What this covers
Vytley (“we”, “us”, “our”) provides digital invitations designed for Apple Wallet and Google Wallet, including RSVP, guestbook and related event tools (the “Service”). This Privacy Policy describes how we process personal information collected through vytley.com and pages that link here.
We are the controller for information collected through this site (waitlist, cookies, staff tools). Where you use Vytley to invite your own guests, you are the controller of that guest list and we act as processor. Hosts should also read the Data Processing Addendum at /dpa.
If you are in the United Kingdom or the EEA, see “Notice to European users” below. If you are in a US state with a consumer privacy law, see “State privacy rights”.
Personal information we collect
We collect only what the Service needs. We do not collect government ID numbers, payment-card data, or precise live location of a visitor’s device.
- Contact data you give us: first name and email on the waitlist; optional name and email on an open RSVP; optional email on a named-party RSVP.
- Event data a host enters or imports: names, dates, venues, blessing text, meal options, guest-list names, optional phone or email, household tokens.
- Relationship data: who is in a household, and child or infant labels a host chooses.
- User-generated content: guestbook messages, voice notes and photos; guest album photos where the host has opened photography.
- Communications data: privacy-request forms and emails you send us.
- Marketing data: that you asked to be emailed when Vytley launches, with the wording version you saw and that you confirmed you are 16 or over.
- Device and online activity data: pages requested, approximate region and device type. If you accept analytics, Vercel and (when a measurement ID is configured) Google Analytics also receive aggregated page views and performance timings.
- Consent records: timestamp, analytics on or off, banner version, and whether Global Privacy Control was set.
- Staff session data: Admin, Studio or House sign-in cookies after a passphrase or username is checked. We do not store that passphrase.
Sources
We collect information from you, from hosts who upload a guest list, and automatically from your device when you use the Service. We do not buy personal information from data brokers. We do not receive personal information from social logins on the public site.
How we use it
Service delivery: create and deliver invitations, calendar files and (when certificates exist) wallet passes; collect RSVPs, guestbook entries and photos; email you when Vytley opens if you joined the waitlist; run staff tools.
Service improvement and analytics: understand which pages are used and whether the site is slow, only after you accept optional analytics (or never, if Global Privacy Control is on).
Compliance and protection: security, abuse prevention, legal requests, and enforcing the terms.
We do not sell personal information. We do not share it for cross-context behavioural advertising. We do not use a host’s guest list to market to those guests. We do not use guest or waitlist data to train AI models.
Religious, health and location information
A blessing or script can reveal religious belief. Optional RSVP notes can include allergies, diet or access needs. Venue addresses and optional map coordinates are used for a maps link and an Open-Meteo forecast, not to track a guest’s live location. We store this only to run that event, never for advertising.
Who else processes it
Service providers: Vercel (hosting, private Blob storage, optional Web Analytics and Speed Insights). Google (Google Analytics if a measurement ID is configured and you accept; Google Wallet pass content when passes are issued; Maps when you follow an outbound maps link). Apple (Wallet pass content when passes are issued). Open-Meteo (venue coordinates only).
Transfers: Vercel and Google may process data in the United States. [transfer mechanism: DPA / SCCs / UK addendum — confirm; do not assume a contract is signed]. Ask hello@vytley.com if you want more detail on the mechanism in use.
Staff Studio may call AI model providers through Vercel AI Gateway with staff prompts, not waitlist, RSVP or guestbook content. Meta and TikTok APIs are used only inside Studio for publishing.
Authorities, professional advisors, or a buyer of the business if the law requires or a genuine transaction is underway.
How long we keep it
Waitlist: until we have sent the launch email, then deleted within 30 days, or sooner on request. If that email has not been sent, you can still ask us to delete the entry; no automatic cleanup runs before it is sent.
Events, guest lists, RSVPs, guestbook and photos: until 12 months after the last ceremony, then a cleanup job deletes them. Passes already on a phone stay on the phone.
Consent records: up to 13 months. Staff session cookies: 12 hours (Admin) or 14 days (Studio/House).
Cookies and similar technologies
See the Cookie Notice for the table of cookies, localStorage keys, and how to reject optional analytics. We honour Global Privacy Control as a refusal of sale, sharing and targeted advertising, and we keep optional analytics off.
Some browsers send a “Do Not Track” signal. We do not treat DNT as a separate control; use the cookie banner, Cookie settings, or GPC.
Your choices
There is no public account to log into. To access, correct, delete, object, restrict, withdraw waitlist consent, or complain, use the privacy request form or email hello@vytley.com. We aim to reply within 30 days.
You can decline optional analytics. Essential cookies are needed for staff sessions and to remember that choice.
If you do not give a waitlist name and email, we cannot add you to the list. If a host does not give guest details, we cannot deliver a named invitation.
Children
The waitlist is for people aged 16 or over. We do not keep a signup without that confirmation. We do not knowingly collect waitlist details from anyone under 13.
Hosts may include children and infants on a family guest list. We do not market to those children. The host is responsible for a lawful basis for that data.
Security and other sites
We use private storage, HTTPS, access checks on guest links, and rate limits on public forms. No internet service is perfectly secure.
Outbound links (for example Google Maps, Apple or Google Wallet terms) are not our sites. Their privacy notices apply on those sites.
Changes
If we change this notice we update the date at the top. Material changes will be posted on this page. Continued use after the effective date is how we apply the updated notice to later visits.
Contact
hello@vytley.com
Vytley is the trading name of a business operated from the United Kingdom. There is no limited company under this name on the Companies House register yet. When there is, its registered name, number and office address will be listed here.
State privacy rights notice
This section is for residents of US states whose privacy laws apply to us and grant the rights below. Rights are not absolute. We may need enough detail to find your records. We do not currently collect a phone number for toll-free state requests.
You may request: categories of personal information collected and sources; access to a copy; correction; deletion; portability; an appeal of a refusal; and opt-out of sale or sharing. We do not sell personal information or share it for targeted advertising. We do not use personal information for profiling that produces legal or similarly significant effects. We do not process sensitive personal information to infer characteristics about you.
We do not have actual knowledge that we sell or share the personal information of consumers under 16. Hosts may still list children on an invitation they control.
Submit requests at /privacy-request or hello@vytley.com, or send Global Privacy Control from your browser. Shine the Light: California residents may email hello@vytley.com with the subject “Shine the Light Request”, their name, mailing address, and a statement that they are a California resident. Nevada residents may email us to opt out of any future sale for monetary consideration (we do not currently make such sales).
Personal information we collect, use and disclose (CCPA categories)
Practices currently and during the 12 months before this notice. Free-text fields may contain extra categories. We do not sell or share for targeted advertising.
| What we collect | CCPA category | Purpose | Disclosed to (business purpose) | Sold or shared |
|---|---|---|---|---|
| Waitlist name and email | Identifiers | Launch email | Vercel (storage) | No |
| Host and guest names, contacts, tokens | Identifiers; customer records | Deliver the invitation | Vercel; Apple/Google for passes | No |
| RSVP, meals, optional dietary notes | Customer records; sensitive (health-related notes, if given) | Show the host replies | Vercel | No |
| Guestbook and photos | User content; sensory (audio/image) | Host’s event book | Vercel | No |
| Blessing / script | Sensitive (religion, if revealed) | Render the invitation | Vercel; Apple/Google for passes | No |
| Venue address / coordinates | Geolocation (venue, not the guest’s device) | Maps link; forecast | Vercel; Open-Meteo; Google Maps if you click through | No |
| Analytics (if accepted) | Internet / electronic activity | Site performance | Vercel; Google | No |
Notice to European users
This section applies to individuals in the United Kingdom and the EEA. “Personal information” includes “personal data” under UK GDPR and EU GDPR.
Vytley is the controller for site and waitlist data. For a host’s guest list, the host is the controller and we are the processor.
EU representative: [EU REPRESENTATIVE]. UK representative: we operate from the United Kingdom; contact hello@vytley.com.
We do not use automated decision-making that produces legal or similarly significant effects.
You may ask us to access, correct, delete, transfer, restrict, object, or withdraw consent. You may complain to the ICO (ico.org.uk, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF) or to your EU supervisory authority.
We are based in the United Kingdom. Some providers process data in the United States, which is not covered by an adequacy decision in every case. We rely on a contract with the provider (standard contractual clauses or equivalent) where that is in place — confirm in the hand-off — or, for optional analytics, your consent.
Legal bases (UK / EEA)
Where UK GDPR or EU GDPR applies, we rely on the bases below.
| Purpose | Typical data | Legal basis |
|---|---|---|
| Waitlist launch email | Name, email, age confirmation, wording version | Consent |
| Deliver an invitation you create or import | Event and guest details | Contract (with the host) / processor instructions |
| RSVP, guestbook, photos | Replies and UGC | Contract with the host; legitimate interests of host and guests in running the event |
| Blessings / dietary notes | Special category / health-related | Host’s documented basis; we process only to deliver the event |
| Optional analytics | Page views, timings | Consent |
| Security, fraud, legal requests | Technical logs, request records | Legitimate interests / legal obligation |
About this notice
Adapted from General Legal’s CC0 templates. This is not legal advice, and using these pages does not create a lawyer–client relationship with General Legal or with Vytley.