ENES

Privacy Policy

Last updated: November 5, 2026

1. Who we are

InviteTous is provided by Spacode, an Israeli sole proprietorship, Authorized Dealer No. 205674500, located at Isser Harel 1, Or Akiva, Israel. In this policy, “we”, “us” and “our” mean Spacode.

Spacode is the controller of the personal data described in this policy, except for guest data that hosts upload, which we process on the host’s behalf (see section 4).

We have not appointed a data protection officer. For any privacy question or request, contact us at ben@spacode.co.il or +972-54-476-3639.

2. Scope of this policy

This policy applies when you:

  • visit our website, https://invitetous.com;
  • create an account and use the InviteTous web app, as a host or as a co-host;
  • receive an invitation from a host who uses InviteTous, or reply to one; or
  • contact us or use our help bot.

InviteTous is available in English and Spanish to people in the United States, Mexico, Spain and the rest of the European Union. Sections 12 to 16 describe the rights you have depending on where you live.

Our Terms of Service govern your use of InviteTous. Our Cookie Policy explains the cookies and similar technologies we use.

3. Personal data we collect about account users

We collect the following personal data about hosts, co-hosts and anyone else who creates an account:

  • Account details: your name or username, email address, phone number, language preference and, if you choose, a profile photo (uploaded by you or taken from your Google account when you sign in with Google).
  • Sign-in and security data: one-time sign-in codes, refresh tokens, IP address, device and browser information, and bot-check signals from Cloudflare Turnstile.
  • Event details: the title, date, location, description, budget and vendors of your events.
  • Content you create or upload: invitation content, uploaded images and floor plans.
  • AI prompts and outputs: the instructions you give our AI features and the text, layouts and images they generate.
  • Support messages: messages you send to us or to our help bot.
  • Payment records: amount, date, order ID, the number of tous credited, and the payer’s name and country as provided by our payment processor. We never receive or store full card numbers; card data is handled by our payment processor, Hyp.
  • Tous balance and usage: how many tous you have and how you use them.

Most of this data comes directly from you. Sign-in and security data is collected automatically from your device when you use InviteTous. If you sign in with Google, we receive your name, email address and profile photo from Google. Payment records come from our payment processor. If a host shares an event with you as a co-host, we receive the details the host provides for that purpose.

You must provide the details needed to create an account, sign in and complete a purchase; without them we cannot provide InviteTous to you. Everything else, such as a profile photo, is optional.

4. Guest data uploaded by hosts

Hosts can add their guests to InviteTous. For each guest, InviteTous may hold:

  • name and phone number;
  • email address (optional);
  • group tags, such as family, work or VIP;
  • RSVP status and headcount;
  • dietary notes;
  • seat or table assignment; and
  • message delivery status and the replies the guest sends through WhatsApp.

For this guest data, the host is the controller and Spacode is the processor. We process it only on the host’s instructions to provide InviteTous, as set out in our Data Processing Addendum. The host decides which guests to add and how to contact them, and is responsible for having a lawful basis to do so.

If you are a guest, you received an invitation because a host added your details. Questions about why the host has your data, and requests to correct or remove it, are best sent to the host. You can also contact us at ben@spacode.co.il: we will forward your request to the host and help them respond.

5. How we use personal data and our legal bases

This section covers the personal data for which we are the controller. If you are in the European Union, the United Kingdom or another place with similar laws, each purpose relies on the legal basis shown in brackets.

  • To provide InviteTous under our contract with you (performance of a contract): creating and managing your account, signing you in, letting you create events, invitations, seating plans and budgets, sending invitations and reminders by WhatsApp, link or email, collecting RSVPs, running AI features and vendor search, sharing events with co-hosts, processing payments, crediting tous, and sending service messages such as sign-in codes.
  • To keep InviteTous secure and prevent fraud, abuse and automated bot activity (our legitimate interests in protecting our users and our service).
  • To understand how InviteTous is used, fix problems and improve the product (our legitimate interests in offering a useful and reliable service).
  • To answer your questions and provide support, including through our help bot (our legitimate interests in supporting our users).
  • To keep tax and accounting records and respond to lawful requests from authorities (compliance with our legal obligations).
  • To set optional, non-essential cookies, of which we currently use none, and to send marketing emails if we offer them (your consent). We never send marketing emails without your consent, and you can withdraw it at any time.

Where we rely on legitimate interests, we have balanced those interests against your rights, and you can object to the processing (see section 12).

We do not sell your personal information and we do not share it for cross-context behavioral advertising, as those terms are defined in California law. We do not use advertising cookies, and we do not carry out profiling or automated decision-making that produces legal or similarly significant effects on you.

6. AI features

InviteTous includes AI features that help you write invitation text, create layouts and images, and get answers from our help bot. When you use them, we send your prompts and the relevant event content to AI model providers through their business APIs: Google (Gemini) and, depending on our configuration, Anthropic and OpenAI.

We do not use your content to train our own models. We use API services whose terms do not permit the provider to train its models on API inputs by default. Providers may keep inputs and outputs for a limited time under their own terms, for example to detect abuse.

Please do not include sensitive data in prompts, such as health information, government identification numbers or financial details.

7. Who we share personal data with

We share personal data only as described in this section.

Service providers. The following providers (sub-processors) process personal data on our behalf to run InviteTous:

  • Hyp (Israel): payment processing.
  • Google Cloud (Israel): hosting and infrastructure.
  • Google LLC (United States): Gemini AI models, Google Places for vendor search, Google Sign-In, Gmail for sending emails, and Google Fonts on our marketing site.
  • Anthropic (United States): AI models.
  • OpenAI (United States): AI models.
  • Meta Platforms (United States): WhatsApp Business messaging, used to send invitations and reminders and to receive guest replies.
  • Cloudflare (United States): Turnstile bot protection.
  • MongoDB, Inc. (MongoDB Atlas, hosted on Google Cloud in Israel): our database.

Our cache (Redis) runs on our own cloud infrastructure. A guest’s use of WhatsApp is also governed by WhatsApp’s own terms and privacy policy.

Co-hosts. If you share an event with a co-host, they can access that event, including its guest list.

Guests. Guests receive the invitation content and event details that the host chooses to send them.

Legal reasons. We may disclose personal data where the law requires it, to respond to a valid request from a public authority, or to protect the rights, safety and property of our users, the public or Spacode.

Business transfers. If Spacode is involved in a merger, acquisition or sale of all or part of its business, personal data may be transferred as part of that transaction and will remain protected under this policy.

8. International data transfers

Spacode is based in Israel, and our service providers operate in several countries. Your personal data may therefore be processed in Israel, the United States and other countries where our providers operate.

The European Commission and the United Kingdom recognize Israel as providing an adequate level of data protection. When personal data from the European Union or the United Kingdom is transferred to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum for data from the United Kingdom) or, where the provider is certified, the EU-U.S. Data Privacy Framework.

You can ask for more information about these safeguards at ben@spacode.co.il.

9. How long we keep personal data

  • Account data and content (your profile, events, invitations, uploaded images, AI prompts and outputs, and support messages): for as long as your account is active.
  • After you delete your account: we delete your account and event data within 30 days. Copies in our backups are overwritten within a further 30 days.
  • Guest data: deleted together with the event or the host’s account, or earlier if the host asks.
  • Payment and tax records: 7 years, to meet tax and accounting obligations.
  • Security logs: up to 12 months.
  • One-time sign-in codes: they expire after 10 minutes.

We keep personal data longer only where the law requires it, or where it is needed to establish, exercise or defend legal claims.

10. How we protect personal data

We use technical and organizational measures appropriate to the risk, including:

  • encryption of data in transit using TLS;
  • access controls, with staff access limited to what each person needs (least privilege);
  • one-time codes and tokens that are hashed and short-lived;
  • bot protection on sign-in; and
  • never storing payment card data ourselves: card payments are handled by Hyp.

No system is completely secure. If a personal data breach occurs, we will notify the competent authorities and the people affected as the law requires.

11. Your choices and account controls

  • You can edit your profile and change your language preference in the app.
  • You can delete your account in Settings. To protect you, we ask you to confirm with a one-time code. Deleting your account also deletes your events and their guest lists (see section 9).
  • You can control cookies through your browser settings, as explained in our Cookie Policy.
  • If we send you marketing emails, you can unsubscribe at any time using the link in each email.

12. Your rights in the EU, EEA and UK

If the General Data Protection Regulation (GDPR) or the UK GDPR applies to you, you have the right to:

  • access your personal data and receive a copy of it;
  • have inaccurate or incomplete data corrected (rectification);
  • have your data erased;
  • restrict how we process your data;
  • receive your data in a structured, commonly used, machine-readable format and have it sent to another provider (portability);
  • object to processing based on our legitimate interests;
  • withdraw your consent at any time, without affecting processing carried out before you withdraw it; and
  • lodge a complaint with a supervisory authority, in particular in the country where you live or work or where you believe an infringement took place. In Spain, this is the Agencia Española de Protección de Datos (AEPD), aepd.es.

13. Your rights in California

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), gives you the right to:

  • know what personal information we collect, use and disclose, and receive a copy of it;
  • delete your personal information;
  • correct inaccurate personal information;
  • opt out of the sale or sharing of your personal information; we do not sell or share personal information, so there is nothing to opt out of;
  • limit the use of your sensitive personal information; we use sensitive personal information, such as your account sign-in credentials, only to provide InviteTous and for other purposes the CCPA permits;
  • not be discriminated against for exercising any of these rights; and
  • use an authorized agent to make a request for you. We may ask the agent for proof of your signed permission and ask you to verify your identity directly with us.

In the past 12 months we have collected the following categories of personal information:

  • identifiers, such as name, username, email address, phone number and IP address;
  • customer records, such as name, phone number and payment records;
  • commercial information, such as purchases of tous and your tous balance and usage;
  • internet or other electronic network activity, such as device and browser information, sign-in data and bot-check signals;
  • audio, electronic, visual or similar information, such as your profile photo and uploaded images;
  • sensitive personal information, namely account sign-in credentials (your account combined with one-time codes); and
  • other information you provide, such as event details, invitation content, AI prompts and support messages.

We collect these categories from the sources described in section 3, use them for the purposes in section 5, disclose them for business purposes only to the recipients in section 7, and keep them for the periods in section 9. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of sale and sharing.

We respond to California requests within 45 days.

14. Your rights in other US states

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with comprehensive privacy laws may, depending on their state, have the right to access, correct and delete their personal data and to obtain a portable copy of it. We do not sell personal data, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects.

If we decline your request, you can appeal by replying to our decision or by emailing ben@spacode.co.il with the subject “Privacy appeal”. We will respond to your appeal within the time your state’s law requires. If you disagree with the outcome, you can contact your state’s attorney general.

15. Your rights in Mexico

Under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares of 2025, you have the right to access and rectify your personal data, to have it cancelled and to oppose its processing (ARCO rights), and to revoke your consent.

The primary purposes of our processing, which are necessary for our relationship with you, are providing InviteTous, security, support and legal compliance, as described in section 5. Improving the product and sending marketing emails, if we offer them, are secondary purposes: you can tell us at any time at ben@spacode.co.il that you do not want your data used for them, and this will not affect your use of InviteTous.

Sharing data with the service providers in section 7, who act on our behalf, does not require your consent.

We respond to ARCO requests within 20 business days. If you believe your rights have been violated, you can file a complaint with the competent authority, the Secretaría Anticorrupción y Buen Gobierno, which took over the data protection functions of the former INAI in 2025.

16. Your rights in Israel

Under the Israeli Privacy Protection Law, 5741-1981, as amended (including Amendment 13), you have the right to access your personal data and to ask us to correct or delete data that is inaccurate, incomplete, unclear or out of date. You can also file a complaint with the Privacy Protection Authority.

17. How to exercise your rights

Email us at ben@spacode.co.il, if possible from the email address linked to your account, and describe your request. You can also use the account controls in section 11. Wherever you live, we will consider your request in line with the law that applies to you.

Before acting on a request, we verify your identity, for example by sending a one-time code to the email address or phone number on your account. We may ask for more information if needed. If someone makes a request on your behalf, we may ask for proof that they are authorized.

We aim to respond within 30 days, and always within the time the law requires: one month under the GDPR, which we may extend by up to two further months for complex or numerous requests, in which case we will tell you why; 45 days under the CCPA; and 20 business days for ARCO requests under Mexican law.

Requests are free of charge. Where the law allows, we may charge a reasonable fee for, or decline, requests that are manifestly unfounded or excessive, and we will explain why.

If you are a guest and your request concerns data a host uploaded, see section 4.

18. Children

InviteTous is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has created an account, contact us at ben@spacode.co.il and we will delete it.

Hosts may add guests who are minors, for example for an XV años celebration. In that case the host is responsible for doing so lawfully and should add only the information needed for the event.

19. Cookies and similar technologies

InviteTous uses only strictly necessary cookies and similar technologies: a secure cookie that keeps you signed in, browser local storage for your preferences and drafts, and Cloudflare Turnstile bot protection on sign-in. We do not use analytics, advertising or social media tracking cookies. Our Cookie Policy has the details.

20. Changes to this policy

We may update this policy when our service or the law changes. We will publish the new version on this page and update the “last updated” date. If a change materially affects how we use your personal data, we will also notify you by email or in the app.

21. Contact us

For any question about this policy or your personal data, contact Spacode at ben@spacode.co.il or +972-54-476-3639, or write to us at Isser Harel 1, Or Akiva, Israel.