Privacy Policy

1. About this policy

This policy applies when you visit the site, create an account, build an invitation, make a payment, contact support or use any EMS Event Management feature. It is written with reference to Indonesia's Personal Data Protection Law (Law No. 27 of 2022).

For your account and transaction data, we are the data controller. For the guest data you enter, you decide what is collected and why; we process it on your behalf to run your invitation.

2. Data we collect

Account data. Your name, email address, phone number (if you add one) and password, which is stored as a one-way hash we cannot read. If you sign in with Google, we receive your name, email address and Google account ID.

Event data. The title, date, location, story, photos, music and settings of your invitation, including any bank or e-wallet gift details you choose to show.

Guest data. The names, phone numbers or email addresses and guest groups you enter; RSVP answers, head counts, wishes, photos uploaded by guests (if you allow it), check-in records, and a record of when each personal invitation was opened.

Transaction data. Order number, package, amount and payment status, payment information from DOKU, and the bank name, account holder and account number you give if you request a refund. Card details are handled by DOKU and never stored by us.

Support data. Help tickets, live chat conversations, and the materials you send for the Done for You service.

Technical data. IP address, browser and device type, access times, sign-in sessions and system logs, used for security and troubleshooting.

Trying without an account. If you try building an invitation before registering, the names and details you type are kept as a temporary draft that is deleted if it is not claimed with an account.

3. How we use data

• To build, store and show invitations, and to record RSVPs, wishes and attendance.
• To send invitations and messages to guests when you ask us to.
• To manage accounts, orders, payments and refund requests.
• To send verification codes, receipts, expiry reminders and account notifications.
• To provide support, including setting up invitations for the Done for You service.
• To prevent fraud, spam and abuse, and to keep the service secure.
• To monitor performance and improve the service.

We do not sell your personal data or guest lists, and we never use your guest list to market our services to your guests.

4. Legal basis

We process data because it is needed to perform our agreement with you, because you consented (for example when signing in with Google or using an AI tool), to meet legal obligations such as keeping transaction records, and for legitimate interests such as security and fraud prevention.

5. Cookies

We only use cookies the site needs to work: your sign-in session, protection of forms against forged requests, and your language choice. We do not use advertising cookies or third-party ad trackers.

Invitation pages may embed Google Maps or a YouTube video if the host adds one. Those services may set their own cookies under Google's privacy policy.

6. Who receives data

We share data only as far as needed to run the service:

• DOKU, to process payments.
• Messaging providers such as Twilio and our email provider, to send verification codes, notifications and invitations by email or WhatsApp.
• Google, when you sign in with Google and to show location maps.
• Hosting and file-storage providers, to run the site and store photos and media.
• OpenAI, only the photo you choose when you use the AI Cartoonizer tool.
• An AI model provider for the live chat assistant, which receives the content of your support conversation.
• Authorities, when required by law or a valid order.

Some of these providers process data outside Indonesia. Where they do, we take reasonable steps to keep the data protected as the applicable regulations require.

7. What is public

A published invitation, including the photos, location and gift account details you show, can be seen by anyone with its link. Guest wishes you approve appear on the invitation. A personal link shows that guest's name.

Your guest list, full RSVP answers and check-in data are never public. Each guest only sees the invitation and their own replies.

8. Who can access your data

Event and guest data can be accessed by you as the host, and by our staff when they need it for support, the Done for You service or security. Our AI assistants work with limited, logged access, and decisions about payments, refunds, privacy or deletion are always made by staff.

9. How long we keep data

• Account, event and guest data are kept while your account is active, unless you delete the event or ask us to delete the data.
• When a package ends, the invitation stays reachable for 14 more days, then it is archived. Event photos are deleted 30 days after archiving.
• Events you delete are removed from public access straight away and their files are deleted.
• Uploads you did not end up using while creating an event are deleted after 7 days. Drafts made without an account are deleted if not claimed in time.
• Sign-in session records and notifications are kept for 90 days; audit logs for 1 year.
• Transaction records are kept for as long as tax and accounting rules require.

10. Security

We use reasonable technical and organisational measures, including hashed passwords, encrypted connections, payment notifications verified by digital signature, role-based staff access, and masking of personal data in logs. No system is completely risk-free. If a data breach affects you, we will notify you as the law requires.

11. Your rights

You can ask to access, receive a copy of, correct or delete your personal data, withdraw consent, and object to certain processing. You can update your account details and export your guest list directly from your account. For anything else, contact support@ems.com. We may ask you to verify your identity, and we may keep data the law requires us to keep.

Guests who want their data corrected or deleted can ask the host, or contact us directly.

12. Children's data

Accounts are for users aged 18 or over, or with a parent's or guardian's consent. If you enter a child's details, for example for a birthday invitation, make sure you are their parent or guardian or have their consent. If you learn that a child's data was given without that consent, let us know.

13. Changes to this policy

We may update this policy. We will tell you about material changes through the service or by email, and the date at the top of this page shows the latest update. If the Indonesian and English versions differ, the Indonesian version prevails.

14. Contact us

Privacy questions or requests can be sent to support@ems.com or through our contact page.