Privacy Policy — mieven.to

Effective date: October 20, 2026 · Last updated: October 20, 2026

This policy explains how mieven.to collects, uses and shares personal information when you buy or use our digital invitations, RSVP to an event, or visit our website. If you live in Mexico, our Spanish Aviso de Privacidad Integral (mieven.to/privacidad) applies and prevails.

1. Who we are

mieven.to is operated by José Carlos Chaparro Morales, a sole proprietor located in Chihuahua, Chih., Mexico. Privacy contact: [email protected].

2. Information we collect

We do not ask for Social Security numbers, precise geolocation, biometric data or government IDs (except to verify a privacy request). Event details may incidentally reveal religious beliefs (e.g., a church wedding or baptism); we use them only to display the invitation the host requested.

3. How we use information

• Create, publish and host the invitation and status image; manage guest lists, passes, RSVPs, and photo galleries.
• Share guests' RSVPs, messages and photos with the event host.
• Process payments, revisions, refunds and invoices; provide support.
• Send transactional emails and, only to guests who opted in, event reminders via WhatsApp.
• Pay referral commissions.
• Keep the service secure, prevent fraud and bots, and comply with law.
• With separate consent only: send marketing emails to hosts/partners; feature an invitation in our portfolio (never one showing children).

We do not sell personal information, "share" it for cross-context behavioral advertising, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects.

4. How we disclose information

• The event host receives information that guests submit through that host's invitation.
• Service providers acting on our behalf under contract (the app and its main database run on our own server, operated by us in Chihuahua, Mexico): Cloudflare, Inc. (CDN, R2 storage, Turnstile), Meta Platforms / WhatsApp Business (reminders), Resend (email delivery, United States).
• Referral partners learn only that their code was used, the package and the amount — never guest data.
• Authorities, when required by law, or to protect rights and safety.
• A successor if the business is sold or transferred, subject to this policy.

Services the guest turns on. If an invitation includes a playlist (Spotify, Apple Music or YouTube Music), the service does not load until the guest taps "Listen to the playlist". From that moment the guest's browser connects directly to that provider, which receives the guest's IP address, technical data and the origin of the invitation site, under its own privacy notice. mieven.to does not send the guest's personal information to that provider.

Interactive map. If an invitation includes an interactive map, the map loads its data from our own servers only after the guest taps "View interactive map". We send no data to third parties to show it.

In the last 12 months we have not sold or shared personal information as those terms are defined under California law, and we have no actual knowledge of selling or sharing information of consumers under 16.

5. Information about children

mieven.to is a general-audience service for adults who organize events. It is not directed to children and we do not knowingly collect personal information from children under 13.

Hosts — typically parents or legal guardians — may include a child's name and photos on an invitation (for example, a birthday or quinceañera). That information is provided by the adult, not collected from the child, so the US Children's Online Privacy Protection Act (COPPA) does not apply to it; we nevertheless treat it with extra care:

• Only a parent or legal guardian of the child may upload the child's photos or name.
• We never use children's images for marketing or our portfolio.
• Invitation pages are not indexed by search engines.
• A parent or guardian may ask us to remove a child's information at any time and we will do so promptly.

If we learn that we collected personal information directly from a child under 13 (for example, a child submitting an RSVP or uploading a photo) without verifiable parental consent, we will delete it. Contact [email protected].

6. WhatsApp and text message reminders (TCPA)

If you are a guest, we send automated reminders only if you check the opt-in box on the RSVP page and provide your own number. By opting in you agree to receive up to 3 automated informational messages about that specific event from mieven.to via WhatsApp. Consent is not a condition of attending or of any purchase. Message and data rates may apply. Reply STOP to stop at any time; reply HELP for help. We send messages between 9 a.m. and 8 p.m. in your local time and never send marketing to guests.

We do not send automated messages to phone numbers that a host provides unless the guest has opted in. Hosts may share their invitation link manually from their own phone.

7. Email (CAN-SPAM)

Transactional emails (order status, preview, expiry) are sent as part of the service. Marketing emails are sent only to hosts and partners who opted in; each includes our postal address (Chihuahua, Chih., Mexico) and an unsubscribe link, and we honor opt-outs within 10 business days.

8. Cookies, Do Not Track and Global Privacy Control

We use only strictly necessary technologies: a session cookie for hosts, a cookie with the language you chose and Cloudflare Turnstile (bot protection). Form progress and RSVPs are saved on our servers, not in your browser. Your browser's local storage keeps a random identifier and your vote only on invitations with the gender reveal add-on, to count one vote per browser and show you the one you chose. Our analytics (Umami) uses no cookies and does not identify you. We do not use advertising cookies or allow third parties to collect information about your online activities across websites through our service.

Do Not Track (CalOPPA disclosure): because we do not track users across third-party websites, our site responds to Do Not Track signals the same way it handles all traffic — no cross-site tracking takes place. We also treat a Global Privacy Control signal as a valid opt-out of sale, sharing and targeted advertising (none of which we do).

9. Retention

10. Security and international processing

We use HTTPS, tokenized guest links, access controls and backups. No method is 100% secure; we will notify affected users and authorities of a breach as required by law. Information is processed in Mexico and the United States (and on Cloudflare's global network).

11. Your rights

Depending on where you live, you may have the right to: know/access the information we hold, correct it, delete it, obtain a portable copy, opt out of sale, sharing, targeted advertising and profiling, and limit the use of sensitive information. Residents of Mexico have ARCO rights under Mexican law (see our Spanish notice).

• How to ask: email [email protected] with the subject "Privacy request" and the invitation link if you are a guest. We will verify your identity with information we already hold (we may ask for more if needed).
• Authorized agents may submit requests with your signed permission.
• Timing: we respond within 45 days (extendable once by 45 days where the law allows).
• Appeals: if we deny your request, reply to our decision with "Appeal"; we will answer within 60 days. If you are still unsatisfied, you may contact your state Attorney General.
• No discrimination: we will not deny service or change prices because you exercised a right.
• Guests: the host controls their guest list; you can also ask the host to remove you.
• California "Shine the Light": we do not disclose personal information to third parties for their direct-marketing purposes.

12. Changes

We will post changes here with a new "Last updated" date. For material changes we will notify active hosts by email before they take effect.

13. Contact

José Carlos Chaparro Morales (mieven.to) · Chihuahua, Chih., Mexico · [email protected]