Privacy Policy
Updated: 18 October 2026
1. Data Controller & Scope
Imbitasyon Ko is operated by Web Lifestyle studio (operations manager: 鐙谷 直貴), located in Tokyo, Japan (2-11-15-105 Funabashi, Setagaya-ku, Tokyo 156-0055, Japan). Web Lifestyle studio is the Personal Information Controller for personal data processed through Imbitasyon Ko. This policy explains what personal data we collect, how we use it, and your rights. Although we are based outside the Philippines, we offer this service to people in the Philippines and we comply with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). As a business based in Japan, we also comply with Japan's Act on the Protection of Personal Information (Act No. 57 of 2003, "APPI"). Contact: support@imbitasyonko.com.
1a. Data Protection Officer
As required by the Implementing Rules of the DPA, 鐙谷 直貴 is designated as our Data Protection Officer (DPO) and is accountable for our compliance. You can reach the DPO at support@imbitasyonko.com (subject line: "DPO"). The DPO handles data subject requests, privacy complaints, and coordination with the NPC.
2. Personal Data We Collect
Account data (name, email, login IDs such as your Google account ID); invitation content you create (names of the couple/family, event details, photos, love story, gift account information); guest data you provide (names and contacts, including phone numbers for SMS/Viber/WhatsApp invitations, RSVP responses, guest wishes, and open/view records); usage data (IP address, device/browser type, pages viewed); cookies; payment data (card payments processed by Stripe, charged in PHP; GCash payments processed by KOMOJU, charged in JPY — we do not store full card details).
3. Legal Basis for Processing (Data Privacy Act)
We process personal information based on: performance of a contract; consent (e.g. RSVP/wishes, which can be withdrawn at any time); our legitimate interests (security, service improvement, abuse prevention); and compliance with a legal obligation. Some of what an invitation necessarily reveals — marital status, and religious affiliation where you choose religious content such as a Nuptial Mass — is sensitive personal information under Section 3(l) of the DPA. We process it only with your consent, given when you enter that content and publish your invitation, and you can withdraw it by removing the content or deleting the invitation.
4. How We Use Data
To provide the service and display your invitation to guests; to process RSVPs/wishes and show statistics; to send transactional emails (login codes, receipts, notifications); to maintain, secure, and improve the service; to prevent fraud and comply with the law. We do not sell your data and do not send irrelevant marketing without your consent.
5. Data Sharing & Third-Party Processors
We do not sell data. We only share it with the providers that operate Imbitasyon Ko: • Cloudflare (hosting & compute, CDN/DNS/security) • Neon (database, Singapore) • Cloudflare R2 (image storage) • Stripe (card payments) • KOMOJU (GCash payments) • Cloudflare Email Service (email) • PostHog (analytics) • Sentry (error monitoring) • Google (sign-in/login) • Anthropic (optional AI assistance) Each provider processes data according to our instructions and its own security obligations.
6. International Data Transfers
Because the providers above operate outside the Philippines (e.g. Singapore, Japan, and the United States), your personal data is transferred to and stored abroad. Where required by the Data Privacy Act, we rely on consent and/or contractual safeguards and choose providers that maintain an adequate level of protection for cross-border data transfers.
7. Data Retention
We keep personal data only as long as it is needed for the purpose it was collected for. Invitations: none of our current plans (Free, Standard, Premium) has an expiry date. An invitation and everything attached to it — guest lists, RSVPs, wishes, and uploaded photos — stay online and are kept as a keepsake until you delete the invitation or your account. When you delete an invitation, all of this is permanently deleted, including from our image storage. Invitations with an expiry date: if an invitation is ever given an expiry date (for example, under a time-limited plan or offer), we will send you a reminder 7 days before it expires, and 90 days after the expiry date the invitation and everything attached to it will be permanently deleted, including from our image storage. Account data is kept while your account exists. You can delete your account and all your data at any time through your account settings. Guest data is deleted when the related invitation or account is deleted, or earlier on request (see sections 8 and 9).
8. Your Rights
Under the Data Privacy Act you have the rights to be informed, to access and obtain a copy of your data, to correct inaccurate data, to erasure or blocking, to object to certain processing, to data portability, to withdraw consent at any time, and to be indemnified for damages caused by inaccurate, false, unlawfully obtained, or unauthorised use of your data. Use your account settings or contact support@imbitasyonko.com; we respond within 30 days and will tell you sooner if a request needs longer. You also have the right to lodge a complaint with the National Privacy Commission (NPC).
9. Notice for Guests
If you are a guest, the couple provides your data to create and send their invitation; the couple is responsible for having a lawful basis to share it. You can request access, correction, or deletion by contacting the couple directly or support@imbitasyonko.com, and we will assist or forward your request.
10. Security & Breach Notification
We apply reasonable technical and organizational measures (encryption in transit, access controls, server-side authorization so data can only be accessed by its owner). No method is 100% secure. If a personal data breach occurs that involves sensitive personal information or information that may enable identity fraud, and it is likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and the affected data subjects within 72 hours of knowledge of, or reasonable belief in, the breach, and submit the full report as required by NPC Circular 16-03.
11. Children
This service is intended for adults (18+) who are legally capable of entering into a contract. It is not intended for children, and we do not knowingly collect children's data.
12. Cookies
We use essential cookies for authentication (to keep you signed in), a functional cookie that lets a guest who replied through a general invitation link update that same reply later (it holds an opaque key, lasts up to one year, and is sent only to our RSVP endpoint), and analytics cookies to understand usage and improve the service. You can manage cookies through your browser; disabling essential cookies may interfere with signing in.
13. Gift Information (Cash Gifts)
Imbitasyon Ko only displays the bank account/e-wallet (e.g. GCash)/QR information or shipping address entered by the couple. We do not receive, store, process, or disburse funds, and we are not a payment processor. Gift transactions occur directly between the guest and the couple. See the Terms & Conditions.
14. Changes to This Policy
We may update this policy. Material changes will be indicated by updating the effective date and, where necessary, through a notice within the service.
15. Contact
Web Lifestyle studio — Operations manager: 鐙谷 直貴. Address: 2-11-15-105 Funabashi, Setagaya-ku, Tokyo 156-0055, Japan. For privacy questions or to exercise your rights: support@imbitasyonko.com.