Privacy Policy
Last updated: October 12, 2026
At a glance
- We use guests’ details only to deliver the host’s invitations, updates and RSVPs. We never sell them, never use them for our own marketing and never send guests marketing emails.
- No analytics or advertising trackers run on invitation, RSVP or event pages. Google Analytics and the Meta Pixel run only on our marketing pages and on the host’s own account pages (section 8).
- Event pages can be seen by anyone who has the link, and so can attending guests’ names and notes on the guest wall. We ask search engines not to index them (section 5).
- Your personal RSVP link works like a password. Please don’t forward it.
- Whether you’re a host, a guest or a visitor, you can ask us for a copy of your information or ask us to delete it: mitul@bonsaitech.net.
1. Who we are
Fête (fete.rsvp) is a digital invitation and RSVP service run by Bonsai Tech LLC, a company based in the United States (“Fête”, “we”, “us”). We are responsible for the personal information described in this policy. You can reach us about privacy at mitul@bonsaitech.net. Our full contact details are in section 21.
2. Who this policy covers
This policy applies to everyone whose information Fête handles, whether or not they have an account:
- Hosts: people who create an account and events.
- Guests: people a host invites, and people who add themselves to an event from its public link.
- Visitors: anyone who browses fete.rsvp.
If you’re a guest
A host added your name and email address (and sometimes a phone number) to their guest list so we could deliver their invitation. We use your details only for that event: to send you the host’s invitation, reminders and messages, record your RSVP, and show it to the host. We never sell your details, never use them for our own marketing and never send you marketing emails. For questions about the event itself, contact the host. You can reply to any invitation email to reach them. To see, correct or delete what we hold about you, email mitul@bonsaitech.net. Hosts agree in our Terms that they may share their guests’ contact details and will use them only for their event.
3. Information we collect
Hosts
- Account: your email address and password. Passwords are handled by our sign-in provider, Supabase Auth, and we never see them. If you sign in with Google, Google shares your name, email address, profile picture and Google account ID with us. We use them only to create your account, sign you in and show your name, and we don’t share Google user data with advertising or analytics services.
- Profile and plan: your name (if you give it), your plan, and your referral code and who referred you, if you joined through a referral link.
- Events: everything you enter for an event. This includes the title, type, date, time, venue name and address, description, host names, dress code, theme and settings. It also covers images you upload, video links you add, and event-website details such as a schedule, FAQs or registry links.
- Guest lists: the names, email addresses and optional phone numbers you add for your guests.
- Messages: messages you post to your guests.
- Payments: if you upgrade, Stripe collects your card details directly. We never see or store full card numbers. We receive your Stripe customer ID, your plan and your subscription status.
Guests
- From the host: your name, email address and, optionally, phone number.
- From you, when you RSVP: your response and, unless the host has turned those questions off, a plus-one’s name, dietary choices and a song request. You can also leave a personal note, send messages to the host and upload photos to the event gallery. We remove location data from gallery photos before they’re uploaded.
- If you add yourself from an event’s public link: your name and email address.
- Invitation activity: when your invitation was sent, when you first opened your invitation page, and when you responded. We also record which of our subject-line versions your invitation email used, and, for invitations from Pro hosts, when the email was first opened or its button clicked (section 9).
Everyone
- Device and log data: our hosting and database providers record technical details of each request, such as IP address, browser and device type, the page requested, the referring page and the time. We use them to run, secure and debug the service.
- Analytics and advertising data: on the pages listed in section 8 only.
- Cookies and browser storage: see section 9.
- Messages to us: if you email us, we keep the conversation.
4. Sensitive information
Dietary choices (vegetarian, vegan, gluten-free, dairy-free, nut-free, halal or kosher) can reveal religious beliefs or health information. They are always optional. The RSVP form asks for them unless the host turns dietary questions off for their event. We collect them with the guest’s consent, so they reach the host.
Dietary choices are shown only to the host (in their dashboard, their guest-list export and their RSVP notification emails) and to the guest who gave them. They never appear on public pages, are never sent to analytics or advertising providers, and are deleted with the event. A guest can change or clear them at any time by editing their RSVP, which withdraws that consent. Please don’t put other sensitive information in notes or messages. You can find more in our Consumer Health Data notice.
5. What is public
- Event pages: each event has a page (fete.rsvp/e/…, or a custom link the host picks). Anyone with the link can see the event details the host chose to show: the title, host names, date, time, venue and address, description, images and videos. We mark event pages “noindex” so search engines don’t list them, and we leave them out of our sitemap. Anyone who has the link can still open it and share it. Pages that search engines indexed before September 29, 2026 can take a few weeks to drop out.
- The guest wall: when an attending guest leaves a personal note, their name (as the host entered it) and their note appear on the event page and on other guests’ invitation pages. The note box says so. Guests who decline, and attending guests who leave no note, aren’t shown.
- Photos: once a host approves a guest’s gallery photo, it appears on the event page for anyone with the link.
- Uploaded images: images are stored at web addresses that are hard to guess and aren’t listed anywhere. Anyone who has an image’s address can still open it.
- Public RSVP links: if the host allows it, anyone with the event link can add themselves to the guest list.
A guest’s email address, phone number, dietary choices, song request and messages are never shown on public pages.
6. What other people can see
- Hosts see everything their guests give us for their event: responses, plus-ones, dietary choices, song requests, notes, messages and photos. They also see when each guest first opened their invitation.
- Guests see the event details and host names. On the guest wall, they also see other attending guests’ names and notes.
- Your own invitations: if you have a Fête account with the same email address a host sent an invitation to, and we have confirmed that you own that address, your dashboard lists that event with your RSVP and a link to your invitation page. It shows only what your invitation page already shows you. Invitations a host hasn’t sent yet, and events the host has unpublished, aren’t listed.
- Reply-to address: emails we send for a host (invitations, reminders, messages and RSVP confirmations) use the host’s account email as the reply-to address. Recipients can see that address, and replies go straight to the host.
7. How we use information
We use information for the purposes below. For visitors in the UK, the EEA and Switzerland, the legal basis for each purpose is shown in brackets.
- To provide Fête: to run accounts and events, send the invitations, reminders and messages a host asks us to send, send automatic event reminders unless the host turns them off (section 10), record RSVPs and show them to the host (contract with hosts; for guests, our and the host’s legitimate interests in delivering the invitation the host asked us to send and helping guests get to the event).
- To collect dietary choices on the RSVP form, unless the host turns them off (the guest’s consent, which they can withdraw by editing their RSVP).
- To take payments and manage subscriptions (contract), and to keep tax and accounting records (legal obligation).
- To write invitation wording with AI when you ask for it (contract).
- To send hosts a welcome email and occasional tips on getting started, which you can unsubscribe from at any time (legitimate interests).
- To keep Fête secure, prevent abuse and fix problems (legitimate interests).
- To understand how our marketing pages are used and to measure our ads (legitimate interests; see section 8).
- To comply with the law, respond to lawful requests and enforce our Terms (legal obligation and legitimate interests).
Where we rely on legitimate interests, you can object. See section 17.
8. Analytics and advertising
We use Google Analytics (from Google), the Meta Pixel (from Meta) and Vercel Web Analytics to understand how people find and use Fête, and to measure our ads.
Where they run
They run only on our marketing pages, meaning the home page, pricing, themes, guides, holiday invitation pages, the wedding planner page, and our privacy and terms pages. They also run on sign-up and log-in, and on hosts’ own account pages: onboarding, the event wizard and the dashboard.
They never run on invitation and RSVP pages, public event pages or custom event links, so guests’ details and RSVP links are never sent to analytics or advertising providers.
What they receive
On those pages, Google and Meta receive your IP address, cookie and device identifiers, browser details, the pages you visit and the page that referred you. When someone creates an account, we tell Google and Meta that a sign-up happened. Meta also receives a code derived from the new account’s ID so each sign-up is counted only once. When a host creates or duplicates an event, we tell them that an event was created and its type (for example “Birthday”), never its title, details or guests. Nothing is sent from a host’s page for a single event, or from a log-in page that leads back to one, because their web addresses contain the event’s ID, and that page’s title never includes the event’s name. We don’t send them your name or email address.
Vercel Web Analytics counts page views without cookies. Google and Meta use this data under their own privacy policies and may use it to measure and personalise ads, including Meta ads shown to you elsewhere. We have turned off the Meta Pixel’s automatic collection of button clicks and page details.
Your choices
- Google Analytics: Google’s opt-out browser add-on, and how Google uses data from sites that use its services.
- Meta: your ad preferences and the “Activity off Meta technologies” setting in your Meta account.
- Interest-based ads generally: aboutads.info/choices (US) or youronlinechoices.eu (Europe).
- Your browser: block or delete cookies, or use a content blocker.
10. Emails we send
- To hosts: account emails (such as confirming your address or resetting your password) and RSVP notifications. If you subscribe, Stripe may email you receipts. We also send a welcome email and occasional tips on getting started, from hello@fete.rsvp, each with a one-click unsubscribe link.
- To guests: the invitations, reminders, messages and updates a host sends, plus a confirmation when you RSVP. If you add yourself from an event’s public link, we also email you your personal RSVP link. We never send guests marketing emails. If you don’t want emails about an event, tell the host or email us and we’ll take you off that event’s list.
- Automatic event reminders: unless the host turns them off for their event, we email guests who said yes a reminder the day before the event, with its time, place and links to add it to a calendar or get directions. If the host is on Pro, we also email invited guests who haven’t replied a reminder a week before the event, asking them to RSVP. Each reminder is sent once, and replies go to the host.
We send email through our provider, Resend.
11. AI features
To suggest invitation wording, we send the event type, the tone you pick, and any title, host names and venue name you’ve entered to Anthropic’s Claude API. This can happen before you create an account. If you add a YouTube video, we also send its public thumbnail image so the AI can check that it works well as a preview.
We never send guest lists or anyone’s contact details to Anthropic. Anthropic processes this data to provide the service to us and, under its commercial terms, doesn’t use it to train its models. AI suggestions can be wrong, so check them before you send.
13. Selling, Do Not Track and Global Privacy Control
We don’t sell personal information for money, and we never share guests’ contact details for anyone’s marketing. On the pages listed in section 8, Google and Meta receive the data described there, and Meta may use it to target ads. You can limit that with the choices listed in the same section.
Do Not Track: there is no common standard for Do Not Track signals, so we don’t respond to them. Global Privacy Control: we don’t currently act on GPC signals automatically. Email us and we’ll help.
14. Where information is processed
Bonsai Tech LLC operates Fête from the United States. Your information is stored with Supabase in the US (US East), and our site runs on Vercel in the US. Our other providers mainly process data in the US. If you use Fête from outside the US, your information will be transferred to and processed in the US, where the privacy laws may differ from yours and US authorities may be able to access it.
15. How long we keep information
- Account: kept while your account is open. If you ask us to delete your account, we delete it and its events, guest lists and uploaded images within 30 days.
- Events, guest lists, RSVPs, messages and reminder records: kept until the host deletes the event or their account. Deleting an event from the dashboard removes its details, guest list, RSVPs, messages and reminder records straight away. Images uploaded for the event may stay in storage until the account is deleted; email us to have them removed sooner.
- Payment records: kept by Stripe and by us for as long as tax and accounting laws require.
- Logs and backups: kept for our providers’ standard periods, typically days to weeks, then deleted.
- Analytics data: kept under Google’s and Meta’s retention settings. Our Google Analytics data is kept for 14 months at most.
- Emails with us: kept while needed to help you.
16. Security
We use reasonable safeguards designed to protect your information. These include encryption in transit (HTTPS), database access rules that limit each account to its own events, and limited access to production systems. No system is perfectly secure, and we can’t guarantee absolute security.
A small number of Bonsai Tech staff can look up accounts, events and guest lists, but only to help a host or guest who contacts us, to investigate a problem or to keep Fête secure. Every search and every account or event they open is logged. Staff tools don’t show guests’ RSVP links, phone numbers, dietary answers, notes or messages.
Your personal RSVP link works like a password. Anyone who has it can see and change your RSVP, so please don’t forward it. If you think it has been shared, email us and we’ll give you a new link.
If we become aware of a security incident affecting your personal information, we will notify affected people, and regulators where required, as the law requires.
17. Your rights
Wherever you live, and whether you have an account or were invited as a guest, you can ask us to:
- give you a copy of your information;
- correct it or delete it;
- stop or restrict how we use it, or object to our use of it;
- stop marketing emails. Every marketing email also has a one-click unsubscribe link.
Where we rely on your consent, you can withdraw it at any time.
Hosts can edit their events and guest lists from the dashboard. To change your account name or email address, or to delete your account, email us from your account address. We’ll delete your account, events, guest lists and uploaded images within 30 days and cancel any subscription.
To make any request, email mitul@bonsaitech.net from your account address. Guests should use the address their invitation went to. We may ask you to confirm your identity, and we reply within 30 days. If we can’t do what you ask, we’ll explain why, and you can reply to ask us to reconsider. We won’t treat you differently for exercising your rights.
In the UK or the EEA, you can also complain to the Information Commissioner’s Office (ico.org.uk) or your local data protection authority.
18. Consumer health data
Some dietary choices can count as consumer health data under laws such as Washington’s My Health My Data Act. Our Consumer Health Data notice explains what we collect, why, who receives it and how to exercise your rights.
19. Children
Fête isn’t meant for children. Hosts must be at least 18, and we don’t knowingly collect personal information from children under 13. If a child is invited, a parent or guardian should respond for them. If we learn that we have collected a child’s personal information without a parent’s consent, we’ll delete it promptly. Parents or guardians can contact us at mitul@bonsaitech.net.
20. Changes to this policy
We’ll update this policy when our practices change. The date at the top always shows the latest version. If we make a material change, we’ll tell you by email or with a prominent notice on the site before it takes effect.
21. Contact us
For privacy questions and requests, contact: