Privacy policy

• Account: email address, name (optional), preferred language and support code. If you sign in with Google, we receive the name and email of that Google account.
• Invitation content: names, dates, venues, text, uploaded photos and videos, and bank or e-wallet numbers for digital gifts if added.
• Guest lists added by hosts: guest names, WhatsApp numbers, groups, party size and the events they are invited to.
• From guests: RSVPs (name, attendance, party size, message) and wishes (a name or anonymous, and the message). The guest’s browser keeps a random code to recognise their answer again, and a key to delete their own wish.
• Reports: the reason, details, and the reporter’s email if given.
• Support: from Saweria or Ko-fi we receive the name, amount, message and email that provider sends. We never receive your card or bank details.
• Technical data: IP addresses are used briefly to limit spam and for Cloudflare Turnstile security checks. They are not stored in our database.

• To run the service: storing and showing invitations, sending sign-in links and notices, and showing RSVPs and wishes to hosts.
• To prevent spam, fraud and abuse, and to follow up reports.
• To record support and match it to an account through the support code.

The basis is providing the service you ask for, and your consent. Data isn’t used for ads and isn’t sold.

• A published invitation can be opened by anyone who knows its address. It doesn’t appear in search engines unless the host allows it.
• Shown wishes are visible to everyone who opens the invitation.
• RSVPs, guests’ WhatsApp numbers and private messages are visible only to the host and the co-hosts they invite.
• The DatangYuk team opens data only to handle reports, fix technical problems or meet legal obligations.

Some providers process data on our behalf. Some of their servers are outside Indonesia; we only use providers that keep data secure.

• Server provider (VPS): where the app and database run.
• Cloudflare: DNS, bot checks (Turnstile), and photo and video storage (R2).
• Resend: sending sign-in links and notices by email.
• Google: Google sign-in if you use it; Google Fonts are loaded from Google’s servers when an invitation opens.
• YouTube: videos on invitations load from youtube-nocookie.com after a guest taps play.
• Saweria and Ko-fi: support payments, under their own privacy policies.

• An invitation, with its guest list, RSVPs, wishes, photos and videos, is deleted automatically 14 days after its last event session. Drafts without an event date are deleted after 90 days without changes. Notices are sent beforehand, and the data can be downloaded until the deletion date.
• Hosts can delete an invitation at any time.
• Your account is kept until you delete it on the Account page. Deleting your account also deletes every invitation you own.
• Database backups are kept for 30 days, then deleted.
• Support records are kept as financial records.
• A deleted invitation’s address can’t be taken by anyone else for 12 months. Only the address is kept, without content.

We use a session cookie to keep you signed in, and a language cookie. Your browser also stores invitation changes that haven’t been sent yet, guest codes, wish delete keys and display choices. There are no advertising cookies or third-party trackers.

• See and correct your account data on the Account page, and your invitation content in the editor.
• Download an invitation’s data (guests, RSVPs, wishes and content) in its Settings.
• Delete an invitation or your account at any time.
• Withdraw consent, object, or ask for a copy of other data at halo@datangyuk.online.

Guests who want their data deleted can contact the host or us. A guest can delete their own wish from the browser they sent it with.

Accounts are for people aged 13 and over, and users under 18 need permission from a parent or guardian. If we learn that an account belongs to a child under 13, we delete it.

Every page uses HTTPS. Trial-run links and guests’ personal links use random codes, and the dashboard opens only for an invitation’s owner and co-hosts. No system is completely secure. If a personal data breach happens, we notify affected users within 3 x 24 hours, as the Personal Data Protection Law requires.

Changes are announced on this page. Important changes are also emailed.

Questions and requests about personal data: halo@datangyuk.online.