Privacy Policy

1. Who is responsible

Nimanto Inc, a Texas corporation, 320 Clearlake Dr, Hutto, TX 78634, United States, is the controller of the personal data described here, with one difference for guest lists: when a host adds guests or collects RSVPs, the host decides whom to invite and what to ask, and we process those guests’ details to deliver the host’s invitation. Hosts are responsible for having the right to give us their guests’ details. We remain responsible for what we ourselves do with it, such as security, keeping our do-not-mail list and meeting the law.

Questions and requests: [email protected], or by post to Privacy, Nimanto Inc, 320 Clearlake Dr, Hutto, TX 78634, United States.

2. What we collect

From hosts, organizers and partners

• Account: name, e-mail address, optional phone number, profile picture, language and time zone, and a password hash if you sign up with e-mail. Passkeys keep only a public key on our side. With Google sign-in we receive your name, e-mail address and profile picture; with Apple, the name and e-mail address you choose to share (which may be a private relay address).
• What you create: invitations, cards, event pages, plans, text, photos, videos, music, venues and dates, design briefs and reference pictures, and photos of people you choose to star in a Design Genie design.
• Guest lists you type, import from a file or pick from your phone’s contacts: guests’ names, e-mail addresses, phone numbers and groups. The app reads only the contacts you pick, and only when you ask it to.
• Purchases and plans: what you bought, amounts, currency, tax, billing country and the payment provider’s references. Card details are entered on Stripe or Razorpay, or with Apple or Google in the app, and never reach our servers.
• Organizers selling tickets: your Stripe Connect account reference, its country and status. Your identity documents and bank details go to Stripe, not to us.
• Partners: name, handle, e-mail, phone, country, the payout details you give us (such as bank, UPI or PayPal details), whether a tax form is on file, and your signature on the partner agreement with the time, IP address and browser it was signed from.
• Messages to us: contact-form messages, Feedback answers (with the page, browser, device and window size), conversations with Elli, our in-app assistant, blog posts and reviews you send us.

From guests and ticket buyers

• RSVPs and reservations: name, attendance, number in your party and their names, and optionally e-mail, phone, dietary notes, a message to the host, and gift pledges.
• Album uploads: the photos and videos you add, your name and caption as you give them.
• Tickets: your name, e-mail and phone for the pass; card payments go to Stripe. If you add a pass to Google Wallet, its details go to Google.
• We also receive guests’ details from the host who invited them (above).

Collected automatically

• Sign-in activity: when an account signs in or edits, with the IP address and browser or app it came from, to keep accounts secure and to answer support questions.
• Invitation activity: when a guest link is opened and from which referring site, so the host can see who has seen it.
• Abuse protection: a one-way hash of the IP address on RSVPs, reservations and album uploads, never the address itself.
• Country, worked out on our own servers from your IP address (or your phone’s region in the app) to show prices in your currency. We do not collect precise location, and the app does not ask for it.
• App: device model and name, app version, operating system, language, time zone, push notification token, and first-party usage events (such as “opened the app” or “published”) tied to a hashed device id. You can switch usage events off in the app’s settings. The app does not track you across other companies’ apps or sites.
• Cookies and similar technologies, as set out in our Cookie Policy. Google Analytics runs only if you choose “Accept all”.
• Delivery records of each e-mail and text we send: type, time, the account and invitation it belongs to, the result, and a one-way fingerprint of the address or number with its domain or country code, never the address, the subject or the body.
• Technical logs of the calls our servers make to our providers, which can include the content of an e-mail, text or AI request, kept briefly to find and fix faults.

3. How we use it, and our legal bases

• To provide the service you asked for (performance of our contract with you): build and show invitations and pages, deliver guest links, invitations and updates, collect RSVPs and reservations, sell and check tickets, pay organizers and partners, run Design Genie and Elli, send receipts and account e-mail, and give support.
• To keep Nimanto safe and working (our legitimate interests): prevent spam, fraud and abuse, enforce our Terms and fair-use limits, secure accounts, fix faults, and understand in aggregate how the service is used so we can improve it.
• With your consent: Google Analytics cookies, text alerts to a host’s phone, push notifications, and star photos of people. You can withdraw consent at any time, which does not affect what was done before.
• To meet legal obligations: tax and accounting records, honouring unsubscribes and STOP replies, answering lawful requests, and handling copyright notices.
• Account mail to hosts about their own account and events (for example a reminder about a draft not yet published, Planner reminders, or a summary after an event). Guests never receive marketing from us.

We do not use automated decision-making that has legal or similarly significant effects on you. We do not use your content, your guests’ data or your photos to train AI models, and we do not give our AI providers permission to train on what we send them.

4. AI features

Design Genie, Elli, translation and our writing helpers send what you give them (briefs, reference pictures, invitation text, your messages to Elli) to Anthropic (Claude), and the painting steps send prompts and reference pictures to our image and media providers: Meta, Runware and Magic Hour, which may run Google models. A photo of people you add to star in a design is sent to these providers only to paint those people as characters, after you confirm you may use it and that everyone in it (a parent or guardian for a child) agrees. Guests see the painting, never the photo. We do not create face templates or other biometric identifiers from any photo. Elli conversations are kept in your account until you delete them.

When you speak instead of typing, your browser or phone turns speech into text with its own speech service (Google in Chrome and on Android, Apple in Safari and on iPhone); Nimanto receives only the text and keeps no recording.

5. Who we share it with

We share personal data only as follows, and never sell it.

• The people you share with. A published invitation or event page is visible to anyone with its link. Hosts and their collaborators see their own guest lists, RSVPs, reservations and album; organizers see their buyers. Guests can see the names that uploaders give in an album.
• Service providers who process data on our behalf under contract and only for us:
  • Hosting, database and files: Railway, Hostinger, Neon and Cloudflare (content delivery and file storage).
  • E-mail: Amazon Web Services (Amazon SES), Twilio SendGrid and Resend.
  • Payments: Stripe (including Stripe Connect and Stripe Tax), Razorpay (Indian rupees), Apple, Google and RevenueCat (purchases in the app).
  • Sign-in: Google and Apple.
  • AI and media: Anthropic, Meta, Runware and Magic Hour.
  • Maps and places: Google (Places search, map embeds and Google Wallet), Geoapify and Photon (Komoot) for venue search.
  • App notifications: Expo, which relays to Apple Push Notification service and Google Firebase Cloud Messaging.
  • Analytics, with your consent: Google Analytics, with advertising features turned off.
  • Our internal team workspace (Slack) receives a notice of new accounts and invitations.
• Our Indian company, Nimanto Private Limited (CIN U62011AP2026PTC129267), No. 20-3-2/1, Siva Jyothi Nagar, Tirupati North, Tirupati (Urban), Chittoor 517507, Andhra Pradesh, India, which takes payments in Indian rupees through Razorpay: it receives the order, the amount and the payer’s name, e-mail and phone that Razorpay needs, and keeps its own payment and tax records under Indian law.
• Professional advisers such as lawyers, accountants and auditors, under confidentiality.
• Legal and safety: when we believe in good faith it is required by law or legal process, or needed to protect someone’s safety, to stop fraud or abuse, or to protect our rights. We report child sexual abuse material to the authorities.
• Business transfers: if Nimanto is merged, acquired or sells its assets, data may pass to the new owner, who must honour this policy.

An invitation can include a Google Maps map or music from YouTube if the host added one; those load from Google when a guest opens it, under Google’s privacy policy.

6. E-mail we send, and how to stop it

Every e-mail Nimanto sends is about a specific event or account: an invitation from a host who added you to their guest list, an RSVP or ticket confirmation, an update the host wrote, new photos in an album, or account mail to hosts. We do not send newsletters, we do not buy, rent or share address lists, and a host cannot upload a list to send anything other than their own invitation and updates.

• Who can send to you: only a signed-in host who added your address to their own guest list. Each e-mail names the host and the event and has a Reply-To that reaches the host.
• Unsubscribe: every guest e-mail has an Unsubscribe link and the list-unsubscribe headers that Gmail, Apple Mail and Outlook turn into a one-click button. You can stop e-mail about one event or everything from Nimanto, at once, and undo it on the same page.
• Bounces and complaints: when a mailbox rejects our e-mail permanently, or you mark one as spam, the address goes on our do-not-mail list automatically and no host can e-mail it through Nimanto again.
• No tracking: our e-mails have no open-tracking pixels and their links are not rewritten through tracking redirects.
• Limits: each account has a fair-use weekly sending allowance.

To be removed by hand, or to ask which hosts have your address, write to [email protected] from that address.

7. How long we keep it

• Accounts, events, guest lists, RSVPs and albums: while the account exists, or until the host deletes the event or the item. Deleting an event removes its guests, RSVPs and album entries; deleting an account removes its events and everything in them. Files you uploaded may remain in our file storage, unlinked from any page, after the record is deleted; ask [email protected] and we will erase them within 30 days.
• Sign-in activity (with IP address and browser) and app usage events: 13 months.
• Delivery records of e-mails and texts: 13 months, and deleted with the account.
• Technical logs of calls to our providers: 14 days.
• Orders, payments, refunds, payouts and tax records: as long as tax and accounting law requires, usually 7 years, even after an account is deleted.
• Partner agreements and signatures: for the life of the agreement and 7 years after.
• Elli conversations: until you delete them or your account.
• Contact and feedback messages: up to 3 years, for support history.
• Do-not-mail and STOP lists: indefinitely, so an unsubscribe or STOP is honoured even after the event is gone.
• Records of changes made by Nimanto staff: kept as a security audit trail.
• Backups are overwritten on a rolling basis by our database provider.

8. Security

Data travels encrypted (HTTPS), passwords are stored only as salted hashes, sign-in can use passkeys, access by our staff is limited and recorded, and payments are handled by PCI-compliant providers. No system is perfectly secure, so we cannot guarantee security; if a breach affects your personal data, we will tell you and the authorities as the law requires. Keep your password and devices safe and tell us at [email protected] if you think your account has been misused.

9. Your choices and rights

Everyone can: see and correct their account details in account settings; download their guest list and replies as a spreadsheet; delete events, Elli conversations or the whole account from the website or the app; unsubscribe from guest e-mail; reply STOP to texts; turn off push notifications in the phone’s settings; change cookie choices at any time; and ask us at [email protected] for a copy of their data, to correct or delete it, or to restrict or object to how we use it. Guests can also ask the host who invited them.

We answer within 30 days (45 days where US state law allows, extendable once by 45 days when needed). To protect you, we check your identity, usually by asking you to write from the e-mail address on the account or that received the invitation. You may use an authorised agent, who must show your signed permission; we may still ask you to confirm your identity. We will not treat you differently for using your rights.

California and other US states

Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and other states with privacy laws have the right to know what personal data we collect, use and disclose; to get a copy in a portable form; to correct and delete it; and to opt out of its sale, its sharing for cross-context behavioural advertising, targeted advertising and profiling. We do not sell or share personal data, use it for targeted advertising, or profile you, and have not done so in the last 12 months, including for anyone under 16. We use sensitive personal information only as needed to provide the service, so there is nothing to limit. Our browser treats a Global Privacy Control signal as a choice of “Essential only” and does not load Google Analytics. We do not respond to the older Do Not Track signal, which has no agreed standard.

If we turn down a request, you can appeal by replying to our answer or writing to [email protected] with the subject “Appeal”; we will answer within 45 days (60 in Colorado), and if you are still unhappy you may contact your state attorney general. California residents may also ask, once a year, about disclosures for direct marketing (“Shine the Light”); we make none. Nevada residents: we do not sell covered information.

The categories of personal information we have collected in the last 12 months:

We use each category for the purposes in section 3 and keep it as set out in the retention section. We do not collect precise geolocation, government identifiers, biometric data, or account log-in details for any account other than yours with us.

European Economic Area, United Kingdom and Switzerland

You have the rights of access, rectification, erasure, restriction, portability and objection, and to withdraw consent, under the GDPR and UK GDPR, and the right to complain to your data protection authority (in the UK, the Information Commissioner’s Office). Our legal bases are in section 3.

India

Under the Digital Personal Data Protection Act, 2023, you may access, correct, complete and erase your data, nominate someone to act for you, and raise a grievance with our Grievance Officer at [email protected] (or by post to Grievance Officer, Nimanto Private Limited, No. 20-3-2/1, Siva Jyothi Nagar, Tirupati North, Tirupati (Urban), Chittoor 517507, Andhra Pradesh, India), which we acknowledge within 24 hours and answer within 30 days; you may then approach the Data Protection Board of India.

Elsewhere

Wherever you live, you may use the choices above, and any further rights your local law gives you, by writing to [email protected].

10. International transfers

Nimanto is based in the United States, and our providers process data in the United States and other countries. When we transfer personal data from the EEA, the UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum), on a provider’s certification under the EU-US Data Privacy Framework and its UK and Swiss extensions, or on another lawful basis. You can ask us for a copy of the relevant safeguards.

11. Children

Accounts are for people aged 16 or over, and purchases for adults. Nimanto is not directed to children under 13, and we do not knowingly collect personal data from them. Children may be guests, and a host may enter a child’s name on a guest list or add a child’s photo with a parent’s or guardian’s agreement; we use it only to deliver that host’s invitation. If you believe a child under 13 has given us personal data, write to [email protected] and we will delete it.

12. Cookies

We use strictly necessary cookies to keep you signed in, protect forms and remember your choices, and Google Analytics cookies only after you choose “Accept all”. We do not use advertising or cross-site tracking cookies. Fonts are served from our own servers, so opening a page does not contact Google Fonts. The full list is in our Cookie Policy.

Cookie settings

13. Other sites and services

Invitations and pages can link to registries, ride apps, maps, calendars, wallets and other sites we do not control. Their own privacy policies apply when you use them.

14. Changes and contact

We will update this policy when our practices change, show the new date above, and tell account holders by e-mail or on the site before a material change takes effect. Questions or requests: [email protected], or Privacy, Nimanto Inc, 320 Clearlake Dr, Hutto, TX 78634, United States.