Privacy policy

• Your account: name, email, and a hashed password.
• Your events: the invitations you design, your guest list (names, emails, phone numbers, groups), and anything you upload.
• Guest replies: RSVPs, meal and dietary answers, messages, and any photos, videos or voice notes guests share.
• Purchases: which plan you bought for which event, the amount, currency and date, and a payment reference. Never card numbers.
• Usage data: pages visited, invitation opens and clicks, IP address, approximate location, and device details. It stays on our own systems.

For guest data we act for the host: the host decides who is invited and what is asked. We never market to guests.

To run the service: send your invitations, collect replies, show you how your event is going, keep accounts secure, and improve the product. Cookies and a random visitor ID in your browser keep you signed in, remember settings, and power our own analytics. No ads, no cross-site tracking.

If you connect a Gmail account (rolling out soon), your invitations go out from your own address. We ask only for permission to send email (gmail.send), plus your email address to show which account is connected. We cannot read, search, or delete your mail.

• We use this access only to send the invitations and messages you choose to send to your guests.
• We store the access token encrypted, never share it, and never use it for ads or to train AI models.
• Disconnect any time in Settings, or from your Google Account permissions page.

Paper&Seal's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

These providers process data only to provide their service to us:

• Vercel: hosting and file storage for guest uploads.
• Neon: database.
• Resend: email delivery.
• Google: sending from your Gmail, only if you connect it.
• Anthropic and OpenAI: the AI features (drafts, translations, contract reading, vendor research), only for the text you send them.
• Cloudflare: DNS and email routing.
• Stripe: payments, when you buy a plan. Stripe receives your name, email and the plan you buy. Payments are processed by Stripe; we never see your full card number.

Some providers store data in the United States or elsewhere outside Canada, where local laws apply.

While your account and events are active. Delete an event (or ask us to close your account) and its data, including guests and replies, is deleted for good. Export anything you want to keep first. We may keep minimal records where the law requires, such as purchase and refund records for tax and accounting.

Ask us to access, correct, or delete your information at support@paperandseal.com. Guests can also ask their host. In the EU or EEA you have your GDPR rights and may complain to your local authority; in Canada, to the Office of the Privacy Commissioner.

We post any change here and update the date below.