Privacy Policy

Who you are dealing with

RSVIP is a digital invitation, RSVP and event-communication platform for weddings and every other kind of event, operated by Kanvas Creative Solutions in South Africa. We provide the platform to hosts and organisers, and deliver their invitations to the guests they invite.

• Trading nameRSVIP (rsvip.co.za)
• Operated byKanvas Creative Solutions
• Registration number2019/136304/07
• AddressJohannesburg, South Africa
• Support and legal emailrsvp@kanvas.co.za
• Telephone and WhatsApp(+27) 081 788 0727
• Support hoursMonday to Friday, 09:00 to 17:00 (SAST), excluding public holidays
• CurrencyAll prices are in South African Rand (ZAR)

1. Scope and who is responsible

This Policy covers the RSVIP website, host accounts and dashboards, invitation pages, RSVP forms, galleries, Communities, the Len assistant, the affiliate programme, the vendor directory, payments and support. Kanvas Creative Solutions, operating as RSVIP, is the responsible party for platform information under the Protection of Personal Information Act, 2013 (POPIA).

For the guest list, guest responses and event content a host puts into RSVIP, the host is also a responsible party and must handle that information lawfully. RSVIP processes it on the host's behalf to run their invitation.

2. What we collect

Host and account information

Name, email address, phone and WhatsApp number, company or logo where given, account type, sign-in records (PIN requests, sign-in links, WhatsApp sign-in requests), co-organiser contacts and their access settings, and support messages.

Wedding and event details

Couple, host or organiser names, event date and times, venue, address, map and live-stream links, dress code, programme, about text, quotes and tributes, speakers, sponsors and partners, gift registry entries, invitation notes, contact numbers and the names shown with them, theme choices, and any tracking IDs the host adds.

Guest information

Names, email addresses, mobile numbers, attendance (yes, maybe or no), number of guests, dietary requirements and personal requests, messages to the host, guest-list and whitelist entries, invitation status per channel, and imported contacts for SMS.

Photos, music and media

Cover images, gallery photos and captions, theme songs and videos the host uploads; photos guests take with the Public Gallery camera; Community posts, profile photos and the names guests post under.

Camera and microphone

A Public Gallery or Community photo is taken with your phone's camera only after your browser asks for, and you give, permission. RSVIP receives the photo you choose to submit, never a continuous camera feed. The microphone is not used.

Payment information

The amount, method, status and gateway reference of a payment, coupons used, and for affiliate partners the bank details given for withdrawals. We do not receive or store complete card numbers, expiry dates or card security codes.

Device and usage information

IP address, browser and device information, timestamps, pages and actions used, security and error logs, and session identifiers.

3. Why we use it

We process personal information where it is necessary to perform our contract with you, to comply with the law, for legitimate interests that do not override your rights, or with your consent. Specifically, to:

• create accounts and sign you in by PIN, link or WhatsApp, and give co-organisers the access a host grants;
• build and publish invitations, programmes, galleries and Communities;
• deliver invitations by email and SMS, record RSVPs and notify the host of new responses;
• take payment, apply coupons, record transactions and pay affiliate commission;
• answer questions through Len and through our support team;
• detect abuse, secure accounts, investigate errors and enforce our Terms;
• meet accounting, tax, consumer-protection and other legal duties; and
• improve reliability, usability and support.

4. Len and AI features

When you chat with Len, the messages you type and any picture or PDF you attach are sent to our AI provider to produce a reply. They are not used by us to make decisions about you. The chat is kept in your own browser for up to seven days so you can continue it, and you can clear it at any time with "End Chat". If you ask for a transcript or ask Len to pass a message to our team, that email is sent to the address you give us.

Where a host switches on AI formatting for a programme, the programme text is sent to the AI provider to lay it out.

Please do not share sensitive information with Len - PINs, passwords, card numbers, banking details, ID numbers, or health or other special personal information.

5. Cookies and browser storage

• Essential cookies keep you signed in, protect forms against forgery and enforce the inactivity timeout. Blocking them breaks sign-in.
• A referral cookie remembers, for 30 days, which affiliate partner sent you, so the right partner is credited if you sign up.
• Browser storage keeps your Len chat for up to seven days and remembers small choices, such as whether a welcome message has been shown.
• Host tracking. A host may add Google Analytics, a Meta Pixel or a similar tag to their own invitation. Those tags are the host's responsibility and are subject to that provider's policy.

You can control cookies in your browser settings, but disabling essential cookies stops parts of the service from working.

6. Who sees your information

We do not sell personal information, and we do not share it for marketing without consent. We share only what is needed, with:

• guests and visitors - whatever a host publishes on an invitation, and the photos and posts in an enabled gallery or Community;
• the host and their co-organisers - the RSVP and contact details guests submit;
• the affiliate partner who referred you - your name and the number of paid invitations, so they can see their referrals;
• service providers under contract and only for these purposes: PayFast for payments, our hosting provider, our email delivery service, our SMS provider, WhatsApp (Meta) for WhatsApp sign-in, and our AI provider for Len and AI programme formatting;
• advisers, regulators, courts or law enforcement where the law requires it; and
• a buyer of the business in a lawful reorganisation, with equivalent protection.

7. Information sent outside South Africa

Some providers - including email delivery, WhatsApp and our AI provider - process information outside South Africa. Section 72 of POPIA allows this where the recipient is bound by rules giving comparable protection, where you consent, or where it is needed to perform our contract with you. We rely on contract terms with those providers and pass on no more than the service needs. See the POPIA and PAIA notice.

8. Card and banking information

Card payments are taken on PayFast's own secure page. Card details travel encrypted between you and PayFast; RSVIP is not in that path and holds no card number, expiry or security code. We keep the outcome of the payment: amount, status, method and reference.

Bank details are kept only for affiliate partners' withdrawals and for repaying an approved refund, and are visible only to staff who need them for that payment. All pages are served over HTTPS.

9. How long we keep it

• Invitations and programmes: may be removed 30 days after the event date, as the Terms explain.
• Guest and Public Gallery photos: up to two years after the event date, unless the host deletes them or earlier deletion is requested.
• Active accounts: while the account is open.
• Closed accounts: most information deleted within 30 days of closure.
• Transaction, payment and affiliate records: seven years, for tax and legal compliance.
• Support messages: normally two years. Security and error logs: normally twelve months.
• Len chats: in your browser for up to seven days; we do not keep a copy on our servers.

We send reminders before any automatic deletion of event memories, so you can download your photos and content first. Information may remain in restricted backups until those are overwritten in the ordinary cycle.

10. How we protect it

We use passwordless sign-in with short-lived PINs, protected sessions with an inactivity timeout, access controls and role separation, encrypted HTTPS transport, private directories the web server refuses to serve, checks on uploaded files, verification of payment notifications, and monitoring and logging. Scripts hosts add to invitations are rebuilt from tracking IDs rather than run as written.

No online service is risk-free. Please help: keep your email and WhatsApp secure, never share a PIN or sign-in link, and tell us at once if you think your account has been misused.

If a security compromise affects your personal information, we will notify you and the Information Regulator as POPIA requires.

11. Public content and other people's information

Invitation pages, galleries and Communities can be seen by anyone with the link. Do not publish anything confidential there. If you add information about guests, speakers, sponsors or anyone else, you confirm you are allowed to and have given any notice required.

Anyone submitting a photo needs the permission of identifiable people in it. Hosts must respond properly to requests about content on their invitation, and we will help where we can.

12. Your rights

Under POPIA you may ask whether we hold information about you, ask for a copy, ask us to correct or delete it, object to processing, withdraw consent where we relied on it, and complain to the Information Regulator. We can also provide your data in a structured, commonly used format where that is practical.

How to make a request, our response times and the Regulator's details are on the POPIA and PAIA page. A guest who wants an RSVP removed may ask the host or us. Some records must be kept where payment, tax, fraud or legal duties require it.

13. Children and direct marketing

RSVIP is not intended for children under 13, and we do not knowingly collect their information for our own purposes. Users between 13 and 18 should involve a parent or guardian when creating invitations, submitting photos or managing guest information. Tell us if a child's information has been submitted improperly and we will remove it.

Sign-in, payment and RSVP messages are transactional, not marketing. We may send marketing about new RSVIP features; every marketing email carries a way to opt out, and opt-outs are honoured.

14. Contact and changes

Privacy questions and requests: rsvp@kanvas.co.za or (+27) 081 788 0727. Give us enough detail to find the account or invitation, and never send PINs or card numbers.

We may update this Policy as the service or the law changes. The current version and its effective date stay on this page. For material changes we notify account holders by email and post a notice on the website, with 30 days' notice where the change affects you significantly.