Privacy Policy

Last updated: October 31, 2026

Ringkasan: kami hanya mengumpul maklumat yang diperlukan untuk kad jemputan dan RSVP anda, kami tidak menjual data anda atau data tetamu anda, dan kad jemputan disembunyikan daripada enjin carian secara lalai. Versi Bahasa Inggeris di bawah ialah versi rasmi.

This policy explains how Nikahwin ("we") handles personal data under Malaysia's Personal Data Protection Act 2010 (PDPA). It covers couples who create invitations and guests who open them.

1. Data we collect from couples

  • Account: email, username (your invitation address), password (stored as a secure hash) and birth year.
  • Invitation content: names of the couple and their parents, event dates, venues, addresses, phone numbers, bank account details and photo links that you choose to add.
  • Technical: IP address at sign-up and login, for security.

2. Data we collect from guests

  • RSVP: the name, attendance, number of people, and optionally phone number and message that a guest submits. This is collected on behalf of the couple, who decides what to ask for.
  • Wishes: the name and message a guest posts. Wishes may be shown publicly on the invitation.
  • Stats: anonymous visit counts (no cookies; IP addresses are hashed and not stored in readable form).

3. How we use data

  • To show invitations, collect RSVP replies and wishes, and give couples their guest list.
  • To keep the Service secure and prevent spam and abuse.
  • To send account emails (confirmation, password reset). We do not send marketing email without consent.

We do not sell personal data. Guest RSVP data is visible only to the couple who owns the invitation (and to our staff when needed to run the Service or handle a report).

4. Who we share data with

  • Hosting and email providers that run the Service for us.
  • ImgBB, if a couple uploads photos: the photo is stored by ImgBB and shown from their servers.
  • Google Fonts, Google Maps, Waze and video sites load when guests view an invitation or tap a button, and may receive the guest's IP address.
  • Advertising partners on free invitations, which may use cookies. See section 6.
  • Authorities, when the law requires it.

5. How long we keep data

Invitations, RSVP replies and wishes are kept until the couple deletes them or their account. Deleted data is removed from backups within 30 days. Couples can delete individual RSVP replies and wishes at any time.

6. Cookies

We use a session cookie to keep you logged in, a language cookie for your chosen language, and your browser's storage to remember small settings (for example the light/dark theme). Ad partners on free invitations may set their own cookies.

7. Security

We use HTTPS, hashed passwords, rate limits and regular backups. No system is perfectly secure; tell us at once if you suspect a problem.

8. Your rights

Under the PDPA you can ask to access or correct your personal data, or withdraw consent. Couples can edit or delete their data in the dashboard. Guests who want an RSVP reply or wish removed can ask the couple, or contact us with the invitation address and we will help.

9. Children

The Service is for people aged 16 and over. Couples should not add photos or personal details of children without their parents' consent.

10. Changes

We may update this policy and will show the new date at the top.

11. Contact

For privacy questions or requests, feel free to drop us a line.