Privacy policy
Last updated: 3 November 2026
Your trust matters more than anything. This page explains, simply, what data we use, why, for how long, with whom, and how to exercise your rights, in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and the French Data Protection Act (Law no. 78-17 of 6 January 1978).
In short
- We collect only what is necessary for your invitation.
- We never sell, rent or exchange any data, and we do no targeted advertising.
- Your guests' data is used only for your event and is deleted automatically 30 days afterwards.
- The website is hosted in the European Union, with no advertising cookies or external tracking tools.
1. Data controller
TOVA, a limited liability company (SARL) with share capital of €1,000, 280 avenue du Prado, 13008 Marseille, France, Marseille Trade Register no. 944 883 156, which operates the InviteTo brand. Contact for any question about your data: contact@inviteto.fr. Given its activity, TOVA is not required to appoint a data protection officer; the person in charge of these matters is its managing director.
2. Our customers' data
| Why | What data | Legal basis | Retention |
|---|---|---|---|
| Create, deliver and, if you chose it, send your invitation; give you access to your platform | Name, phone, email, company name where applicable, event details, texts, photos, logos, music and design choices | Performance of the contract (Art. 6.1.b GDPR) | 3 years after the event; photos, logos and music: 3 months after the event |
| Collect payment and issue the invoice | Identity, amount, payment reference (never your card numbers, which are handled only by Stripe) | Legal obligation (Art. 6.1.c) | Invoices: 10 years (Art. L123-22 of the French Commercial Code) |
| Reply to your messages and quote requests | Name, email, phone, company, message | Pre-contractual measures or legitimate interest in replying to you (Art. 6.1.b and f) | 3 years |
| Secure the website and prevent abuse (automated submissions, payment fraud) | IP address, technical log of emails sent | Legitimate interest (Art. 6.1.f); legal obligation for the hosting provider's connection logs | Anti-abuse counter: 2 hours; email log: 1 year; hosting provider's connection logs: 1 year (Decree no. 2021-1362) |
We send you no newsletters or advertising. The only emails you receive relate to your order, including, the day after your event, a thank-you note inviting you to leave a review, with no obligation.
3. Your guests' data
You, the customer, decide whom to invite: you are the controller of your guests' data. TOVA acts as a processor on your behalf, within the meaning of Article 28 GDPR, and contractually undertakes to:
- use their first name, last name and phone number solely to send them your invitation by text message and collect their replies;
- never sell, share or use them for advertising, or for its own purposes;
- delete them automatically, along with their replies, 30 days after your event;
- make them accessible only to you, on your protected platform;
- protect them with appropriate security measures, give access only to those who need it, and notify you without delay in the event of an incident;
- help you respond to any request from a guest who wishes to exercise their rights.
Any guest may at any time ask to stop receiving messages or to have their reply deleted, by writing to contact@inviteto.fr.
4. Who receives your data?
Only the TOVA team and essential technical providers, bound by contract, subject to confidentiality and to the GDPR:
- OVH SAS (Roubaix, France): hosting of the website, orders, replies and emails, in the European Union;
- Stripe Payments Europe Ltd (Dublin, Ireland): secure card payment. Some data may be processed in the United States by the Stripe group, which participates in the EU–US Data Privacy Framework and applies the European Commission's standard contractual clauses;
- Brevo (Sendinblue SAS) (Paris, France): sending text messages to guests for the Design + SMS Sending plan, data hosted in the European Union.
No data is passed to any other third party, unless required by law (for example at the request of a judicial authority).
5. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability of your data (Articles 15 to 21 GDPR), as well as the right to set instructions on what happens to your data after your death (Article 85 of the French Data Protection Act). No automated decision-making or profiling takes place.
To exercise your rights, write to contact@inviteto.fr. We reply within one month at most. We may ask you to prove your identity, only in case of reasonable doubt.
If, after contacting us, you believe your rights are not being respected, you may lodge a complaint with your local data protection authority or with the CNIL (the lead supervisory authority): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.
6. Cookies and storage on your device
This website uses no cookies, no external tracking tools (no Google Analytics) and no social media buttons that track you: no banner to accept.
Audience measurement. To know how many people visit the website and where they come from, our server counts page views, without cookies and without any third-party service. It keeps only daily totals: the page viewed (without its parameters), the site you came from (for example Google or Instagram) and the type of device (phone, computer). Your IP address is never recorded: it is used only, on the same day, to calculate a non-reusable fingerprint that avoids counting the same person twice. These statistics are strictly limited to measuring the website's audience, are shared with no one and are deleted after 13 months. In line with CNIL guidelines, this measurement is exempt from consent. You can refuse it by blocking JavaScript or requests to /api/visite.php.
Fonts and music are hosted on our own server: no data is sent to a third-party service when you visit. The Stripe payment page only opens when you order.
Your browser stores locally, on your device: your invitation draft while you design it (you can erase it with "Start over"), the "music muted" choice on the home page and, for a guest, the fact that they have already replied. None of this is sent to us before you confirm. Only the administration area reserved for the InviteTo team uses a login cookie, which is strictly necessary. These elements are exempt from consent (Article 82 of the French Data Protection Act).
7. Security
The website is served exclusively over an encrypted connection (HTTPS). Orders, images, music and replies are stored in an area that cannot be accessed from the internet. Your customer platform and final invitation only open with a secret link unique to your order; your guests' invitation is not indexed by search engines. Administration is protected by a password. Payments are processed by Stripe, certified PCI DSS Level 1: TOVA never has access to your card numbers.
8. Minors
Our services are intended for adults. Data about minor guests (for example for a child's birthday) is provided by the customer under their responsibility and protected in the same way.
9. Changes
This policy may change, for example if we add a provider. The update date is shown at the top of the page; in the event of a significant change, customers with an order in progress are informed by email.