Privacy Policy

Last updated: 23 October 2026

We collect the minimum we need to build and deliver your invitation — nothing more. This page explains exactly what we collect, why, and what we never collect.

What we collect from you

Your name and WhatsApp number — to reach you and to keep a copy of your invitation link for you.
The event details you type yourself: names, date, venue and address, and any text or photos you add to the invitation.
Your approximate country — inferred from your internet connection to show prices in your currency. It does not pinpoint your location.

What we never collect

Your card details. Payment happens entirely inside the payment gateway; card numbers never pass through our servers, and we never see or store them.
No ID documents, no home address, no official paperwork.

Your mobile app account

The mobile app takes no payments and contains no sales. It shows the invitations you ordered on the website or through our support team, and the invitations you create in it, so you can manage them.
When you register, we store your name, chosen email address or phone number, account identifier and invitation memberships. We store a secure password hash to verify sign-in, and session records, expiry and revocation information to protect the account.
The phone keeps your session in the operating system's secure storage, along with locally stored app preferences and invitation summaries for offline viewing. Signing out clears the account session and summaries.

Photos, camera, contacts and notifications

Photos you choose to upload are sent to our storage to appear in the invitation or album. The app does not automatically copy your photo library or address book.
“Add from contacts” in the guest list reads your contacts' names and phone numbers on your phone only when you ask for it and after you allow access, so you can pick your guests. Only the names and numbers you select are uploaded to our servers, where they are stored in your invitation's guest list alone; we do not use them for anything else or share them, and you can delete them at any time and turn off access in your phone settings. The “Send” button opens WhatsApp on your phone with a ready message to that guest, which you send yourself from your own number.
The guest ticket scanner requests camera access when you start it. Camera frames are processed locally to read the QR code; the ticket code is sent to the server to verify and record entry. Scan frames are not uploaded or stored on our servers.
If you enable notifications, we store your device's delivery token, platform and its account/session link. Apple APNs or Google Firebase Cloud Messaging delivers service notifications. You can turn them off in your account or your phone settings.

Your guests' data

When your guests RSVP we store what they submit: name, number of companions, and a congratulations message if they write one. This is visible to you in your control link. Other guests only see the wishes you choose to display.
If you enable the photo album, photos your guests upload are stored and shown to whoever you share the album with.
You are responsible for letting your guests know you are collecting their RSVPs through an online invitation.

Why we use your data

To build and serve your invitation, send you your control link, respond when you contact us, and improve our service.
We never sell or rent your data or your guests' data, and we never share it for third-party marketing.

Who can access it

Us — to deliver the service and support you.
Service providers we rely on to run the site: hosting and database, and the payment gateway to complete your purchase. Each accesses only what its task requires.
Advertising measurement tools (such as the Meta pixel) that tell us which ad led to a purchase. They receive a signal that a purchase happened and its value — never your invitation content or your guests' data.
Authorities, if the law requires it.

Cookies

We use functional cookies only: to remember your chosen currency and site language, to save your in-progress invitation so your work isn't lost if you close the browser, and to tie your order to your device so nobody else receives your control link.
Plus an advertising measurement cookie when you arrive from an ad. You can clear cookies anytime, but some site functions may stop working.

How long we keep it

Your invitation and its link stay active for the invitation's validity period (six months by default, extendable).
Unpaid in-progress invitations are deleted automatically within 48 hours.
Order and billing records are kept as long as accounting and dispute resolution require.

Your rights

You can request a copy of your data, ask us to correct it, or have your invitation and its guest data permanently deleted — message us on WhatsApp or by email and we'll act within a reasonable time.
Most of your data you can edit yourself, directly from your control link, without contacting us.

Deleting your mobile account

You can request account deletion from My Account in the app. Once completed, it removes the account and invitation memberships, revokes its sessions and removes its notification device links. Uninstalling the app alone does not delete your account.
You can also delete the same account on the website without the app: open https://halaheel.com/account, sign in with the same email or phone number and password, then choose «حذف الحساب نهائياً» (Delete account permanently).
Deleting the account also deletes the unactivated invitations it created in the app and cancels their incomplete orders. We retain records of activated orders for as long as accounting, legal obligations and dispute resolution require, and activated invitations, invitations shared with other accounts and their guest data are not deleted automatically. To delete an invitation or its data, contact us at the email address shown on the website.

Security

The whole site runs over an encrypted connection, and your control link contains a secret token only you have — so never share it; share the invitation link only.
No system is one hundred percent secure, but we take your data seriously and fix any issue we find as fast as we can.

Children

Our service is intended for adults organising events. We do not knowingly collect data from children.

Changes to this policy

If we change something material we update the "last updated" date at the top. Continuing to use the site after a change means you accept it.

Questions? Message us on WhatsApp · hello@halaheel.com