Privacy Policy
Last Updated: October 2026
1. Introduction & Scope
This Privacy Policy applies to the BuzzInvite platform (“BuzzInvite”, “we”, “us”, or “our”), accessible via our website and online services. We provide online tools enabling event hosts (“Hosts”) to publish event landing pages, generate digital entry QR codes, collect RSVPs, and manage attendee rosters, and enabling guests (“Guests” or “Attendees”) to respond to event invitations.
We are bound by the Australian Privacy Principles (“APPs”) set out in the Privacy Act 1988 (Cth) (“Privacy Act”). This policy sets out how we collect, hold, use, disclose, and protect your personal information, and your rights to access and correct that information.
2. Kinds of Personal Information We Collect
Under the Privacy Act, “personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable. The information we collect depends on your interactions with BuzzInvite:
A. Account Information (Event Hosts)
When you register an organizer account, we collect your name, email address, password hash (encrypted), profile avatar image, and authentication tokens if you authenticate through federated third parties (such as Google or Apple).
Google and Apple Sign-In (user data we receive)
If you choose “Sign in with Google”, we request only the basic openid, email and profile permissions. From Google we receive your name, email address, profile picture and a flag that Google has verified your email, plus the sign-in tokens Google issues for your session. We do not request or access your Gmail, Google Drive, Google Calendar, contacts or any other Google data.
How we use it: only to create and sign you in to your BuzzInvite host account, to show your name and photo in your dashboard and on events you host, and to send you service emails about your events. How we store it: in our database (hosted by Neon), in the same way as other account information, protected as described in section 9. Sharing: we do not sell it, use it for advertising, or share it with anyone other than the service providers listed in section 8 that we need to run BuzzInvite. We do not use it to train AI or machine learning models.
Existing accounts: if you already have a BuzzInvite account with the same email address and Google or Apple has verified that address, we connect your Google or Apple sign-in to that account, so you can use either way to sign in.
Deleting it: deleting your account under Account settings removes your profile and the stored sign-in link to Google. You can also remove BuzzInvite's access at any time from your Google Account at myaccount.google.com/permissions.
BuzzInvite's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
If you choose “Sign in with Apple”, we receive the email address Apple provides (which may be Apple's private relay address) and, where you allow it, your name. It is handled in the same way as above.
B. RSVP & Guest Information (Attendees)
When you submit an RSVP to an event hosted on BuzzInvite, we collect the information the event's RSVP form asks for, which can include your full name, email address, mobile telephone number, attendance status (attending, declined, or tentative), the number of adults and children in your party, and free-text notes.
C. Sensitive Information (Dietary Requirements & Allergies)
Dietary requirements may disclose sensitive health or religious information (such as severe food allergies, medical dietary requirements, celiac status, or halal/kosher observance). We only collect this information when you type it into the RSVP form to help the Host with catering and safety. Some events ask specific allergy questions, so provide only what you are comfortable sharing with the Host.
D. Children's Party & Family Information
For events such as children's birthday parties, the RSVP form may ask for the parent or guardian's name, the number of children attending, and, optionally, each child's name and any dietary notes for them. These RSVPs should be completed by a parent or guardian, who is responsible for the information given about the child.
E. Technical, Device & QR Scan Data
Our hosting provider keeps standard server logs (such as IP address, browser type and request time) for security and troubleshooting. We do not log QR code scans: the QR codes we generate are plain links to an event or photo gallery.
Guest visitor ID. When you open an event page, we set a random visitor ID (a first-party cookie named buzzinvite_vid, kept for up to 12 months, and a copy in your browser's local storage). It is not linked to your name or email. We store it with a visit count and first and last visit times so the Host can see how many people have viewed the invitation. Visits by the Host and co-hosts, and by known link-preview bots, are not counted. You can clear this cookie and local storage in your browser at any time.
Remembered RSVP. After you RSVP, your browser keeps a small record for that event (a first-party cookie and a copy in local storage, both named buzzinvite_rsvp_ followed by the event address, kept for up to 12 months). It holds your name, your reply and the private link code for editing your RSVP, so you can come back and change it on the same device.
Photo uploads. When a guest uploads a photo, we store the photo and any name they choose to give, plus a scrambled (hashed) form of their anonymous cookie ID so they can remove their own photos, and a keyed hash of their IP address used only for rate limiting. We do not store the IP address itself. The anonymous cookie ID is a first-party cookie that expires after 60 days, and the name you type is remembered in your browser's local storage (buzzinvite:guest-name) so you do not have to retype it. You can clear both at any time.
Photo book interest. On a photo gallery, you can ask to be told when printed photo books are available. If you open that offer we count it, and if you give your email address we store it with the event so we can email you once when books are ready. We do not use it for anything else, and it is deleted when the event is deleted. You can also email us to have it removed.
3. How We Collect Personal Information (APP 3 & APP 4)
In accordance with APP 3, we only collect personal information by lawful and fair means, and with your knowledge and consent:
- Directly from you: When you complete our sign-up form, create an event, submit or update an RSVP, upload photos, or contact us.
- From Event Hosts: An event organizer may provide your contact details (such as your email or phone number) to deliver an event invite or manage a pre-filled invitation roster. Hosts warrant that they hold any necessary consents before uploading third-party contact information.
- Automated technologies: Via sign-in session cookies, the guest visitor ID described above, server logs, and rate-limit counters used for security. Error monitoring (Sentry) receives technical error reports, with personal details scrubbed before they are sent.
- Product analytics (hosts only): While you are signed in or using the sign-in and dashboard pages, we use PostHog to record which features you use and, on some pages and with all form inputs masked, session recordings of how you move through the dashboard, so we can fix confusing screens. Events are linked to your internal account ID, and we strip names, emails and similar details from them. It is not used on guest invitation, RSVP or photo pages. Your browser's "Do Not Track" setting is respected, and you can contact us to ask us to stop.
4. Purposes of Collection, Use, and Disclosure (APP 6)
We collect, hold, use, and disclose personal information for primary purposes connected with operating BuzzInvite, specifically:
- Enabling Hosts to create, customize, and share event pages;
- Processing guest RSVPs, calculating capacity limits, and providing attendance counts;
- Generating QR codes that link to an event invitation or photo gallery, and counting invitation views for the Host;
- Storing and displaying photos uploaded to an event gallery;
- Issuing automated transactional confirmations, RSVP modification links, and critical event updates;
- Allowing Hosts to download CSV rosters of their registered attendees for on-site event logistics;
- Detecting, preventing, and addressing fraud, spam, cyber threats, and security incidents;
- Complying with applicable Australian legal and regulatory obligations.
We do not sell, rent, or trade your personal information to third-party data brokers or advertisers.
5. Handling of Sensitive Information (Dietary & Health Data)
Under APP 3.3, sensitive information (including health information and philosophical/religious beliefs inferred from dietary restrictions) receives heightened protection.
Explicit Consent for Dietary Entries:
By submitting dietary requirements or allergy alerts in the RSVP form, you give your explicit consent for BuzzInvite to store this information and disclose it directly to the designated Event Host. This information is used strictly to assist the Host and venue caterers in providing safe food options. It is never used for advertising or shared outside of event logistics.
6. Public vs. Private Guest Rosters
Event Hosts can choose whether the attendee list is shown to other invitees:
- Public Attendee Lists: This is on by default, and the Host can turn it off. When on, attendee names and RSVP statuses may be visible to other invitees on the event page. Some event types, such as surprise events, keep the list hidden.
- Private Attendee Lists: If disabled, attendee rosters and RSVP details are strictly restricted to the authenticated Host dashboard.
Private contact details (such as your personal email, phone number, and sensitive dietary requirements) are never displayed on public event rosters.
7. Direct Marketing & The Spam Act 2003 (Cth) (APP 7)
BuzzInvite strictly adheres to the Spam Act 2003 (Cth) and APP 7:
- Transactional vs Marketing: RSVP confirmations, unique edit token links, password resets, and critical schedule alerts sent by the platform are designated as functional transactional messages.
- Commercial Messages: We will not send you unsolicited commercial electronic messages without your verifiable consent. Where direct marketing is offered, every communication includes a clear, functional unsubscribe mechanism.
- Host Obligations: Event Hosts who send invites or messages through BuzzInvite warrant that they have the requisite prior consent or existing relationship with their recipients in compliance with the Spam Act.
8. Cross-Border Data Disclosures (APP 8)
We use the following service providers to run BuzzInvite. Your personal information may be stored or processed by them on servers outside Australia, including in the United States:
- Vercel – web hosting and server logs;
- Neon – database (accounts, events, RSVPs);
- Cloudflare R2 – storage of uploaded photos;
- Resend – sending transactional and invitation emails;
- PostHog – product analytics for signed-in hosts;
- Sentry – error monitoring;
- Google – optional sign-in, only if you choose “Sign in with Google”;
- Apple – optional sign-in, only if you choose “Sign in with Apple”.
Under APP 8 we take reasonable steps in the circumstances to make sure these providers handle personal information in line with the Australian Privacy Principles. We rely on their published security and privacy terms, and we may change providers over time.
9. Data Security & Storage (APP 11)
We take reasonable steps to protect your personal information against misuse, interference, loss, and unauthorised access, modification or disclosure. No online service can guarantee absolute security. Our measures include:
Passwords are salted and hashed using bcrypt before database storage.
Each RSVP gets a random UUID edit link, so only someone holding that link can change it.
All data transferred between your browser and our servers is secured with HTTPS/TLS.
We collect only what is needed to run events, and delete it when a host removes an event or account (see Retention and Deletion).
Data breaches. If a data breach is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act.
10. Access and Correction of Personal Information (APP 12 & APP 13)
Under APPs 12 and 13, you have a right to request access to the personal information we hold about you and to request corrections if it is inaccurate, out-of-date, or incomplete:
- Self-Service RSVP Updates: If you submitted an RSVP, you can view and edit your details at any time using the secret edit link issued in your confirmation screen or email.
- Host Account Records: Hosts can update their profile information and event settings directly via their authenticated BuzzInvite Dashboard.
- Direct Requests: You may contact us to request access to, correction of, or deletion of your records. We aim to respond within 30 days.
11. Anonymity and Pseudonymity (APP 2)
Whenever lawful and practicable, you have the option of dealing with us anonymously or using a pseudonym (for instance, browsing public event details without registering). However, submitting an RSVP or managing an event requires verifiable contact details to enable host coordination, capacity governance, and communication of event changes.
12. Complaints, Enquiries & OAIC Contact
If you have questions about this Privacy Policy, wish to exercise your rights, or wish to make an enquiry regarding a potential breach of the Australian Privacy Principles, please contact us:
Escalation to the OAIC:
We investigate all privacy complaints thoroughly and aim to resolve them within 30 days. If you are not satisfied with the outcome, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC) through their official online regulatory portal at oaic.gov.au.
Retention and Deletion
Hosts and your guests' information. The Host who creates an event decides what to ask guests, and receives their RSVPs, contact details, dietary information and photos. Hosts are responsible for how they use and share that information, including after exporting it, and must handle it in line with privacy law. BuzzInvite is not responsible for what a Host does with information once they hold it. Contact the Host directly about their handling of your details, and contact us if you need help.
Photos. Photos uploaded to an event gallery are visible to the Host and co-hosts, and to anyone who has the gallery link, depending on the Host's settings. Guests can remove photos they uploaded from the same browser, and the Host can remove any photo. Only upload photos you are happy for the Host and other guests to see, and do not upload photos of people who would object.
We keep personal information only for as long as it is needed to run BuzzInvite:
- Events, RSVPs and photos stay until the host deletes the event or their account. Deleting an event removes its RSVPs, guest list and uploaded photos straight away.
- Deleting your account removes your profile, every event you host with its RSVPs and photos, and your sign-in sessions. Backups held by our database provider may take a short time to roll off.
- Sign-in, reset and rate-limit records are short-lived. Email confirmation and password reset links expire within 24 hours and 1 hour, and rate-limit counters hold only a scrambled network identifier for a few hours.
13. Changes to this Policy
We may revise this Privacy Policy periodically to reflect technological advancements, platform updates, or amendments to Australian privacy laws. Any updates will be posted directly to this page with an updated “Last Updated” date. Continued use of BuzzInvite signifies acceptance of the updated terms.