Invi Privacy Policy

1. Who we are and how to contact us

CetchApp AS is the data controller for the personal data processed in the Service.

CetchApp AS Email: support@cetchapp.com

Send privacy questions and requests for access, correction or deletion to this address.

2. Information we collect

Information you give us:

• Account information: name, display name, email address, phone number and password (stored encrypted). If you sign in through a third-party sign-in service, we receive your name, email address and an identifier from that service.
• Profile: profile picture and preferred language.
• Content you create or share: activities, invitations, messages in activity chats, photos, memories, favourites and friend groups.
• Saved addresses, if you choose to save them for quicker entry.
• Text and voice recordings you send to cAI, the AI feature that helps you create activities.
• Payment details for activities with payment: the phone number the payment should go to.
• Messages you send us, for example by email or through a form on the website.

Information collected when you use the Service:

• Location, when you have given permission: used to show nearby activities, places and weather.
• Device and usage: IP address at registration and last use, time of last activity, device name and device ID, and notification tokens that let us send push notifications.
• Error and crash reports from the app: technical details of the error, app version and device type.
• Referral code, if another user invited you.

3. Permissions on your device

The app only asks for a permission when a feature needs it, and you can change permissions at any time in your device settings:

• Location: to show nearby activities, places and weather, and for the map.
• Camera and photos: to take or choose photos for your profile, chats and memories. Only the photos you choose are uploaded.
• Microphone: to describe an activity to cAI by voice. The recording is sent to be turned into text.
• Contacts: to find friends who already use Invi. Your contacts are turned into irreversible codes on your device. Names, phone numbers and email addresses from your address book are never uploaded or stored.
• Calendar: to add activities to your calendar and check for clashes. Your calendar stays on your device and is never uploaded.
• Notifications: to tell you about invitations, messages and changes to activities.

4. How we use information, and our legal bases

• Providing the Service: creating and running your account, showing and storing activities, sending invitations and messages, and letting you plan with friends. Legal basis: our contract with you (GDPR Article 6(1)(b)).
• AI features: turning text and speech into activity suggestions. Legal basis: our contract with you (Article 6(1)(b)).
• Location, camera, microphone, contacts, calendar and notifications: only after you grant permission on your device. Legal basis: consent (Article 6(1)(a)), which you can withdraw in your device settings.
• Security, troubleshooting and abuse prevention: logging IP addresses and errors, preventing fraud and enforcing our Terms of Service. Legal basis: legitimate interests (Article 6(1)(f)) in a safe and stable service.
• Improving the Service: understanding errors and how features work. Legal basis: legitimate interests (Article 6(1)(f)).
• Meeting legal obligations, such as accounting rules or orders from authorities. Legal basis: legal obligation (Article 6(1)(c)).

We do not sell personal data, and we do not use it for targeted advertising.

5. Who we share information with

Other users see what you choose to share: your profile name and picture, activities you create or join, messages and photos in activity chats, and memories you share. Public activities may be visible to more people, depending on their visibility settings.

We use service providers that process data on our behalf (processors), only to provide the Service:

• AI services: process text and voice recordings you send to cAI, to create activity suggestions and turn speech into text.
• Storage and hosting: servers, databases, photo storage and hosting of the website.
• Maps, place search and weather: your location and the searches you make in the Service.
• Notifications and email: delivery of push notifications and email, for example to verify your email address.
• Error monitoring: technical error and crash reports, which may include a user ID, IP address and error message.
• Protection against automated abuse of forms and AI features on the website.

Our providers may only process data on our instructions and only as needed for their task. You can get an up-to-date list of our providers by contacting support@cetchapp.com.

Signing in through third-party sign-in services and paying for activities happen with those services, under their own privacy policies.

We may also disclose information when required by law, to protect the safety of users or others, or in connection with a sale or reorganisation of the business, in which case it remains subject to the terms of this policy.

6. Transfers outside the EU/EEA

Some of our providers may process data in the United States or other countries outside the EU/EEA.

Such transfers only take place with a valid transfer mechanism, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework where the provider is certified.

7. How long we keep information

• Account information and content are kept for as long as you have an account.
• When you delete your account, we immediately remove your name, email address, phone number, password, profile picture, saved addresses, sign-in links and notification tokens, and the account is blocked.
• Content you shared with others, such as activities, messages in activity chats and memories, remains so that conversations and shared activities do not disappear for the other participants. It is then shown as “Deleted user” and is no longer linked to your name or contact details.
• Technical logs and error reports are kept only for as long as needed for troubleshooting and security.
• Data may remain in backups for a limited period before it is overwritten.
• Data we are legally required to keep is retained for as long as the law requires.

8. How to delete your account and data

You can delete your account in the Invi app. You can also request deletion by emailing support@cetchapp.com from the email address linked to your account.

If you want us to delete specific information without deleting your whole account, contact us at the same address.

9. Your rights

Under data protection law, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict processing;
• object to processing based on legitimate interests;
• receive your data in a machine-readable format (data portability);
• withdraw consent at any time, without affecting processing before the withdrawal.

Send your request to support@cetchapp.com. We respond without undue delay and within 30 days at the latest.

If you believe we process personal data unlawfully, you can complain to the Norwegian Data Protection Authority, Datatilsynet (www.datatilsynet.no), or the supervisory authority where you live.

10. Security

We use technical and organisational measures to protect your data, including encrypted connections (HTTPS), encrypted password storage and restricted access to our systems. No service can guarantee complete security.

11. The website

The website does not use cookies for analytics or advertising. Your browser stores your chosen language and theme, and a draft you create with cAI on the website is kept temporarily in your browser until you close the tab.

If you create an activity with cAI on the website, the text and activity are sent to us and to our AI service provider to create the suggestion, and the draft is stored until you claim it in the app or it expires.

The map on the website loads map tiles from an external map provider, which can see your IP address.

12. Children

Invi is not intended for children under 13, and we do not knowingly collect data from children under 13. If we learn that a child under 13 has created an account, we will delete it.

13. Changes to this Privacy Policy

We update this Privacy Policy when the Service or the law changes. The date at the top shows when it was last changed. For material changes, we will let you know in the app or by email.