Privacy Policy

1. Scope

This Privacy Policy applies to the Guestcard website, applications, and services (the “Service”) and describes how we handle personal information for hosts and guests. Guestcard shares infrastructure and a single sign-in with Pixbox. Read this policy together with our Terms of Service.

2. Information we collect

Information you provide

• Account information — name, email, password (stored hashed), and, if you sign in with Google, the basic profile information Google shares.
• Event details — invitations, schedules, registry items, and other content a host creates.
• Guest information — names and contact details that hosts add to their guest lists, and RSVP responses, meal choices, messages, and similar details guests submit.
• Gift and payment information — handled by our payment processor; we receive confirmation and limited details, not full card numbers.
• Selfies for photo matching — if a guest opts in to find their photos (see “Facial-matching data”).

Information collected automatically

• Usage and device data — pages viewed, actions taken, approximate location inferred from IP, and browser/device details.
• Cookies and similar technologies — to keep you signed in, remember preferences, and measure usage.

3. Guest data and the host relationship

When a host adds guests, they provide us personal information about those guests so we can deliver invitations and manage the event. For that information, the host directs the processing and is responsible for having the right to share it; we process it on the host’s behalf to provide the Service. If you are a guest and want your information corrected or removed, you can contact the host or email us at support@guestcard.app.

4. Facial-matching data

Where a host enables it, curated photos pushed from Pixbox can be matched to a guest who opts in by taking a selfie. This involves generating facial geometry data (a numerical “faceprint”), which may be considered biometric or special-category personal information in your jurisdiction.

• Consent. Guests opt in by choosing to take a selfie; matching is not performed otherwise.
• Purpose limitation. Faceprints are used only to deliver a guest’s own photos. We do not sell them or use them for advertising or surveillance.
• Deletion. Faceprints are deleted when the event or your account is deleted, when the feature is turned off, or on request to support@guestcard.app.

5. How we use information

• To provide, maintain, secure, and improve the Service;
• To deliver invitations, manage RSVPs, schedules, and registries;
• To deliver curated photos and, where opted in, facial matching;
• To process gifts and payments;
• To send transactional messages (sign-in, RSVPs, reminders, notifications);
• To provide support; to prevent fraud and abuse; and to comply with law.

Our legal bases (where applicable) include performance of our contract, your consent (for example facial matching and certain cookies), our legitimate interests in operating and securing the Service, and compliance with law.

6. How we share information

We do not sell your personal information. We share it only to run the Service:

• Between hosts and guests as needed to run the event (for example, a host sees their guests’ RSVPs).
• With service providers (subprocessors) listed below.
• For legal reasons and in a business transfer, with continued protection under this policy.

Subprocessors

7. Cookies and analytics

We use strictly necessary cookies to keep you signed in and to operate the Service, and analytics cookies (via PostHog) to understand usage. You can control cookies in your browser; disabling necessary cookies may break sign-in and core features.

8. Data retention

We retain personal information while your account or event is active and as needed to provide the Service, then only as required to meet legal obligations, resolve disputes, and enforce our agreements. Deleted Content is removed from active systems and purged from routine backups within a limited period.

9. Your rights and choices

Depending on where you live (for example under Canada’s PIPEDA, the EU/UK GDPR, or California’s CCPA/CPRA), you may have the right to access, correct, delete, port, or restrict processing of your personal information, to withdraw consent, and to object to certain processing. Email support@guestcard.app to exercise these rights; we will respond as required by law. EEA/UK users may also complain to their local data-protection authority.

10. International transfers

We and our subprocessors may process information in Canada, the United States, and other countries, relying on appropriate safeguards (such as standard contractual clauses) where required.

11. Children’s privacy

The Service is not directed to children under 16, and we do not knowingly collect their personal information as account holders. Hosts are responsible for any information about minors they include in their events. Contact us if you believe a child has provided us personal information as a user, and we will delete it.

12. Security

We use technical and organizational measures — including encryption in transit, access controls, and reputable infrastructure providers — to protect your information. No system is perfectly secure, so we cannot guarantee absolute security. Keep your credentials confidential.

13. Changes to this policy

We may update this policy from time to time, revising the “last updated” date above and giving additional notice for material changes where appropriate.

14. Contact

For privacy questions or requests, email support@guestcard.app.

Guestcard is a product of Lysensy Inc., a corporation incorporated under the laws of Canada, which is the data controller responsible for personal information processed through the Service.