1. Overview
Invitee.live ("Invitee", "we", "us", or "our") is a software service operated from Portugal that helps professionals manage client sessions, forms, files, communication, reminders, calendar workflows, and payments.
For account administration, billing, security, analytics, and our own business operations, Invitee generally acts as a data controller. When a professional uses Invitee to collect or manage information about their clients, the professional generally determines why that information is processed and Invitee acts as a processor or service provider on their behalf.
Clients with questions about information requested or used by a professional should normally contact that professional directly.
2. What Data We Process
The information we process depends on how Invitee is used and may include:
- Account information, such as name, email address, authentication identifiers, business details, and preferences.
- Client and session information entered by professionals, such as names, contact details, appointment details, instructions, FAQs, and related workflow information.
- Forms, comments, reference images, PDFs, attachments, and other files submitted by professionals or clients.
- Payment information related to Invitee subscriptions and professional-client transactions, such as amounts, currency, payment status, refunds, platform fees, and Stripe transaction identifiers. Payment card details are handled by Stripe and are not stored by Invitee.
- Integration information, such as connected Stripe account details and, where enabled, Google account, calendar, authorization, and synchronization information needed to provide connected features.
- Usage and technical information, such as IP address, browser and device information, timestamps, page activity, invite-open events, and last-seen information.
- Support and communication information when you contact us.
3. Sensitive Information
Professionals may configure forms that ask clients for health-related or other sensitive information relevant to their service. The professional determines whether that information is requested and is responsible for having an appropriate legal basis and obtaining any consent or applying any safeguards required by law.
Invitee processes that information only as necessary to provide the service on behalf of the professional.
4. How We Use Personal Data
We use personal data where necessary to operate Invitee, including:
- Creating accounts and authenticating users.
- Providing client pages, forms, files, comments, reminders, and related workflow features.
- Processing subscriptions, connected payment workflows, refunds, and related transaction records.
- Providing enabled integrations such as Stripe and Google Calendar.
- Sending transactional communications such as invites, updates, reminders, and activity notifications.
- Securing the service, preventing abuse, troubleshooting, and maintaining reliability.
- Understanding product usage and improving Invitee.
- Complying with legal, accounting, tax, and regulatory obligations.
5. Legal Bases
Where GDPR applies and Invitee acts as controller, we rely on one or more appropriate legal bases depending on the processing:
- Performance of a contract, where processing is necessary to provide Invitee or a requested feature.
- Legitimate interests, such as securing, maintaining, and improving the service and preventing misuse.
- Legal obligations, including accounting, tax, and compliance requirements.
- Consent, where applicable law requires it.
Where Invitee processes client data on behalf of a professional, that professional is responsible for determining the appropriate legal basis for collecting and using that data.
6. Service Providers and Integrations
We use third-party providers to operate Invitee. Depending on the features you use, these may include:
- Clerk for authentication and account management.
- Stripe for subscription billing, connected payment accounts, payment processing, and refunds.
- Supabase for database hosting and file storage.
- Resend for transactional email delivery.
- PostHog for product analytics.
- Vercel for application hosting and related infrastructure.
- Google for services such as Google Calendar and Maps where those integrations are used.
- Crisp for customer support where enabled.
We may also disclose personal data where required by law or where reasonably necessary to professional advisers, regulators, law enforcement, or in connection with a business transfer.
7. International Transfers
Some service providers may process personal data outside the European Economic Area. Where required, we rely on appropriate legal safeguards for those transfers, such as adequacy decisions, contractual protections, or other lawful transfer mechanisms.
8. Data Retention
We keep personal data only for as long as reasonably necessary to provide the service and meet legal, security, accounting, and operational requirements.
- Account information is generally retained while the account is active and for a reasonable period afterwards where necessary.
- Client pages, files, comments, and form submissions are generally retained until deleted by the professional, removed through account closure, or no longer required to provide the service.
- Subscription, payment, refund, and related financial records may be retained for longer where required for accounting, tax, fraud prevention, dispute handling, or other legal obligations.
- Backups and technical logs may remain for a limited period before being overwritten or deleted.
9. Your Rights
Where applicable, you may have rights to access, correct, delete, restrict, object to, or receive a copy of your personal data, and to withdraw consent where processing is based on consent.
To exercise rights relating to data Invitee controls directly, contact contact@invitee.live. We may need to verify your identity before responding.
If your request concerns information collected by a professional through a client page, you may need to contact that professional first. Where Invitee acts as their processor, we will assist them as required.
You also have the right to lodge a complaint with the relevant data protection authority. In Portugal, this is the Comissão Nacional de Proteção de Dados (CNPD).
10. Security
We use reasonable technical and organizational measures designed to protect personal data, including access controls and security measures appropriate to the service. No method of transmission or storage can be guaranteed to be completely secure.
11. Changes to This Policy
We may update this Privacy Policy as Invitee or applicable requirements change. The current version and its "Last updated" date will be published on this page.
12. Contact
If you have questions about this Privacy Policy or how Invitee handles personal data, contact contact@invitee.live.