Privacy Notice

Last updated: 28 July 2026

1. Who we are

ALC digital products ("we", "us") is the data controller for personal data processed through the ALC Invites service. You can reach us via the support channel available from your account.

2. Personal data we collect

• Account data: email address, authentication credentials, display name.
• Invitation content: names, dates, event details, photos, texts, guest lists, RSVPs, budget information you enter.
• Guest content: RSVP responses and photos submitted by your guests through your invitation.
• Support communications: messages you send to us.
• Technical data: IP address, device and browser information, log data, approximate location derived from IP, and usage telemetry.
• Payment data: order and subscription status. Card details are collected and processed by Paddle; we do not receive or store them.

3. Purposes and legal bases

• Providing the Service (creating and hosting your invitation, collecting RSVPs, managing your subscription) — performance of contract.
• Account security and fraud prevention — legitimate interests.
• Customer support — performance of contract / legitimate interests.
• Product improvement and analytics (aggregated usage data) — legitimate interests.
• Legal and tax compliance — legal obligation.
• Marketing communications, where applicable — consent (you can withdraw at any time).

4. Sharing your data

We share personal data with:

• Paddle — our Merchant of Record. Paddle processes payments, calculates and remits taxes, issues invoices and manages subscription billing on our behalf. See Paddle's privacy notice for details.
• Hosting and infrastructure providers that host our database, storage and application under our instructions.
• Professional advisers (legal, accounting) where necessary.
• Competent authorities when required by law.

We do not sell your personal data.

5. International transfers

Some of our providers may process data outside the EU/EEA. Where this happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

6. Retention

We keep your account and invitation data for as long as your account is active. If you close your account, we delete or anonymise personal data within a reasonable period, except where we must keep it longer to meet legal, tax or accounting obligations, or to defend legal claims.

7. Your rights (GDPR)

Under EU/UK data protection law you have the right to:

• access your personal data;
• rectify inaccurate data;
• request erasure ("right to be forgotten");
• restrict or object to processing;
• data portability;
• withdraw consent where processing is based on consent;
• lodge a complaint with your supervisory authority (in Italy, the Garante per la protezione dei dati personali).

We aim to respond to requests within one month.

8. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit, access controls, and row-level security on our database. No online service can be guaranteed 100% secure, but we work hard to minimise risk.

9. Cookies

We use strictly necessary cookies to keep you signed in and to remember your preferences. If we add analytics or marketing cookies in the future, we will ask for your consent through a cookie banner and update this notice.

10. Changes to this notice

We may update this Privacy Notice from time to time. The "Last updated" date at the top reflects the most recent revision. Material changes will be communicated through the Service or by email.