Privacy notice

Last updated: 8 October 2026

Draft: this notice is pending legal review. A Bahasa Melayu version will follow, as the Personal Data Protection Act 2010 requires.

1. Who we are

Kad Jemputan is operated by Foxinex Solutions [SSM registration number], [registered address] ("we"). For any question about your personal data, contact [contact email].

2. Whose data we handle

• Couples who sign in to create a wedding card.
• Guests who open a card, reply to it (RSVP), leave a wish, or share photos, videos, voice messages or notes in a guest gallery.

3. What we collect

From	Data
Couples	Your name and email address from Google when you sign in; the wedding details, wording, photos and music links you add to your card.
Guests replying	Your name, an optional phone number, whether you're attending, the number of adults and children, and any wish you write.
Guests sharing in the gallery	The name you type, and the photos, videos, voice messages, captions and notes you choose to send.
Everyone	Technical data needed to keep the service safe: your IP address and browser type, used for bot protection and rate limiting. We store only a one-way hash, never the raw IP address.

4. Why we use it

1. To publish the couple's card and record replies, wishes and gallery uploads.
2. To show the couple who is attending and what guests have shared.
3. To prevent spam, fake replies and misuse.
4. To meet our legal obligations.

We do not sell personal data, and we do not send guests marketing messages.

5. Who can see it

• The couple (and only the couple) sees the replies, wishes and gallery uploads for their own wedding.
• Other guests see the attendance totals (never names), wishes the couple has approved, and the gallery only if the couple chooses to open it.
• Our service providers, who process data for us under their own security and privacy commitments: Supabase (database and file storage, hosted in Singapore), Vercel (website hosting), Google (sign-in) and Cloudflare (bot protection). Some may process data outside Malaysia; we choose providers with safeguards that meet the PDPA's rules on transfers abroad.
• Authorities, when the law requires it.

6. How long we keep it

• Guest gallery photos, videos, voice messages and notes: deleted automatically 6 months after the wedding date.
• Cards, replies and wishes: kept until the couple deletes the card. Deleting a card deletes all its replies, wishes and gallery items.

7. Your rights

• Ask for a copy of the personal data we hold about you, and ask us to correct it.
• Ask us to delete your reply, wish or upload, or ask the couple, who can delete it themselves.
• Withdraw your consent at any time by contacting us.

Contact [contact email]. We reply within 21 days.

8. Security

Data is encrypted in transit and at rest. Each couple can reach only their own wedding's data, which is enforced by the database itself. Gallery files are private and shared only through short-lived links. If a data breach is likely to cause harm, we will notify the Personal Data Protection Commissioner and the people affected, as the law requires.

9. Changes

We will post any changes on this page with a new date.