A clear, honest privacy policy.
Utsawa is a place to build a trilingual celebration site and collect RSVPs. This page explains what we collect, how we use it, and the choices you have. It is a launch draft written in plain language, not legal advice.
What we collect
We keep collection to what the service actually needs.
Your name and email address when you sign up. This is how you log in and how we reach you about your site.
Everything the host enters to build the site - event names, dates, venues, timezones, stories, and media - in English, Sinhala and Tamil.
The names, contact details, households and language preferences a host adds to their guest list so invitations can be sent.
The replies guests submit through their per-household magic link, including attendance, headcount and any notes or meal choices.
Basic, aggregate usage signals that help us keep the service running. We do not build advertising profiles and we do not sell data.
How it is used
We use your information to run the service you asked for: to publish and host your celebration site, to send invitations and reminders to the guests you choose, to record RSVP responses, and to support day-of check-in. We also use account details to contact you about your site and billing. We do not use guest data for advertising, and we do not sell it.
Guest data and who controls it
The host is the controller of their guest data - they decide who is invited and what is entered. Utsawa is the processor: we store and handle that data on the host's behalf and only to run the service. Guests reply through a per-household magic link, so there is no guest login and no guest account to manage. If a guest has a question about their data, the host running the event is the first point of contact, and we will help them act on it.
Storage and security
Data is stored with Supabase using row-level tenant isolation, so one event's data is separated from another's. Traffic is encrypted in transit. No system is perfectly secure, but we aim to keep the surface small: least-privilege access, isolation between tenants, and third parties chosen for their own security posture.
Retention and deletion
We keep your event and guest data for as long as your account is active so your site keeps working through and beyond your date. A host can request deletion of their event and its guest data at any time by emailing us, and we will remove it from our active systems. Backups age out on their normal cycle. Some records tied to completed payments may be retained where we are required to keep them.
Third parties we rely on
We use a small set of trusted providers to deliver the service. Each receives only the data needed for its job.
Database, authentication and file storage, with row-level tenant isolation between events.
Delivery of invitation and reminder emails to guests and account emails to you.
Object storage for photos and other media uploaded to a celebration site.
One-time billing as merchant of record. Card details are handled by Dodo, not stored by us.
Cookies
We use a small number of functional cookies. An authentication session cookie keeps you logged in to your dashboard. A site-unlock cookie remembers when a guest has entered the password for a protected site so they are not asked again on every page. We do not use advertising cookies.
Contact
Questions about privacy, or a request to delete an event and its guest data, can be sent to hello@utsawa.com. We will do our best to respond quickly.
This is a launch draft to explain our practices in good faith. It is not legal advice, and we will update it as Utsawa grows.