Privacy Policy

Last updated 28 August 2026

RSVP List is in beta. This policy is written in plain language and covers how we handle personal information under the Philippines' Data Privacy Act of 2012 (RA 10173). If anything here is unclear, email us and we'll explain.

Who we are

"RSVP List" ("we", "us") is a small tool operated by Ericka Mae that gives couples one private page for collecting wedding RSVPs. You can reach us at hello@misserickamae.com for anything about your data.

Who controls the guest data

When a couple creates an event and adds their guest list, the couple is the personal information controller for that guest data — they decide who is on the list and why. RSVP List acts as their processor: we store and organize the information so the couple can collect RSVPs, and we don't use it for our own purposes.

If you're a guest and want your information changed or removed, the fastest route is to ask the couple directly. You can also email us and we'll help.

What we collect

From organizers: your account email address, your password (stored hashed, never in plain text), and the wedding details you enter — names, date, location, theme, custom questions, and your guest list.
From guests: the name you enter to find your invitation, and — when you RSVP — your response (attending or not), any plus-one name, your email address, your mobile number, answers to the couple's custom questions, and any note you choose to leave.
Find My Table (if the couple turns it on): the name you type on the day is checked against the guest list to show you your table number and your household's table numbers. The name is not stored with that lookup. If a name has no table assigned, we show the same neutral message either way — the page does not reveal whether a name is on the guest list.
Automatically: basic technical data needed to run the service (e.g. IP address for rate-limiting and abuse prevention, and standard server logs from our hosting providers).

Why we use it

To show a guest their invitation and record their RSVP for the couple.
To send a confirmation email after a guest responds.
To let the couple see and export their responses.
To keep the service secure (rate-limiting, preventing guest-list scraping and email abuse).
To process payment if an organizer upgrades to a paid plan.

The legal basis is the consent you give when you submit the RSVP form, together with the legitimate interest of the couple in organizing their own wedding.

Who we share it with

We do not sell personal information. We share it only with:

The couple whose event you responded to.
Service providers that run the product on our behalf: Supabase (database and authentication hosting), Resend (sending confirmation email), Vercel (website hosting), and HitPay (payment processing, for paid plans only). Each processes data only to provide their service to us.
Authorities, if we are legally required to.

How long we keep it

Guest and event data is kept for as long as the couple's event exists. When an organizer deletes their event or account, the associated households, guests, submissions and responses are deleted with it. Rate-limiting records are short-lived and cleared automatically. Server logs held by our providers follow their own retention periods.

How we protect it

Data is transmitted over HTTPS. Access to each couple's data is enforced at the database level (row-level security) so one organizer can never see another's guest list, and guests never get direct access to the database — only to narrowly-scoped lookups for the specific event link they were given.

Your rights

Under the Data Privacy Act you may:

ask what personal information we hold about you and get a copy;
correct information that is wrong;
ask us to delete or block your information;
object to processing;
lodge a complaint with the National Privacy Commission (privacy.gov.ph).

To exercise any of these, email hello@misserickamae.com.

Children

RSVP List is not directed at children. A child may appear on a guest list as a named attendee; that information is provided and controlled by the couple, not collected from the child.

Changes

If this policy changes we'll update the date above. Significant changes affecting how we use existing data will be communicated to account holders by email.