Privacy Policy

1. Who we are

Konvity (konvity.com.br) is operated by Techlab Soluções Digitais Ltda., a Brazilian company registered under CNPJ 57.243.879/0001-10. This policy explains how we process personal data under Brazil's General Data Protection Law (Law 13,709/2018, the LGPD).

There are two kinds of people on Konvity: the host, who creates an account and organises an event, and the guest, who replies to an invitation without creating an account.

For the host's account data, payment data and site usage data, we are the controller. For the data of an event's guests, the host is the controller — the host decides who to invite and what to ask — and Konvity acts as processor, handling that data on the host's behalf.

2. Data we process

From the host:

• Account: name, email, phone (optional) and password, which is stored in irreversible form. If you sign in with Google, we receive your name, email and profile picture.
• Events: title, date, place, description, images and the settings you choose.
• Pix key and payment instructions, when you enable the gift list or contributions. These are shown to your guests.
• Purchases: plan and add-ons bought, amount, date and payment status. Card details are given directly to the payment processor; Konvity does not store them.

From the guest:

• Name, reply to the invitation and the names of companions.
• Email, phone, dietary restrictions and notes, when provided by the guest or the host.
• Payment receipts uploaded on events that collect contributions.
• Gifts chosen and the message left for the host.

From anyone using the site:

• Technical data: IP address, browser and device type, pages visited and time of access.
• Error reports, used to fix failures. We do not record your screen or browsing session.

3. Why we use it and on what legal basis

• Providing the service — creating the account, publishing the invitation, recording replies, showing the gift list and notifying the host: performance of a contract (art. 7, V).
• Processing payments and issuing the purchase confirmation: performance of a contract and compliance with a legal obligation (art. 7, II and V).
• Protecting the service against fraud, abuse and automated access: legitimate interest (art. 7, IX).
• Understanding how the site is used and improving it: legitimate interest (art. 7, IX).
• Answering support requests and data subject requests: performance of a contract and compliance with a legal obligation.
• Keeping access logs for the period required by Brazil's Internet Civil Framework: compliance with a legal obligation (art. 7, II).

We do not sell personal data and we do not use an event's guest list to send advertising.

4. Who we share it with

A guest's data is seen by the host of the event. The host's Pix key and payment instructions are seen by that event's guests.

We use providers that process data on our behalf, only for the purpose stated:

• Stripe: card payments.
• AbacatePay: Pix payments.
• Resend: transactional email.
• Z-API: WhatsApp notifications, when that add-on is active.
• Cloudflare: bot protection and file delivery.
• PostHog: site usage statistics.
• Sentry: site error reporting.
• Google: sign-in with a Google account, when you choose that option.
• Cloud infrastructure providers: hosting, database and file storage.

We may also share data when required by law or by order of a competent authority.

5. International transfers

Some of these providers process data outside Brazil. In those cases the transfer relies on the grounds in art. 33 of the LGPD, with providers that take on contractual data protection obligations.

6. How long we keep it

• Account and event data: for as long as the account exists. You can delete a guest, an event or the whole account at any time.
• Files (receipts and gift photos): removed from storage within 7 days of deleting the guest, event or account they belonged to.
• Receipts uploaded but never attached to a reply: removed 7 days after the RSVP deadline or the event date.
• Payment records: for the period required by tax and accounting law.
• Access logs: for at least 6 months, as required by Brazil's Internet Civil Framework.

7. Your rights

The LGPD gives data subjects, among others, the right to confirm whether we process their data, to access and correct it, to request anonymisation, blocking or deletion, to request portability, to know who it was shared with and to object to processing.

To exercise these rights, write to [email protected]. We reply within the period set by law and may ask for information to confirm your identity.

If you are a guest of an event, the fastest route is usually the host, who can correct or delete your reply directly. If you prefer, write to us and we will forward the request.

You may also file a complaint with Brazil's National Data Protection Authority (ANPD).

8. Cookies and local storage

• Session: keeps the host signed in. Required for the service to work.
• Language: remembers the language you chose.
• Statistics: measures visits and page usage, through PostHog.
• Browser local storage: holds a code that lets a guest edit their own reply from the same device.

You can delete or block cookies in your browser settings. Without the session cookie it is not possible to access the account.

9. Security

We apply technical and organisational measures to protect data: encrypted connections, private file storage reached through temporary links, per-event access control and removal of sensitive data from internal logs.

No system is fully immune to incidents. If an incident occurs that may cause relevant risk or harm, we will notify the affected data subjects and the ANPD, as the law requires.

10. Children and teenagers

A host account is for people aged 18 or over. An invitation may include the names of children and teenagers provided by a guardian or by the host; that data is used only to organise the event.

11. Changes to this policy

We may update this policy. The date at the top shows the version in force. Relevant changes will be communicated to hosts by email or by a notice on the site.

12. Contact

Questions about this policy or about how your data is processed: [email protected]. This is also the channel for our data protection officer.