Privacy Notice

1. Who we are

AcharaSutra operates AcharaSutra and is the data controller for the personal data described here. Contact us at invyta@live.com.

Where an event host uploads their guest list, the host is the controller of that guest data and AcharaSutra acts as processor on their behalf.

2. What we collect and why

• Account data — email address, password (stored hashed), display name. Used to create and secure your account. Legal basis: performance of our contract with you.
• Event data — couple names, event date, venue, invitation text, uploaded photos, seating and settings. Used to provide the service. Legal basis: contract.
• Guest data uploaded by hosts — guest names, phone numbers, email addresses, RSVP responses, table assignments, check-in times, number of children, and where the host enables playland, waiver signatures and the clauses accepted. Used to run the event. Legal basis: contract with the host; the host is responsible for their own lawful basis toward guests.
• Purchase records — order status, amount, currency, the email used at checkout, and the payment provider's transaction reference. Used for entitlement, support and accounting. Legal basis: contract and legal obligation. We never see or store your card details.
• Technical data — IP address, browser and device information, and error logs. Used for security, fraud prevention and fixing faults. Legal basis: legitimate interests.

3. Who we share it with

• Hosting and infrastructure providers — for running the application, database and file storage.
• Professional advisers — legal and accounting, where needed.
• Authorities — where we are required to by law.

We do not sell personal data and we do not use it for third-party advertising.

3a. Face matching in guest galleries ("Find my photos")

Where a host enables it, a guest gallery can offer an optional "Find my photos" feature. You give explicit consent on the page, then save a selfie — and up to five faces in total, for example family members. Those selfies are stored privately in the host's Google Drive folder for that event: they are not shared publicly, not shown in the gallery, and not given a public link. They are used only to match you against the photographs in that event's gallery.

Your saved faces are linked to a random identifier kept in your phone's browser storage, so when you reopen the gallery on the same phone your photos appear again without another selfie. There is no login, and we do not ask for your phone number or email for this feature.

To make matching possible, each gallery photograph is described once by our AI provider and we store a short text description of the faces it contains (for example approximate age range, hair, glasses), plus the resulting matches. We do not store face crops or biometric templates.

Deleting this data. On the gallery page you can remove any single saved face, or choose "Delete my profile" to delete your whole profile — this removes your stored selfies from Drive and all your saved matches. The host can switch the feature off at any time and can delete all saved guest profiles, selfies and face descriptions for their event in one action. Otherwise this data is kept until you or the host deletes it, or the event is removed.

4. How long we keep it

Account and event data is kept while your account is open. If you delete your account, event and guest data is deleted within 30 days, except purchase records which we retain for up to 7 years to meet accounting and tax obligations. Signed playland waivers are retained for as long as the host's account exists, because they are legal records of consent.

5. Your rights

You may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or export it. Email invyta@live.com and we will respond within one month. If you are in the UK or EEA you also have the right to complain to your local supervisory authority. Guests who want their data corrected or removed should contact the event host in the first instance; we will help where we can.

6. International transfers

Our hosting and payment partners may process data outside your country. Where data leaves the UK or EEA, transfers rely on adequacy decisions or standard contractual clauses.

7. Security

Data is transmitted over encrypted connections and stored with access controls. Passwords and event PINs are stored hashed, never in plain text. Access to guest data is restricted to the event owner and staff who hold the event PIN.

8. Cookies

We use essential cookies and local storage only — to keep you signed in and to remember your session. We do not use advertising or third-party tracking cookies.

9. Changes

We will update this notice when our practices change and revise the date above. See also our Terms & Conditions and Refund Policy.