The data controller for your personal data is ByInvite, the operator of the ByInvite platform. ByInvite is operated by BYINVITE TECHNOLOGIES LTD, a private limited company registered in England and Wales (company number 17458257), with its registered office at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.

If you have any questions about how we handle your personal data or wish to exercise your rights, you can contact us at: [email protected]

When you use our Platform, we may collect the following data:

Data you provide directly

- First and last name
- Email address
- Links to your social media profiles (e.g. Instagram, LinkedIn)
- A short personal introduction or message
- Any additional information you choose to share through our request forms
- Profile details you add to your account: photographs, profession, city, interests and a short bio
- Messages you exchange with other members and with our concierge through the Platform
- Discussions and replies you post at a venue or on an event, visible to the audience you chose (members of that venue, or the ByInvite network) and attributed to you
- Proof of club membership you submit for verification (for example a membership card or confirmation), reviewed by our team
- The name and email address of a person you choose to invite or refer to the network
- Ideas, feedback and issue reports you send us

This data is collected when you create an account, submit an invitation request, an access request, or any other form on our Platform.

Data collected automatically

- IP address
- Browser type and version
- Operating system
- Pages visited and time spent
- Referring URL
- In the mobile app: a device push-notification token (when you allow notifications), crash and error reports, and the days on which you use the app
- Location data, only as described in the “Location & arriving at a venue” section below

This technical data is collected via server logs and, where applicable, cookies.

We use your personal data for the following purposes:

- Reviewing and assessing your invitation or access requests
- Facilitating introductions between guests and members
- Communicating with you about your account and requests
- Managing your account on the Platform
- Processing payments for coordination fees
- Improving and developing our Platform and services
- Ensuring the security and integrity of our Platform
- Complying with our legal obligations

Your data is never sold to third parties.

We process your personal data on the following legal bases:

Consent (Art. 6(1)(a) GDPR): when you submit a request form or opt in to communications from us.

Performance of a contract (Art. 6(1)(b) GDPR): when processing is necessary to provide our coordination services to you, including managing your account and processing payments.

Legitimate interest (Art. 6(1)(f) GDPR): when processing is necessary for our legitimate interests, such as improving our services, maintaining Platform security, and reviewing requests to maintain the quality of our network.

Legal obligation (Art. 6(1)(c) GDPR): when we are required by law to process your data.

ByInvite is a private, invitation-only network. As part of our curation process, requests submitted through our Platform may be reviewed manually by our team.

This review may include verifying your personal information, social media profiles, and introduction message to assess the suitability of your request for our network.

This review is carried out on the basis of our legitimate interest in maintaining the quality, safety, and curated nature of our community.

Participation signals. To keep the network healthy, we also keep an internal record of participation on the Platform — for example events hosted and attended, guests welcomed, and referrals. These signals may influence the order in which suggestions appear and the quiet recognition marks shown on profiles. They are never published as a score, never shared with other members, and no decision producing legal or similarly significant effects is taken automatically. This processing rests on the same legitimate interest.

With your permission, the mobile app uses your device’s location for three purposes only.

Finding what is near you. Your current position is used to sort venues, events and plans by distance and to place you on the map. Only your most recent approximate position (rounded to roughly 100 metres) is stored, for at most 30 days; we keep no history of your movements.

Presence at venues (optional, off by default). If you turn on “Presence at venues” in Settings, then while you use the app at a venue it may tell our servers which venue you are at (the venue’s identifier and how precise the fix was — never your coordinates). Other members who are at the same venue at the same time, and who have also turned this on, can then see that you are around; you can see them on the same terms. Nobody elsewhere can see this, the venue cannot, and it is never sent as a notification to anyone. It lapses shortly after you leave or stop using the app, you can hide yourself for a visit or exclude a venue at any time, and the record is deleted within 48 hours. We rely on your consent for this, which you can withdraw in Settings.

Greeting you when you arrive. If you grant “Always” location access, the app registers the venues you belong to with your device’s operating system. When your device detects that you have arrived at one of them, the app may show you a private greeting. Only the venue’s identifier is sent to our servers — never your coordinates in the background.

What we never do: your position is never shown to other members, never used to tell anyone else where you are, and never used to build a record of the places you visit. The anonymous activity shown for a venue (“a lively evening”, member counts) is computed from members who opened the app there recently and from what members choose to share; it never names anyone, and is only shown once several people are present.

You can withdraw location access at any time in your device settings; the rest of the app works without it.

ByInvite is for adults. You must be at least 18 years old to create an account, and we do not knowingly collect personal data from anyone under 18. If we learn that data of a minor has been collected, we delete it.

Between users: if an introduction is confirmed, certain information about you (such as your first name and introduction message) may be shared with the relevant member to facilitate hosting. Similarly, the member may share certain information with you. Your data is never made public or shared broadly.

Service providers: we use third-party service providers to operate our Platform, including:
- Google Firebase (account authentication and secure file storage; Google LLC, which may process data in the United States)
- Google Analytics (aggregated website usage statistics; website only)
- Google Places (address lookup when a venue is added)
- Expo (delivery of push notifications to your device)
- Sentry (crash and error reporting, so we can fix problems)
- An AI language-model provider that powers our concierge chat: messages you send to the concierge are processed to generate its replies, and are not used by the provider to train its models
- Tally (form collection)
- Hosting, infrastructure and email service providers

These providers only access your data to the extent necessary to perform their services and are contractually required to protect it. Where a provider processes data outside the UK or EEA, the transfer is covered by standard contractual clauses or an adequacy decision.

Legal obligations: we may be required to disclose your personal data where the law requires us to do so, including in response to a court order or regulatory request.

Your data is never sold to third parties.

We retain your personal data only for as long as necessary for the purposes for which it was collected:

- Account data: retained for the duration of your active account, then deleted within 12 months of account closure, unless we are legally required to retain it longer.
- Declined requests: data relating to unsuccessful requests is deleted within 6 months of the decision.
- Payment data: retained in accordance with applicable accounting and tax obligations (generally up to 10 years).
- Server logs: automatically deleted after 90 days.
- Contact form data: deleted within 6 months of closing the enquiry.
- Messages and photos: retained while your account is active and removed with it; a message you delete is hidden from the conversation immediately.
- Discussions: kept while your account is active; a post or reply you delete is hidden immediately and its text is erased after 30 days, which we keep only to review reports. Never shown on the public web.
- Location: only your most recent approximate position is held, for at most 30 days (see “Location & arriving at a venue”); no movement history is kept. Presence-at-venue records are deleted within 48 hours of lapsing.
- Push notification tokens: removed automatically after 60 days of inactivity.
- App usage days: retained for up to two years, then deleted.

We take reasonable technical and organisational measures to protect your personal data against loss, unauthorised access, disclosure, alteration, or destruction.

These measures include encryption of data in transit, access controls, and firewalls. However, no method of transmission over the Internet or electronic storage is completely secure.

You should treat your login information confidentially and close your session when you are finished.

Our Platform may use essential cookies that are necessary for the site to function properly (e.g. session management and authentication).

We do not use advertising tracking cookies. If we introduce analytics cookies in the future, we will update this policy and seek your consent where required.

You can configure your browser to refuse cookies, but this may affect the functionality of the Platform.

Your data is primarily processed on servers located in the United Kingdom and the European Economic Area (EEA).

Where data is transferred outside the UK or EEA (for example, via our service providers), we ensure that appropriate safeguards are in place, including standard contractual clauses or adequacy decisions.

Under the GDPR and applicable data protection law, you have the following rights:

- Right of access: to obtain confirmation that your data is being processed and to access it.
- Right to rectification: to have inaccurate or incomplete data corrected.
- Right to erasure: to request deletion of your data, subject to our legal obligations.
- Right to restriction: to request restriction of processing in certain circumstances.
- Right to object: to object to the processing of your data, including for direct marketing purposes.
- Right to data portability: to receive your data in a structured, machine-readable format.
- Right to withdraw consent: at any time, where processing is based on consent.

To exercise any of these rights, please contact us at: [email protected]

We will respond to your request within one month. You also have the right to lodge a complaint with a supervisory authority:

- United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk
- France: Commission Nationale de l'Informatique et des Libertés (CNIL) — cnil.fr

We may update this privacy policy from time to time. Any changes will be posted on this page. If significant changes are made, we will notify you by email or through our Platform.

We encourage you to review this page regularly to stay informed about how we protect your data.

If you have any questions about this privacy policy or how we handle your personal data, please contact us:

Email: [email protected]