Privacy notice

ARP Invites is run by ARP Cloud Solutions in South Africa. This notice explains what personal information we hold, why, and the choices you have, as required by the Protection of Personal Information Act (POPIA). Questions or requests: contact@arpcloudsolutions.co.za.

Two kinds of people

Hosts create celebrations and invite guests. For the guest list, the host is the responsible party under POPIA: they decide who is invited and what is collected, and we process it on their behalf. Guests receive an invitation and may reply, leave a wish or share photos.

What we collect

• Host accounts: name, email address and sign-in details (handled by Google Firebase Authentication; we never see your password).
• Guest lists, entered by hosts: names, phone numbers and email addresses for sending invitations, group or household, dietary notes, and seating.
• Replies, from guests: attendance per event, meal choices, answers to the host's questions, and any message.
• What guests share: wishes, and photos or videos uploaded to the celebration's wall.
• Activity: when an invitation was sent, first opened and answered, so hosts know who still needs a reminder. We do not use advertising trackers or sell any information.
• Payments: handled by PayFast. We keep the order, amount and status; card and bank details go to PayFast only.

Why, and who sees it

Only to run the celebration: showing the invitation, collecting replies and giving the host their guest list, seating and keepsakes. A guest's reply is visible to the hosts and the team members they add. Wishes and wall photos are shown to other guests unless the host hides them. Each guest's personal link opens only their own invitation.

Where it is stored

• Records: Google Cloud Firestore.
• Photos and videos: our own storage server in South Africa, with Google Cloud Storage as a temporary inbox when that server is offline.
• The website: Vercel, served from Cape Town.
• Email: Resend, used only to deliver invitations and account messages.

Some of these providers process information outside South Africa under their own data protection commitments, which POPIA section 72 allows.

How long we keep it

Until the host deletes the celebration or closes their account. Deleted photos sit in a recoverable trash for 30 days, then they are removed. Payment records are kept as long as tax law requires (at least five years).

Your rights

• Hosts can correct anything in the app, download the guest list, delete a celebration (Settings) or close their account (Account) at any time.
• Guests can change their reply from their link until the host's deadline. To see, correct or remove your information, ask the host, or email us and we will pass it on or act on it.
• You may complain to the Information Regulator: inforegulator.org.za.

Security

All traffic is encrypted. The database is reachable only by our server, never directly from a browser. Sign-in sessions can be revoked, and media links are signed so they cannot be guessed. If a breach affected you, we would tell you and the Regulator as POPIA requires.

See also the terms of use.