Who can see
your information?

What do the bride and groom enter?

The profile contains names, the wedding date, ceremony/reception details, location, photos and content chosen by the couple. The guest list contains recipient names, groups, family sides and maximum party sizes; responses contain attendance status, headcounts and messages. Wedding gift QR codes and bank details are added voluntarily by the couple.

Sign-in is handled through the Nari/Planner account. Invitations uses a session and a one-time linking code to open the correct profile; customers are not asked to send passwords or OTPs to staff.

Who has access?

Drafts and photo libraries belong to the profile and can be managed only by authorised accounts. After publication, anyone with the link can view the published invitation content, including photos, location and QR codes if the couple enables that section.

A personalised link shows the recipient’s name and that invitation’s response. Anyone with the link can forward it and view or change the response while it remains valid; this is not guest identity verification. Do not put sensitive information in messages. A public social-sharing link does not show a specific guest’s name or collect an individual guest’s RSVP.

Invitation and private-preview pages ask search engines not to index them; this does not prevent link holders from taking screenshots or sharing. Revoking or replacing a link blocks the old link but does not delete copies others have saved.

Which systems handle the data?

Invitations runs on Cloudflare Workers, uses D1 for data and R2 for photos. When one profile has access to both apps, guest details and RSVPs are exchanged with Planner; completion is reported only after the receiving app confirms storage.

Transactional emails and order/support information may be processed by email systems and Lark for Nari operations. Creating an invitation does not mean that guests have been emailed; the couple sends guest links themselves.

When an embedded map loads, Google Maps receives the browser’s connection information under Google’s service. Landing/demo analytics record aggregate page loads, not a list of guests who have read invitations.

Retention, changes and deletion requests

The couple can edit drafts and publish updates. Photos still referenced by a draft or published invitation cannot be deleted directly; first remove the photo, save and update the relevant invitations. Deleted photos have no restore button in the app; keep the original files.

Expired access or a revoked link does not by itself prove that all data and backups have been deleted. Retention, deletion and recovery procedures need to be confirmed for the profile; a date displayed on a link is not evidence of when data is deleted.

For data questions or requests to correct, restrict processing or delete data, contact naribabystudio@gmail.com or 0911 686 611. Nari needs to verify the requester and profile scope; some documents or logs may need to be retained for transactions, disputes or legal obligations. Do not send passwords, OTPs or private links through public channels.

Before importing a list or submitting a response

The couple needs an appropriate basis to upload guest information and photos, inform the people concerned and enter only what is needed for wedding invitations. Guests may contact the couple directly if they do not want to use the online RSVP form. Submitting an RSVP sends attendance status, headcount and a message to the couple’s profile; it is not a marketing subscription.