it, record your screen or collect what you type. On event pages, the personal code in a Guest's invite link is removed before anything is sent, and page titles (which can show a Guest's name) are not sent at all. We have not turned on any advertising features.
• Do Not Track (CalOPPA disclosure): browsers' Do Not Track signals have no common standard, so we do not respond to them. We do honour Global Privacy Control (GPC) signals as a request to opt out of sale and sharing; because we do not sell or share, no further action is needed for a GPC signal.
• Other than PostHog as described above, which works for us only, we do not allow third parties to collect information about your online activities over time and across websites when you use the Service.

7. International transfers

Inwyt is based in Sri Lanka, and our providers store data mainly in the United States. When we transfer personal data from the EU, UK or Sri Lanka to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum) or equivalent safeguards our providers offer, and on transfer mechanisms permitted under the PDPA. Contact us for a copy of the relevant safeguards.

8. How long we keep information

Guest Data and event content are kept only while the event exists. Every event is live, then archived, then deleted:

• A Host can delete an event at any time. Deleted events, their Guest Data and uploaded photos are removed from our live systems within one day. We keep no archive copies. Residual copies in automatic database backups and logs are overwritten within 30 days.
• Account data is kept while your account is open and deleted within 30 days of closing it.
• Hashed link-activity records are deleted with their event.
• Payment and invoice records are kept for as long as tax and accounting law requires, even after an event or account is deleted. Paddle keeps its own records under its policy.
• Waitlist emails are deleted once we have told the waitlist that Inwyt is open, unless you create an account.
• Marketing preferences (including unsubscribes) are kept so we keep honouring them.

9. Security

All traffic uses HTTPS (TLS). Data is encrypted at rest by our hosting providers. Each Host's data is isolated from other Hosts'. Each Guest's invitation link is a long random token that shows only that Guest's information. Passwords are handled by Amazon Cognito. We store hashes rather than raw IP addresses for link activity. No system is perfectly secure. If a personal data breach is likely to affect your rights, we will notify you and the relevant authorities as the law requires (under GDPR, within 72 hours of becoming aware of it).

10. Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you and get a copy, including in a portable format;
• correct inaccurate information;
• delete your information;
• restrict or object to certain uses, including at any time to direct marketing;
• withdraw consent where we rely on it, without affecting earlier processing;
• complain to a data protection authority.

Hosts can view, edit, export and delete most of their data in the dashboard. For anything else, email [privacy@inwyt.link]. We will verify your identity, normally by confirming access to your account email, and answer within one month (GDPR, PDPA) or 45 days (CCPA); we may extend this where the law allows and will tell you why.

EU and UK residents. You may complain to your local supervisory authority.

Sri Lanka residents. Under the PDPA you may request access, correction, completion, erasure, and to withdraw consent or object to processing, and to have automated decisions reviewed. If you are not satisfied with our response you may appeal to the Data Protection Authority of Sri Lanka.

11. Guests' rights

Guest Data belongs to the Host who invited you. To see, correct or remove your details, contact the Host first. You can opt out of being contacted on a channel from the preferences link in your invitation. If you cannot reach the Host, email [privacy@inwyt.link] with the event's web address; we will pass your request to the Host and, where the law allows or requires, act on it ourselves.

12. California privacy rights (CCPA/CPRA)

This section applies to California residents. In the past 12 months we have collected:

• Sources: you; Hosts (about Guests); Guests; your browser and device; Paddle.
• Purposes: those in section 3.
• Retention: section 8.
• Sale and sharing: we do not sell or share personal information, and we have no actual knowledge of selling or sharing that of consumers under 16.
• Sensitive personal information is used only to provide the Service, as the CCPA regulations permit without a right to limit, so that right does not apply.
• Your rights: to know (categories and specific pieces), delete, correct, opt out of sale or sharing (no action needed, as we do neither), and limit use of sensitive personal information. We will not discriminate against you for exercising them.
• How to ask: email [privacy@inwyt.link]. We will confirm receipt within 10 business days and respond within 45 calendar days. An authorised agent may ask on your behalf with your signed permission; we may still verify your identity directly with you.
• Shine the Light (Cal. Civ. Code § 1798.83): we do not disclose personal information to third parties for their own direct marketing.

13. Children

Inwyt is not directed to children. Hosts must be at least 18. We do not knowingly collect personal information directly from children under 13 (or under 16 in the EU and UK). Hosts sometimes list children as Guests, for example on a family invitation; that information is Guest Data that the Host is responsible for, and the Host confirms they have permission from the child's parent or guardian. If you believe a child has given us information directly, email [privacy@inwyt.link] and we will delete it.

14. Reviewing and changing your information (CalOPPA)

Hosts can review and change their account information in the dashboard settings, and their events and Guest Data in each event. Anyone else can ask us as described in section 10.

15. Changes to this policy

We will post changes here and update the "Last updated" date. For material changes we will email Hosts at least 14 days before they take effect and, where the law requires, ask for consent again.

16. Contact

• Inwyt: Pasan Nissanka, trading as Inwyt, Colombo, Sri Lanka · [privacy@inwyt.link]
• Data Protection Officer (PDPA): [dpo@inwyt.link]