Privacy policy

1. Scope

This policy applies to services provided directly by Xitang. Third-party websites, apps, payment, map, sign-in and sharing services process information under their own privacy policies. This policy does not govern those independent activities.

2. Information we collect and use

Account registration and sign-in: when you authorize a third-party account, such as WeChat, we may receive its account identifier, nickname and avatar to create an account, identify you and display your profile. Declining authorization prevents use of features requiring that sign-in but generally does not prevent browsing public content. On this international website, email addresses and verification codes are used for email sign-in.

Creating, publishing and sharing invitations: we process content you provide, such as names, forms of address, photographs, dates, venues, messages and contact information, to save drafts, generate and display invitations, and provide navigation or sharing. Photographs, precise addresses and contact details may be sensitive personal information. Provide them only when necessary and obtain consent before submitting another person’s information.

Responses, interactions and event statistics: when you submit an RSVP, interact or visit a public event page, we may collect the information you submit, event identifiers, visit times, referring pages, interaction records, network addresses and necessary device information. We use this to provide responses and aggregate statistics to event organizers, secure the service and investigate issues. Organizers may see responses and aggregate results for their events.

Support: when you contact us, we may collect contact details, account information, communication records, descriptions of the issue and evidence you voluntarily submit to verify identity, handle questions or complaints and record the outcome.

Security and improvement: we may collect IP addresses, browser or device types, operating systems, access times, page paths, referrals, error logs, action events and anonymous or de-identified user identifiers to protect accounts and networks, identify anomalies, measure feature use and improve the experience. We follow data minimization and use access controls and de-identification to reduce risk.

Content review: to fulfill content safety obligations, we may automatically or manually review images and other content you upload for public display and retain necessary review results. We may restrict display, remove content or take other necessary steps when we identify unlawful or infringing material.

Exceptions to consent: where law permits processing without consent, we may process information to meet legal obligations, respond to public health emergencies, protect life, health or property, or reasonably process information you have made public or that has otherwise been lawfully disclosed.

3. Device permissions

When you upload photographs, save invitations, scan codes or use location-based navigation, the relevant client may request photo library, camera, storage or location permissions. We request access only when you actively use the feature. You can manage or withdraw permissions in device settings. The corresponding feature may then be unavailable; withdrawal does not affect prior lawful processing.

4. Cookies and similar technologies

We may use cookies, local storage and similar technologies to retain sign-in status, preferences and security identifiers, keep the service working, reduce repeated actions and analyze usage. You can clear or restrict this data in your browser, but some sign-in, editing or preference features may stop working.

5. Processing by others, sharing and disclosure

Service providers: we may entrust necessary information to providers of cloud storage, content delivery, messaging, content review, analytics or support. Agreements specify processing purposes, duration, methods, information types and safeguards, and we supervise the entrusted processing.

Sharing: except to deliver third-party sign-in, maps, payments or sharing you choose, or as otherwise required by law, we do not share your personal information with other independent controllers. When sharing is legally required, we identify the recipient, purpose and information types, and obtain additional consent where required.

Transfers: if a merger, division, restructuring, asset transfer or similar transaction involves personal information, we will identify the recipient and require it to remain bound by this policy. A recipient changing the original purpose or method must obtain consent again as required by law.

Public disclosure: as a rule, we do not publicly disclose personal information. Where necessary, we explain the purpose and information types and obtain separate consent unless law provides otherwise.

Content in invitations you publish and share can be accessed within the sharing scope you choose. Be careful when entering personal information and protect your invitation links.

6. Storage and protection

Personal information collected through the service is stored within the People’s Republic of China. If an overseas transfer becomes necessary, we fulfill applicable notice, consent, security assessment and other legal obligations.

We retain information for the shortest period necessary for the purposes described here, unless law requires otherwise or you separately authorize retention. We then delete or anonymize it as required. Where technical limitations temporarily prevent deletion, we stop processing other than storage and necessary security protection.

We use reasonable access controls, transmission protection, log auditing, backups and security monitoring. If a security incident may harm your rights, we take corrective measures required by law and provide appropriate notice of the incident, potential effects and protective recommendations.

The internet is not completely secure. Use strong passwords, protect sign-in credentials and avoid unnecessary sensitive information in public invitations.

7. Your rights

Subject to applicable law, you may use product features or support channels to exercise these rights:

Access and copies: view your account, invitations and other accessible information, or request a copy of personal information. Correction: update inaccurate or incomplete account information or invitation content.

Deletion: delete invitations or request deletion of personal information where legal conditions are met. Withdrawal of consent: disable permissions in system settings or contact us to withdraw specific authorization. This does not affect the lawfulness of earlier processing.

Account closure: request closure through the account management features provided in the product. Signing in again may create a new account, and the original invitations, saved designs and entitlements may not transfer.

Explanation and complaints: ask us to explain our processing rules or submit feedback and complaints.

We may first verify your identity for security. We generally respond within the period required by law. We may lawfully limit requests that are unjustifiably repetitive, unreasonable, harmful to others’ rights or otherwise permitted to be refused, and explain why.

8. Children and minors

The service is primarily intended for adults. Minors should use it with a guardian’s guidance and consent. Before providing information about a child under 14, a guardian must read and agree to the relevant rules for children’s personal information. Contact us if you believe we collected a child’s information without the required consent; we will investigate and act in accordance with law.

9. Third-party services

Features may include third-party sign-in, payments, maps, sharing or content display. Necessary information is sent to a third party only when you use the corresponding feature and as needed to provide it. Its processing is governed by its own privacy policy. Read the relevant rules before use.

10. Policy updates

We may update this policy to reflect business changes or legal requirements. Updated policies appear here with an updated date. We will prominently notify you of material changes to purposes, information types or your rights, and obtain consent again where required by law.

11. Contact us

For questions, feedback, complaints or personal information rights requests, contact us through the support channels published in Xitang. We may verify your identity and ask for details of the request. We respond within the period required by law or a reasonable time.