Privacy policy

Elicus Technologies Private Limited (“we”, “us”), which runs Truly Invited, is the Data Fiduciary for the personal data described here. This policy is our notice under the Digital Personal Data Protection Act, 2023 and the rules made under it (the “DPDP Act”), and is published under the Information Technology Act, 2000 and its rules. Notice version 2026-10-23.

For any question about your personal data, write to our Grievance Officer, [Grievance officer’s name], at support@trulyinvited.com.

In short

• We collect only what we need to make, show and bill your invitations, and to keep the service safe.
• We don’t sell your data, show ads, or share your data with anyone for advertising or marketing.
• A few service providers process data for us — for hosting, payments, email, sign-in and error reports — only on our instructions.
• What you put on an invitation can be seen by everyone who has its link, or by everyone if you make it Public.
• You can see, correct and delete your data in Settings, and withdraw your consent by deleting your account.

What we keep and why

When you sign in, we ask for your consent to the following, separately from the Terms:

• Your email address, and your name and profile photo if you use Google — To sign you in, and to send sign-in codes, invoices and reminders before an invitation goes offline.
• What you put on an invitation: names, dates, venue, messages, links and photos — To show the invitation to everyone who has its link (or to anyone, if you make it Public), and to keep it in your account until you delete it.
• Billing name, state and GSTIN (if you give one), when you pay — To issue invoices, which tax and company law require us to keep for at least 8 years.
• Payment records from Razorpay: amount, method, status, and the email, phone number and UPI ID or bank you paid with — never your card number, CVV, UPI PIN or banking password — To keep invitations live, switch Pro on, and handle renewals, refunds and disputes.
• Technical data: IP address, browser, sign-in times and how many times your invitations are opened — To keep the service secure, stop abuse, fix problems and show you view counts.

We also keep:

• Your consent — the version of this notice you agreed to, when, how you signed in, and your confirmation that you are 18 or older — to show what you agreed to, as the DPDP Act requires.
• Guest drafts — if you start an invitation without signing in, what you put on it, linked to your browser, so you can come back to it.
• Reports and messages — if you report an invitation or write to us: the invitation’s link, what you tell us, and your email address if you give it, to deal with your report or request.

People who open an invitation don’t sign in or give us anything, and invitation pages set no cookies. We count how many times an invitation is opened each day — a number, not who opened it. Like any website, our servers and Cloudflare see your IP address and browser in order to deliver the page and protect it from abuse.

We don’t collect passwords (we don’t use any), your card number, CVV, UPI PIN or banking password, Aadhaar or other identity numbers, or your location. Photos lose their camera and location data when they are uploaded.

Other people on your invitation

Invitations name and show other people — the couple, family, children. You decide what goes on yours, and you must have their consent (for a child, you must be their parent or lawful guardian, or have their parent’s or guardian’s consent). We process their details only to make and show the invitation as you choose. If you are on someone’s invitation and want something removed, report the invitation or write to support@trulyinvited.com.

On what basis

We process your personal data with your consent, for the purposes listed above. Where a law requires us to keep or disclose data — for example invoices under tax law, or information a court orders us to produce — we do so because the law requires it.

Who can see what you publish

An invitation set to “Anyone with the link” can be opened by everyone who has its link — they can forward it, and copy, screenshot or scrape what is on it. Search engines are asked not to list it, but it is not secret. A “Public” invitation can be found by anyone, including on Google. “Only me” hides it from everyone else. Once shared, copies others have made can’t be recalled. Think about the names, phone numbers, addresses and photos you put on an invitation; see section 5 of our Terms.

Who we share it with

We don’t sell, rent or trade personal data, and we don’t share it with anyone for advertising or marketing. We show no ads and use no advertising or analytics trackers.

We use a few service providers to run Truly Invited. Those that process personal data for us do so under contract and only on our instructions (Data Processors under the DPDP Act). Razorpay and Google also handle what you give them directly — your payment details, your Google account — under their own terms and privacy policies.

• [Server and database provider] — our servers and database, in India.
• Cloudflare — domain names and security (firewall, and bot checks with Turnstile), delivering pages and files through its worldwide network, and storing photos, music, posters and invoices.
• Razorpay — payments. You enter your payment details on Razorpay’s checkout, and it tells us the result.
• Resend — sending our emails: sign-in codes, invoices and reminders.
• Google — sign-in, only if you choose “Continue with Google”: Google gives us your name, email address and profile photo.
• Sentry — error reports from our servers, which can include technical details of the request that failed.

Apart from them, we disclose personal data only:

• to comply with the law, or an order or lawful request of a court, the police or another government agency authorised by law — for example under the IT Act and the IT Rules;
• to report an offence when the law requires us to, or to protect someone’s life or safety in an emergency; or
• if our business is merged or transferred under a scheme the law approves, to the company that takes it over, which must keep the promises in this policy.

Where your data is

Our servers and database are in India. Some of our service providers — Cloudflare, Google, Resend and Sentry — also process data in other countries, and Cloudflare keeps copies of invitation pages and files in data centres around the world so they open quickly wherever your guests are. We transfer personal data outside India only as the DPDP Act allows, and never to a country the Government of India has restricted.

How long we keep it

• Your account (email address, name, profile photo): while you have it. When you delete your account, we erase them from it at once. The IT Rules make us keep your email address and name for 180 days after that, set apart and only to answer lawful requests; then we erase them too.
• Invitations and photos: until you delete them or your account. A deleted invitation waits in Trash for 30 days, so you can restore it; then it is deleted, with the photos no other invitation of yours uses. Photos you removed from a draft, or never used, are deleted after a day.
• Ended invitations stay in your account so you can bring them back. We may delete the photos of an invitation that ended more than 12 months ago; we will email you first.
• Guest drafts: deleted after 30 days without changes, unless you sign in — then they move into your account.
• Billing details, invoices, credit notes and payment records: at least 8 years, as GST, income-tax and company law require — also after you delete your account.
• Records of your consent and of your account’s deletion: kept to show what you agreed to, and when.
• Reports and moderation records: as long as we need them to deal with the matter; content we remove, at least 180 days, as the IT Rules require.
• Logs (IP addresses, sign-ins, security events and errors): at least one year, as the DPDP Rules require, then deleted.
• Backups: deleted data can stay in our backups for up to 30 days; then it is gone.

Cookies and storage on your device

• A sign-in cookie on trulyinvited.com keeps you signed in, or keeps your guest drafts yours.
• A short-lived cookie (15 minutes) carries your consent through Google’s sign-in when you choose “Continue with Google”.
• Cloudflare, which protects the site, may set a security cookie to tell people from bots.
• The editor keeps a backup of your draft, and of photos waiting to upload, on your device, so nothing is lost if the page reloads; it is cleared when you sign out.

All of these are needed for the service to work. We use no advertising, analytics or tracking cookies, and invitation pages on trulyinvited.me set no cookies at all.

Your rights

• Access: a summary of your personal data, how we process it, and who we have shared it with. Most of it is in Settings and Billing.
• Correction: correct, complete or update it — your name and billing details in Settings, your invitations in the editor, anything else by writing to us.
• Erasure: delete an invitation from My invitations, or your whole account in Settings, or ask us.
• Withdrawing consent: delete your account in Settings — as easy as giving consent was. We then stop processing your data and erase it, except what the law requires us to keep (above). Withdrawing doesn’t affect what was done before, and because the service can’t work without this data, it ends your account.
• Grievance redressal: complain to our Grievance Officer; if you are not satisfied with the answer, you can complain to the Data Protection Board of India.
• Nomination: name someone to exercise these rights for you if you die or become unable to — write to us.

To use any of these rights, write to support@trulyinvited.com from the email address you sign in with, so we can confirm it’s you. We reply within 90 days at the latest, as the DPDP Rules require, and usually much sooner. Please give us accurate information and don’t file false or frivolous complaints — the DPDP Act makes that your duty too.

Children

You must be 18 or older to use Truly Invited, and we don’t knowingly collect personal data from children. Invitations often show children (a birthday, a baby shower): upload a child’s photo only as their parent or lawful guardian, or with their parent’s or guardian’s consent. We don’t track anyone’s behaviour or show ads — to children or anyone else.

Security and breaches

We protect personal data with reasonable security safeguards: encryption in transit (HTTPS), private storage for uploads and invoices, short-lived signed links, strict access controls and an audit log for our own staff, and payments handled by Razorpay. No system is perfectly secure, so we can’t promise that data will never be lost or exposed.

If a personal data breach affects you, we tell you without delay — what happened, what it means for you, what we are doing and what you can do — and we report it to the Data Protection Board of India and to CERT-In within the times the law sets.

Emails we send

Only emails about the service: sign-in codes, invoices and credit notes, reminders before an invitation goes offline, and notices about your Pro plan, your account or these policies. We don’t send marketing emails.

Changes to this policy

If we change this policy in a way that matters, we tell you by email or when you next sign in, and ask for your consent again where the law requires. The notice version and the date at the top show the latest change.

Contact

Elicus Technologies Private Limited, [Registered office address, city, PIN]. Questions and requests about your data: support@trulyinvited.com. Complaints: our Grievance Officer, and after that the Data Protection Board of India.