Privacy Policy

Last updated: 2 November 2026

Your privacy and the privacy of your Guests matter to us. This Privacy Policy explains, in plain language, what personal data Art Grafy (“we”, “us”, “our”) collects, why we collect it, who we share it with, how long we keep it, how we protect it and what rights you have. We process personal data in line with the Digital Personal Data Protection Act, 2023 and the rules made under it, the Information Technology Act, 2000 and other applicable laws.

By using the Website, placing an order, sending us your details or replying to an Invitation, you confirm that you have read this Privacy Policy. Where we rely on your consent, you give it by ticking the consent box at checkout, by sending us your details, or by submitting a form, and you can withdraw it at any time as explained in Part F.

Contents

About this policy
What we collect
How we use your information
Sharing your information
Security and retention
Your rights and choices
Cookies and browser storage
Other information

Part A. About this policy

1. What this policy covers

This policy applies to personal data we process when you:

visit www.artgrafy.com or any of its subdomains (“the Website”);
order or enquire about a digital invitation, Save the Date or custom invitation website, whether on the Website, on WhatsApp, by email, by phone or in person;
open an Invitation we host, or send an RSVP, blessing or message through it; or
contact us for any reason.

It should be read together with our Terms & Conditions and Refund & Cancellation Policy. Words such as Invitation, Host, Guest, Manage link and Event date have the meaning given in our Terms.

2. Who we are

Art Grafy, Ahmedabad, Gujarat, India. Email: hiartgrafy@gmail.com · Phone / WhatsApp: +91 9875083317.

3. Our role

For the personal data of Hosts, Website visitors and people who contact us, we are the “Data Fiduciary”: we decide why and how that data is processed.
For the personal data of Guests (RSVPs, blessings and messages), the Host decides who is invited and why the replies are collected. We process that data to provide the Invitation and the RSVP service to the Host. Guests can contact either the Host or us about their data.
For details about family members and other people that a Host includes on an Invitation (for example parents’ and grandparents’ names), the Host is responsible for having their agreement, and we use those details only to make the Invitation.

Part B. What we collect

4. Information you give us when you order

Contact details: your name, WhatsApp or phone number and email address.
Order details: the design, plan and add ons you choose, your quotation and the price paid.
Your consent record: when you tick the consent box at checkout, we record the date, time and IP address of your acceptance, so that we can show what you agreed to.

5. Information about your event

To create your Invitation you send us details such as:

the names of the couple, family members and hosts, and wording in any language;
event names, dates, times, venues, addresses and map locations;
photos, videos and music, and your love story or other personal text you choose to include;
dress codes, travel, accommodation or contact information you want Guests to see.

We do not ask for sensitive information. Please note, however, that names, ceremonies and wording can sometimes show a family’s religion, community or region. We use this information only to design and host your Invitation, and we do not use it to profile you.

6. Payment information

We receive the payment status, amount, currency, date, and references such as a Razorpay payment ID, UPI transaction reference (UTR) or bank transfer reference, and any screenshot of the payment you send us.
Card numbers, CVV, UPI PIN, OTPs and bank login details go directly to our payment partner or your bank. We never see or store them.

7. Guest information

When a Guest replies through an Invitation, we collect the information they enter in the RSVP form, which is usually:

name;
phone number (where the form asks for it);
whether they will attend, and the number of people attending;
a blessing or message for the couple.

For some Custom Invitations, RSVP replies are sent to a Google Sheet set up for the Host instead of, or as well as, our own system.

8. When you contact us

When you use our contact form, message us on WhatsApp, email or call us, we keep your name, phone number, email address, your message and our reply, so that we can help you and have a record of what was agreed.

9. Information collected automatically

When anyone visits the Website or opens an Invitation, some information is collected automatically:

Visitor statistics: we use our own simple visitor counter, not Google Analytics or advertising trackers. For each page view it records the page address, the date and time, the website or campaign that sent you (for example Google, Instagram or WhatsApp), your device type (mobile, tablet or desktop), browser and operating system, and your country. The country is worked out from your IP address at the moment of the visit, and the IP address itself is not stored in these statistics. A random code saved in your browser lets us count returning visitors without knowing who you are.
Server and security logs: like every website, our servers and hosting providers may briefly log technical data such as IP address, browser type, date and time and the page requested, to keep the Website working and secure and to prevent abuse.
Preferences: the currency and language you choose are saved in your browser so the Website remembers them. To suggest a currency on your first visit, your browser’s time zone and language setting are checked inside your browser; they are not sent to us.

Visits by our own team while signed in to the admin area are not counted, and automated bots are filtered out.

10. Information from other people

A family member, friend or wedding planner may place an order for you and send us your details.
A Host gives us the names and details of family members to show on the Invitation.
Our payment partner tells us whether a payment succeeded.

Whoever sends us someone else’s details confirms that they have that person’s agreement to do so.

Part C. How we use your information

11. Why we use personal data

To create, design, host, update and deliver your Invitation, and to provide the RSVP service and your Manage link.
To process payments, issue invoices and keep accounting and tax records.
To contact you about your order, send you previews and links, and answer your questions by WhatsApp, phone or email.
To keep a record of your instructions, approvals and acceptance of our Terms, and to resolve complaints, payment disputes and chargebacks.
To keep the Website and Invitations secure, and to detect and prevent fraud, spam and misuse.
To understand, in total, how many people visit which pages and where they come from, so that we can improve the Website.
To show finished Invitations as samples and reuse our designs as templates, as explained in section 14.
To send you occasional offers or updates, only if you agree (section 15).
To meet legal obligations and respond to lawful requests from authorities.

12. Our legal basis

We process personal data:

with your consent, for example when you place an order, send us your details, submit an RSVP or contact form, or agree to receive offers;
for the specified purpose for which you voluntarily gave it to us, for example your phone number to send you your Invitation, as allowed by section 7 of the Digital Personal Data Protection Act, 2023;
to comply with legal obligations, such as tax and accounting laws, or a court or government order; and
for other legitimate uses allowed by law, such as preventing fraud and keeping the service secure.

13. Things we never do

We never sell or rent personal data to anyone.
We do not use advertising cookies or build advertising profiles of you or your Guests.
We do not use Guest data to contact Guests for our own marketing.
We do not make decisions about you based only on automated processing.

14. Showcasing Invitations as samples

The Invitations we make are our designs, and we may reuse or adapt the design made for you as a template for other customers. To show future customers our work, we may also display your finished Invitation as a sample or live demo on our Website, in our design catalogue and on our social media pages.

What may be shown: the Invitation as designed, including the names, event dates, venues, wording, photos and music that appear on it.
What is never shown: your phone number, email address, payment details, your private Manage link, or your Guests’ RSVP replies and messages.
Children: we do not show photos of children in samples without the specific permission of their parent or guardian.
Your choice: by placing an order you consent to this use. You can withdraw that consent at any time by messaging us on WhatsApp at +91 9875083317 or emailing hiartgrafy@gmail.com. Within 7 days we will remove your Invitation from our samples or replace your names, photos and details with sample content. Withdrawing does not affect your own Invitation.

15. Offers and updates

We will only send you offers, discounts or news if you agree. Every such message lets you opt out, or you can simply reply “STOP” on WhatsApp or email us. Messages about your own order are not marketing and will still be sent while your order is active.

Part D. Sharing your information

16. Service providers

We share personal data only with trusted providers who help us run the Service, only as much as they need, and under appropriate confidentiality and security obligations:

Payment: our payment partner (Razorpay) and banks, to process payments and refunds.
Hosting and storage: our website hosting, database, file storage and backup providers, which store the Website, Invitations, photos and order data.
Communication: WhatsApp (Meta), email and phone providers, when we communicate with you through them.
Google services: Google Maps (to show venues and directions), Google Fonts (to display text), Google Sheets (for some Custom Invitation RSVPs) and Google Translate (only if you choose a language from the language menu, in which case the page text is sent to Google for translation).
Design tools: professional design software and, in some cases, AI assisted tools used to prepare illustrations or edit images. We send only the content needed for your design.

Our currency exchange rate service receives no personal data. These providers have their own privacy policies, and we choose providers that follow good security practices.

17. Legal requirements and protection

We may disclose personal data if required by law, a court order or a lawful request from a government or law enforcement agency, or if we believe in good faith that it is necessary to prevent fraud, protect the safety of any person, or protect our rights, including in a payment dispute or chargeback where we share order, approval and delivery records with the bank or payment partner.

18. Business changes

If our business is sold, merged or transferred, personal data may be transferred to the new owner, who will be bound by this Privacy Policy or one that protects you at least as well.

19. Who can see your Invitation

Invitation pages are hidden from search engines, but anyone who has the link can open it, together with the photos, music and details shown on it. Please share the link only with your Guests, and remember that Guests can forward it.
Blessings and messages may appear on a public wishes wall on the Invitation. Hosts can hide any message at any time.
RSVP details (names, phone numbers, attendance and counts) are shown only to the Host through the private Manage link, or in the Host’s Google Sheet, and to our team for support.
Invitations shown as samples (section 14) are also visible from our Website.

20. Data stored or processed outside India

Some of our service providers (for example cloud hosting, email, Google and WhatsApp) may store or process data on servers outside India. Such transfers are made only to countries not restricted by the Government of India, and with providers that protect the data. If you are outside India, your data will be transferred to and processed in India.

Part E. Security and retention

21. How we protect your data

HTTPS encryption for the Website and Invitations.
Private, hard to guess Manage links for each order, and password protected admin access limited to our team.
Secure, signed session cookies, protection against form forgery, and limits on repeated requests.
Passwords stored only in encrypted (hashed) form.
Regular backups and access only on a need to know basis.

No online service can be 100% secure. Please keep your Manage link private, and tell us immediately if you think someone else has it so we can issue a new one.

22. Data breaches

If a personal data breach happens, we will act quickly to contain it, and we will inform the people affected and the Data Protection Board of India, and any other authority, as required by law.

23. How long we keep data

Invitations, photos, event details and RSVPs: while your Invitation is online, which is at least 12 months after your Event date, and then deleted, unless you ask us to delete them earlier or extend hosting.
Invitations used as samples: until you ask us to remove your details.
Order, consent and communication records: for as long as needed to provide the Service and handle any question, complaint or dispute, normally up to 3 years after your order.
Payment and invoice records: for as long as tax and accounting laws require, usually up to 8 years.
Contact form messages: up to 2 years, unless they become part of an order.
Visitor statistics: kept only in a form that does not identify you, for as long as useful for understanding Website traffic.
Server logs: for a short period, normally not more than 90 days, unless needed to investigate a security issue.

We may keep data longer if the law requires it, or if it is needed for a legal claim or investigation. When data is no longer needed, we delete it or make it anonymous.

Part F. Your rights and choices

24. Your rights

Subject to the law, you have the right to:

Access: get a summary of the personal data we hold about you and how we use it, and the names of those we have shared it with;
Correction and update: have inaccurate or incomplete data corrected, completed or updated;
Erasure: have your data deleted when it is no longer needed, or when you withdraw consent, unless we must keep it by law;
Withdraw consent: at any time, as easily as you gave it. Withdrawal does not affect processing already done, and if you withdraw consent needed for an active order, we may not be able to complete it;
Grievance redressal: complain to us and get a response (section 31);
Nominate: name another person to exercise your rights if you die or become unable to do so.

25. How to make a request

Email hiartgrafy@gmail.com or message us on WhatsApp at +91 9875083317 from the number or email you used with us, and tell us what you would like us to do. To protect your data we may ask you to confirm your identity first. We will respond as soon as possible and in any case within 30 days, or within any shorter time required by law. There is no charge for a reasonable request.

26. Guests

If you replied to an Invitation and want your RSVP or message corrected, hidden or deleted, you can ask the Host or contact us directly. We will remove it, and let the Host know where appropriate. Please note that a Host may already have downloaded a copy of their RSVP list, which is then under the Host’s control.

27. Children

Our Service is meant for adults, and only people aged 18 or over may place an order or send us personal data. Invitations may include children’s names or photos (for example for a naming ceremony or a family photo) only when provided by their parent or guardian, who gives consent on the child’s behalf. We do not track children or show them advertising, and we do not use children’s photos in samples without their parent’s or guardian’s specific permission. If you believe a child has sent us personal data, please contact us and we will delete it.

Part G. Cookies and browser storage

28. What we use

We use only the small number of cookies and browser storage items needed for the Website to work and to count visits. We do not use advertising or cross site tracking cookies.

sid (cookie, essential): keeps your session working, protects our forms against forgery and shows you messages after you submit a form. It lasts up to 7 days.
_av (browser storage): a random code used to count returning visitors. It does not contain your name or contact details.
_as, _ar, _au (browser storage, current visit only): a random visit code and the website or campaign that sent you, used for visitor statistics. They are removed when you close the browser tab.
site_currency (browser storage): remembers the currency you chose.
googtrans (cookie, set only if you use the language menu): remembers your chosen language for Google Translate. Google may also set its own cookies under its policies.

Our payment partner may set its own cookies on the payment window to process payments securely and prevent fraud.

29. Your choices

You can delete or block cookies and browser storage in your browser settings. If you block the essential sid cookie, forms such as checkout and RSVP may not work. Blocking the visitor statistics storage does not affect how the Website works.

Part H. Other information

30. Links to other websites

The Website and Invitations contain links to other websites and apps, such as Google Maps, WhatsApp and social media. Their privacy practices are their own, and we are not responsible for them. Please read their privacy policies.

31. Complaints and Grievance Officer

If you have any question or complaint about how we handle personal data, please contact our Grievance Officer:

Art Grafy, Ahmedabad, Gujarat, India
Email: hiartgrafy@gmail.com
Phone / WhatsApp: +91 9875083317

We will acknowledge your complaint within 48 hours and aim to resolve it within one month, or within any shorter time required by law. If you are not satisfied with our response, you may complain to the Data Protection Board of India. We ask that you contact us first so that we have the chance to put things right.

32. Changes to this policy

We may update this Privacy Policy when our Service or the law changes. The latest version is always published on this page with its “last updated” date. If we make an important change that affects how we use your data, we will also tell customers with an active order by WhatsApp or email where reasonably possible.

33. Contact

For any privacy question or request, contact us at hiartgrafy@gmail.com or on WhatsApp at +91 9875083317. Please include your order number if you have one.