Privacy Policy

Your privacy matters to us. This Privacy Policy explains what personal data nvlab.id ([LEGAL ENTITY NAME — not yet filled in] — "we", "us") collects, why, and how we protect it. We process personal data in line with Indonesia's Personal Data Protection Law (Law No. 27 of 2022, "UU PDP") and, where applicable, the data protection laws of the countries in which we serve users, including Malaysia's Personal Data Protection Act 2010, Singapore's Personal Data Protection Act 2012, the Philippines' Data Privacy Act of 2012, Thailand's Personal Data Protection Act B.E. 2562, and Vietnam's Decree No. 13/2023/ND-CP on Personal Data Protection.

1. Data we collect

a. From you (account holders)

• Account data: name, email address, phone number (optional), password (stored encrypted)
• Invitation content: names, event details, dates, locations, photos, music, stories, and other content you add
• Transaction data: plan purchased, amount, transaction ID, payment status. Payment details (card, bank, e-wallet) are processed by our payment providers — we do not store your full card or bank account numbers.
• Support communication: messages you send to support@nvlab.id

b. From your guests

• Name, RSVP response, number of attendees, wishes/comments
• QR check-in time and attendance status
• Guest names you upload for personalized links

You are responsible for having a legitimate reason to share your guests' data with us (for example, inviting them to your event).

c. Automatically

• Device and browser type, IP address, approximate location, pages visited, and access times
• Cookies and similar technologies (see section 7)

2. How we use data

We use personal data to:

• Create and manage your account
• Build, publish, and host your invitations
• Run RSVP, guest book, and QR check-in features
• Process payments and send receipts
• Provide customer support
• Keep the Service secure and prevent fraud or abuse
• Improve our templates and features (using aggregated or anonymized data where possible)
• Send important service updates. We'll only send marketing messages if you agree, and you can unsubscribe anytime.

We never sell your personal data or your guests' data.

3. Legal basis

We process data based on: performing our contract with you, your consent, our legitimate interests (like security and service improvement), and legal obligations.

4. Who we share data with

We only share data when needed, with:

• Payment providers (Midtrans) to process payments
• Hosting and infrastructure providers (Vercel) to store and serve the Service
• Email and analytics providers to send notifications and understand usage
• Authorities, when required by law

These partners may only use data to provide services to us. Some may store data outside your country of residence; when that happens, we take steps to ensure a level of protection consistent with UU PDP and other applicable data protection laws.

5. Who can see your invitation

Your invitation is accessible to anyone who has the link. Guest RSVPs, check-ins, and guest lists are visible only to you in your dashboard (guest wishes may be shown on the invitation if you enable that feature). Please be careful about sharing sensitive personal details in your invitation.

6. Data retention

• Account data: kept while your account is active.
• Invitation and guest data: kept during your plan's active period, plus up to 30 days after, then deleted or anonymized.
• Transaction records: kept as long as required by applicable tax and accounting laws.

You can delete invitations or your account anytime; we'll delete associated data except where we must keep it by law.

7. Cookies

We use cookies to keep you logged in, remember your preferences (such as language), and understand how the site is used. You can control cookies through your browser settings, but some features may not work without them.

8. Security

We use reasonable technical and organizational measures to protect data, including encrypted connections (HTTPS), encrypted passwords, and access controls. No system is 100% secure, but if a data breach affects you, we'll notify you and the relevant authorities as required by law.

9. Your rights

Under UU PDP and other applicable data protection laws, you have the right to:

• Access and get a copy of your personal data
• Correct inaccurate data
• Delete your data or close your account
• Withdraw consent
• Object to or restrict certain processing

Guests who want their data corrected or removed can contact the invitation owner, or email us directly.

To exercise these rights, email support@nvlab.id from your registered email. We'll respond within the period required by law.

10. Children

The Service is not intended for children under 18 to use without parental supervision. We do not knowingly collect children's data without consent from a parent or guardian.

11. Changes to this policy

We may update this Privacy Policy. The latest version will always be on this page with its "Last updated" date. For significant changes, we'll notify you by email or on the site.

12. Contact

For privacy questions or requests: support@nvlab.id