POPIA
Privacy policy
Last updated 18 October 2026
InviteHarbour builds event invite pages. This policy explains what personal information we handle, why, who can see it, how long we keep it, and your rights under the Protection of Personal Information Act (POPIA). We keep it short and plain on purpose.
Who we are
The responsible party is InviteHarbour (operated by Peacemaker Dev). The InviteHarbour Information Officer can be reached on WhatsApp at 079 168 1131, or by email at info@peacemakerdev.co.za.
The host of each event (the person or company who booked the invite) decides what goes on their page and receives their guests' RSVPs. We process that information on the host's behalf, only to run the event page.
What we collect, and why
| From | What | Why |
|---|---|---|
| Hosts | Name, phone or email, event details, photos you send us | To build and manage your invite page |
| Guests who RSVP | Name, optional phone number, number of people, optional meal preference and message | So the host knows who is coming and can plan catering |
| Guests who share photos | The photo and an optional first name | To show it on the event's guest photo wall |
| Guests who pledge a gift | Name, amount and an optional note | So the host can see and thank contributors |
| Seated events | Guest names and table numbers, supplied by the host | So each guest can find their own table |
| Photo-delivery clients | Photos uploaded by the photographer | To deliver them privately to the client |
- Only fill in what you're comfortable sharing. Optional fields really are optional.
- A meal preference can reveal health or religious information. We use it only to pass on to the host for catering, and only because you chose to give it.
- We don't sell personal information, show ads, or use tracking cookies.
Who can see it
- Everyone with the event link can see the invite details the host published, the photo gallery and the guest photo wall.
- Only the host, after logging in with their private host key, can see RSVPs, phone numbers, meal preferences, messages and pledge amounts.
- The table finder shows a guest only their own table after they type their full name. It never lists everyone.
- Delivery galleries are protected by a password and private links that expire.
- We, as the operator, can access information only to run and support the service.
Where it is stored
Information is stored with our service providers: Supabase (database and photo storage) and Vercel (website hosting). Their servers may be outside South Africa. We use providers that are bound by data-protection terms offering protection comparable to POPIA, and we use encrypted connections (HTTPS) throughout.
How long we keep it
| Information | Deleted |
|---|---|
| Seating lists (table finder) | 30 days after the event |
| Guest photos (photo wall) | When the invite page closes: 30 days after the event (Essential) or 60 days (Premium and Custom), unless the host extends it |
| RSVPs and pledges | 90 days after the event |
| Photo-delivery galleries | On the expiry date shown on the gallery |
| Event details published by the host | The page closes with the guest photos; the details are deleted when the host asks |
| Anti-spam counters | Within a day. They hold a scrambled code, never your IP address |
Deletion runs automatically every day. Hosts can ask us to delete their event's information sooner.
Photos of people
- Only share photos that the people in them would be happy to have shown on the event page.
- Don't share photos of children unless their parent or guardian agrees.
- If a photo of you appears and you want it removed, contact us or the host and we'll take it down.
Your rights
Under POPIA you may:
- ask what personal information we hold about you
- ask us to correct or delete it
- object to how it is used
- withdraw your consent at any time (this doesn't affect what happened before)
- complain to the Information Regulator at inforegulator.org.za
To use any of these rights, message us on WhatsApp (079 168 1131) or email info@peacemakerdev.co.za. We'll respond within a reasonable time.
Security
- Guest details are stored in a database that only our server can read; the public cannot access them.
- Host keys are stored scrambled (hashed), so even we can't read them back.
- Hosts log in once per device; MC and photographer links can only do their one job.
- Repeated attempts (logins, forms, uploads) are slowed down automatically.
- If a security incident affects your information, we will tell the affected hosts and the Information Regulator as POPIA requires.
Cookies
We use essential cookies only: one keeps a host logged in to their dashboard (for up to 30 days), and one remembers that you unlocked a password-protected gallery. There are no advertising or tracking cookies.
Changes
If we change this policy, we'll update the date at the top of this page.
See also our terms of service.