Legal
Privacy policy
Last updated 12 November 2026
In short
- We collect what we need to make, host and deliver your invitation, and nothing for advertising.
- Your guests' replies belong to you. We store them for you and show them only to you.
- We do not sell data, and we use no advertising or tracking cookies.
- Your invitation, files and replies are deleted after your event, as set out below.
Who we are
Luna Invitations is a trading name of XEL TECHNOLOGIES LTD, a company registered in England and Wales (company number 17024788). Our registered office is 71–75 Shelton Street, London, WC2H 9JQ, United Kingdom.
For the details of people who buy an invitation from us, we are the controller under UK and EU data protection law. For the replies your guests send through your invitation, you decide what is asked and what happens to the answers, so you are the controller and we act as your processor. Both are explained below.
Questions about privacy, or a request about your data: hello@lunainvitations.com.
If you buy an invitation
| What | Why | Legal basis |
|---|---|---|
| Your email address and order details | To send you your private editing link, help you with your order and answer your messages | Contract |
| Payment details | Taken and kept by Stripe, our payment provider. We see the amount, the date, the country and the last four digits of the card, never the full card number | Contract |
| Billing records | Kept to meet UK tax and accounting law | Legal obligation |
| What you put in your invitation: names, dates, venues, text, photos, films and music | To build your invitation and show it to the people you send the link to | Contract |
Your invitation is a public web page for anyone who has its link. Search engines are asked not to list it, but anyone you send the link to can pass it on. Please only add what you are happy for your guests to see.
If you are a guest
When you reply to an invitation, the couple or host who sent it receives your answers: your name, whether you are coming and anything else their form asks, such as a plus-one, a meal choice, dietary needs or allergies, or a message. They use your answers to plan their event. Questions about how they use them are best asked of them directly.
We store your reply on their behalf, show it only to them, and use it for nothing else. Dietary needs and allergies can reveal information about health or beliefs: you choose whether to give them, and they are only shared with the host.
Your browser keeps a random code and a copy of your reply, so that sending the form again updates your answer instead of adding a second one. To limit abuse, we keep a scrambled (hashed) form of your internet address together with the reply. It cannot be turned back into the address.
If you would like a reply removed, ask the host, who can delete it. You can also write to us.
When you visit the site
Our hosting provider, Cloudflare, sees technical details of every visit, such as your internet address, browser and the page you asked for, so it can deliver the page and protect the site from attacks. We do not use these details to identify you. Our legal basis is our legitimate interest in running a secure site.
Counting visits
To know how many people visit, which designs they look at and how many go on to buy, our server makes a simple count of page visits, including visits to published invitations. It records the page, the time, the country (worked out by Cloudflare from your internet address), the kind of device (phone, tablet or computer) and the site or campaign that sent you here. On our own pages it also notes how far down a page you scroll, how long the page is open and which of our buttons you press, and groups the pages you open within half an hour into one visit.
To count each person once a day without a cookie, it scrambles your internet address and browser details with a secret that changes every day. The code that results cannot be traced back to you, cannot be linked from one day to the next, and your internet address itself is not stored. This uses no cookies and nothing in your browser. These counts are kept for up to two years. Our legal basis is our legitimate interest in understanding how the site is used so we can improve it.
Cookies and browser storage
We set no advertising, analytics or tracking cookies, so there is nothing to accept or decline. The site keeps a few items in your browser's own storage, only to make it work:
- Your private editing key, so the editor opens again from a bookmark.
- A guest's reply code and a copy of their reply, as described above.
- A note that you have already seen the site's opening animation, so it does not play again on your next visit.
- When you try a design before buying, the details and pictures you add stay in your own browser and are not sent to us.
Cloudflare may set a strictly necessary security cookie to tell people from automated traffic. You can clear all of these at any time in your browser's settings.
Who we share data with
We use a small number of providers who process data for us under written agreements. We do not sell data or share it with anyone for their own marketing.
- Cloudflare, Inc.: hosting, the database and file storage for invitations, uploads and replies.
- Stripe: payments, fraud prevention and receipts. Stripe is also a controller of payment data under its own privacy policy.
We may also share data where the law requires it, or to protect our rights or someone's safety.
International transfers
Our providers run services in many countries, including the United States. Where data leaves the UK or the European Economic Area, it is protected by the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, or by the UK–US data bridge and EU–US Data Privacy Framework where the provider takes part in them.
How long we keep it
- Your guest link closes 30 days after your event date.
- Your invitation, uploaded files and guests' replies are deleted 90 days after your event date, or sooner if you ask us. Please download your replies before then.
- An invitation you never publish is deleted a year after you last change it.
- Your email address and order details are kept for as long as we hold your invitation, and for up to two years after that so we can help with any question about your order.
- Billing records are kept for six years after the end of the tax year, as UK law requires.
- Replies you delete in your private page are deleted straight away.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to limit what we do with it, to object to our use of it, or to receive it in a portable form. Write to hello@lunainvitations.com and we will reply within one month. If you are a guest, we will pass a request about a reply to the host it was sent to, and help them answer it.
If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner's Office at ico.org.uk, or to the data protection authority in the country where you live. We would be grateful for the chance to put things right first.
Security
Everything is sent over an encrypted connection. Your editing key is never stored on our side, only a one-way scrambled form of it, so a copy of our database could not open your editor. Uploaded files sit behind long random addresses. No system is perfectly secure, and if we ever learn of a breach that puts your data at risk we will tell you and the regulator as the law requires.
Children
Invitations are bought by adults. We do not knowingly collect data from children, except where a host adds a child's name to their own invitation or a guest replies on behalf of their family.
Changes
If we change this policy we will update the date at the top. If a change matters to how we use your data, we will tell customers by email before it takes effect.