Privacy Policy

Last updated: May 28, 2026

Our Data Privacy Philosophy

We're a small team who, like you, have been burned by too many companies that farm our data or use it improperly. When we set out to build Lemonvite, we decided to approach things differently. We don't sell your personal data as a source of revenue, and we take care in overseeing how your data is accessed and what it's used for. In short – we treat your data the way we'd want someone to treat our own data.

Lemonvite's data privacy philosophy is to only collect and share the information needed to operate our service. We've designed our product from the ground up with privacy in mind. For example:

• We don't require full names to use our platform
• When you add guests to your event, we only store the contacts you're inviting – not your whole address book
• By default, we don't share your phone number or email with other users
• We don't allow your personal data to be used for purposes unrelated to our platform
• We don't subscribe you to a marketing list when you sign up
• We don't sell your personal data as a source of revenue – we make money by charging a one-time fee to publish your event invitation

Summary of Key Points

This summary provides key points from our privacy notice, but you can find out more details about any of these topics by reading the full sections below.

• What personal information do we collect? When you use our Service, we collect personal information depending on how you interact with Lemonvite, the choices you make, and the features you use.
• Do we receive information from third parties?We may receive information about you from other users (e.g., when a host invites you to an event). We do not receive personal information from third parties for marketing or analytics. The only third-party data we receive about you is what you explicitly authorize: your basic profile when you sign in with Google; — only if you choose to use the optional Google Contacts import — the names, email addresses, and phone numbers from your Google Contacts; and — only if you connect Canva — the list of your Canva designs and the design you choose to import.
• Why do we collect personal information? We collect, use, and disclose personal information to provide, improve, and administer our Service, communicate with you, for security and fraud prevention, and to comply with law. We do not sell your personal information. We may use first-party analytics to understand which campaigns, referrals, and product experiences bring visitors to Lemonvite and help them use the Service, but we do not use your personal information for third-party marketing.
• How do we protect personal information? We have organizational and technical processes in place to protect your personal information. However, no electronic transmission over the internet can be guaranteed to be 100% secure.
• What are your rights? Depending on where you are located, you may have certain rights regarding your personal information, including the right to access, correct, or delete your data.

1. Introduction

Lemonvite, a protected series of Lemonberry Labs LLC, a Delaware Series Limited Liability Company formed pursuant to the Delaware Limited Liability Company Act, 6 Del. C. § 18-215 ("Lemonvite," "Company," "we," "our," or "us") is committed to protecting your privacy. Lemonberry Labs LLC is referred to herein as the "Master LLC." This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our event invitation platform (the "Service"). Please read this policy carefully. By using the Service, you consent to the practices described in this Privacy Policy.

The Master LLC is organized as a Series Limited Liability Company under the Delaware Limited Liability Company Act (6 Del. C. § 18-215). The Lemonvite series operates as a protected series with its own assets, liabilities, and obligations that are legally distinct from those of any other series or of the Master LLC generally. Personal information collected through the Lemonvite service is an asset of the Lemonvite series and is maintained separately from the assets of any other series of the Master LLC. No other series of the Master LLC has access to the personal data collected by the Lemonvite series.

2. Google User Data

Lemonvite uses Google Sign-In (OAuth 2.0) for user authentication and offers an optional Google Contacts import. This section specifically describes how we handle data received from Google APIs, in compliance with the Google API Services User Data Policy.

2.1 Google Data We Access

When you sign in with Google, we request access to the following information from your Google account:

• Email Address: Your primary Google account email address
• Name: Your display name as set in your Google profile
• Profile Picture: Your Google profile photo (optional, if available)

Separately, if (and only if) you choose to use the “Import from Google” feature on the Contacts page, we will ask for an additional one-time, read-only authorization to your Google Contacts (the contacts.readonly scope) so we can copy your contacts into your Lemonvite address book:

• Google Contacts: For each contact in your Google account, we read the display name, email addresses, and phone numbers. We do not read photos, postal addresses, notes, organizations, birthdays, or any other contact fields.

We do not access your Google calendar, files, Gmail, or any other Google services data. Granting the Contacts scope is entirely optional — sign-in works without it, and you can revoke it at any time (see Section 2.5).

2.2 How We Use Google Data

The Google user data we receive is used exclusively for the following purposes:

• Account Creation: Creating your Lemonvite account when you first sign up
• Authentication: Verifying your identity when you sign in to the Service
• Profile Display: Showing your name and profile picture within the Service (e.g., in the navigation bar and on events you create)
• Communication: Sending you transactional emails about your account and events
• Contacts Import (optional): If you explicitly trigger an import, we copy the names, email addresses, and phone numbers from your Google Contacts into your Lemonvite address book so you can invite those contacts to future events. We do not use Google Contacts data for any other purpose, do not transfer it to third parties, and do not use it for advertising or to train AI/ML models.

2.3 Google Data Storage

Google user data is stored as follows:

• Your email address, name, and profile picture URL are stored in our secure database
• Contacts imported via the optional Google Contacts import are stored in your Lemonvite address book alongside contacts you add manually. We do not retain the short-lived Google access token used to perform the import; it is discarded as soon as the import completes
• Data is encrypted in transit using TLS/HTTPS and at rest
• Data is stored on secure servers hosted by Vercel and our database provider
• Data is retained until you delete your account, or, for imported contacts, until you delete them from your address book

2.4 Google Data Sharing

We do not sell, share, or transfer your Google user data to any third parties for advertising, marketing, or any purpose unrelated to providing our Service.

Your Google data may only be shared in these limited circumstances:

• Service Providers: With infrastructure providers (Vercel, database hosting) solely for the purpose of operating the Service
• Legal Requirements: When required by law or to respond to valid legal process
• With Your Consent: Your name and profile picture may be visible to guests you invite to events you create

2.5 Google Data Deletion

You can request deletion of your Google user data at any time by:

• Deleting your Lemonvite account through Settings
• Contacting us at privacy@lemonvite.com
• Revoking Lemonvite's access in your Google Account permissions

Upon deletion request, we will remove your Google user data from our active systems within 30 days. Some data may be retained in backups for up to 30 additional days before permanent deletion.

2.6 Limited Use Disclosure

Lemonvite's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, the use and transfer of raw or derived user data received from Google Workspace APIs (including the data we read under the optional contacts.readonly scope) adheres to these requirements. Specifically, we:

• Only use this data to provide or improve user-facing features that are prominent in the requesting application's interface (importing your Google Contacts into your Lemonvite address book);
• Do not transfer or sell this data to third parties, except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with the user's consent;
• Do not use or transfer this data for serving advertisements, including retargeting or personalized ads;
• Do not allow humans to read this data unless we first obtain your affirmative agreement to view specific messages or data, doing so is necessary for security purposes or to comply with applicable law, or the data has been aggregated and anonymized for internal operations; and
• Do not use, transfer, or sell this data — including data aggregated, anonymized, or derived from it — to create, train, or improve any generalized or foundational artificial intelligence or machine learning models.

2A. Canva User Data

Lemonvite offers an optional integration with Canva that lets you import a design you made in Canva as your invitation image. This section describes how we handle data received from the Canva Connect API. You only connect Canva if you choose to use this feature.

2A.1 Canva Data We Access

When you connect your Canva account, you authorize Lemonvite to:

• Design list (metadata):Read the list of your Canva designs — titles, thumbnails, page counts, and identifiers — so you can browse and search them inside Lemonvite.
• Exported design content: Export the single design you choose to import, as an image, so it can become your invitation. We only export a design you explicitly select.

We request only the minimum Canva permissions needed for import (read design metadata and export the selected design). We do not edit your Canva account, create or delete Canva designs, or access designs you do not choose to import.

2A.2 How We Use Canva Data

• Displaying your Canva design list so you can pick one to import.
• Importing the design you select as the base image of your invitation.

We do not use Canva data for advertising, do not sell or transfer it to third parties, and do not use it to train AI/ML models.

2A.3 Canva Data Storage

• Connection tokens: To keep your Canva account connected, we store the access and refresh tokens Canva issues. They are used only to import designs on your behalf and are deleted when you disconnect.
• Imported images: A design you import is stored the same way as any other invitation image (see Section 8, Data Retention).

2A.4 Disconnecting and Deleting Canva Data

You can disconnect Canva at any time:

• Click Disconnectin the Canva tab of the design editor — we revoke our access with Canva and delete the stored connection tokens.
• Deleting your Lemonvite account also removes the stored connection.
• You can also review or revoke Lemonvite's access from your Canva account settings at any time.

3. Information We Collect

3.1 Information You Provide Directly

3.2 Information Collected Automatically

4. How We Use Your Information

We use the information we collect for the following purposes:

• Providing the Service: Creating and managing your account, events, and invitations
• Sending Communications: Sending invitation emails and SMS on your behalf to your guests, transactional emails, and service notifications
• Processing Payments: Completing purchases and maintaining transaction records
• AI Image Generation: Processing your prompts to generate custom invitation images
• Improving the Service: Analyzing usage patterns, fixing bugs, developing new features
• Measuring Campaign Performance: Understanding which first-party campaigns, referrals, and landing pages lead to visits, checkouts, and purchases
• Security: Detecting and preventing fraud, spam, abuse, and security incidents
• Legal Compliance: Complying with applicable laws and responding to legal requests
• Customer Support: Responding to your inquiries and providing assistance

5. Sharing of Information

5.1 Third-Party Service Providers

We share information with third-party service providers who perform services on our behalf. These providers are contractually obligated to protect your information and may only use it for the purposes we specify.

5.2 Event Guests

When you invite guests to an event, they will see the event details you provide (title, date, location, description, invitation image). If you enable the guest list feature, attending guests may see other guests who are attending.

5.3 Legal and Safety Disclosures

We may disclose your information if we believe it is necessary to:

• Comply with applicable laws, regulations, or legal processes
• Respond to valid requests from law enforcement or government authorities
• Protect the rights, property, or safety of Lemonvite, our users, or the public
• Detect, prevent, or address fraud, security issues, or technical problems
• Enforce our Terms of Service

5.4 Business Transfers

If the Lemonvite series or the Master LLC is involved in a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have.

5.5 We Do Not Sell Your Personal Information

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We have not sold personal information in the preceding 12 months and have no plans to do so.

When you have not opted out of analytics, we send a limited set of conversion and attribution data (such as the fact that a purchase occurred, the campaign click identifiers gclid and fbclid, and approximate purchase value) to Google Analytics and Google Ads so we can measure the performance of advertising campaigns we run. This processing may be considered "sharing" for cross-context behavioral advertising under the California Consumer Privacy Act (CCPA/CPRA).

We do not enable Google's remarketing or advertising-personalization features (thead_personalization consent signal is kept denied), and we do not send user-identifying data to Google Ads for ad measurement (the ad_user_data consent signal is kept denied). We use Google Analytics for first-party measurement and basic Google Ads conversion attribution only.

You can opt out of the conversion-attribution sharing described above at any time by declining analytics cookies in our cookie banner or by enabling the Global Privacy Control browser signal. After you opt out, we stop sending campaign click identifiers and other attribution data to Google Analytics; we may still send a minimal first-party conversion event (such as the fact that a purchase occurred and its value) under denied Consent Mode signals so that we can continue to measure aggregate revenue. See Section 9 for details.

5.6 SMS/MMS Messaging Privacy

This section describes how we handle mobile phone numbers and SMS/MMS messaging in compliance with the Telephone Consumer Protection Act (TCPA) and carrier guidelines.

5.6.1 Information Collection and Consent

We collect your mobile phone number when you register for an account using your phone number, or when a registered User (Host) provides it to us for the purpose of sending or receiving transactional event invitations and account security alerts (OTP).

Legal Basis for Host-Initiated Messages:Our platform facilitates communications based on the existing social relationship between the Host and the Guest. When a Host provides a Guest's phone number, they are exercising their existing relationship to send a transactional invitation—Lemonvite serves as the technical tool to deliver that message. As our messages are strictly transactional social invitations (not telemarketing), they meet the statutory requirements of the TCPA.

5.6.2 Use of Mobile Information

Your mobile information will be used exclusively for:

• Transactional Notifications: Delivering event details, RSVP status updates, and logistics as initiated by a Host
• Account Security: Sending One-Time Passwords (OTP) and multi-factor authentication codes
• Customer Support: Responding to your direct inquiries via SMS/MMS

5.6.3 Mobile Information Non-Sharing Disclosure

We value your privacy. Your mobile information—including your phone number and SMS opt-in/consent status—will NOT be shared, sold, or rented to any third parties for marketing or promotional purposes.

We may only share your mobile data with trusted third-party service providers (such as telecommunications carriers or SMS platform providers) for the sole purpose of facilitating the delivery of your messages. All such providers are bound by strict confidentiality agreements.

All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

5.6.4 Opt-Out and Help

You can opt out of our SMS service at any time:

• To Opt Out: Reply STOP to any message you receive
• For Help: Reply HELP or contact us at support@lemonvite.com
• Charges: Message and data rates may apply depending on your mobile carrier

5.6.5 SMS Data Security and Record-Keeping

We implement industry-standard security measures to protect your mobile data. As required by the TCPA and carrier guidelines, we maintain timestamped records of all opt-ins and opt-outs to ensure your preferences are strictly honored.

6. Guest Data: Your Role as Data Controller

When you upload guest information (names and email addresses) to send invitations, you are the data controller for that guest data, and Lemonvite acts as a data processor on your behalf. This means:

• You are responsible for ensuring you have a lawful basis (such as consent or legitimate interest) to share your guests' information with us
• You should inform your guests that their information is being processed through our Service
• Guests may contact you directly to exercise their data rights
• We process guest data only as necessary to provide the Service to you

Guest data is retained for the duration of your event plus one year, after which it is automatically deleted unless you request earlier deletion.

7. AI-Generated Content and Your Data

When you use our AI image generation features:

• Your text prompts and reference images are sent to our AI service providers to generate images
• We do not use your prompts, images, or generated content to train AI models. Your data is used solely to fulfill your specific request.
• Generated images are stored in your account and may be used for your events
• AI service providers may retain data temporarily for operational purposes in accordance with their privacy policies

8. Data Retention

You can request deletion of your data at any time by contacting us or using the account deletion feature in your settings. Some data may be retained as required by law or for legitimate business purposes (e.g., fraud prevention, legal claims).

9. Cookies and Tracking Technologies

9.1 Types of Cookies We Use

9.2 Managing Cookies

When you first visit our Service, you will see a cookie consent banner allowing you to accept or decline non-essential cookies. In regions where opt-out analytics is permitted (such as the United States), analytics and attribution cookies may be enabled by default until you decline. In regions requiring opt-in consent (the European Economic Area, the United Kingdom, and other jurisdictions with equivalent rules), analytics and attribution cookies are not set unless you accept.

If you decline, we stop sending product analytics events to Amplitude from that browser session, we stop sending campaign click identifiers (such as gclid and fbclid) and other attribution data to Google Analytics, and Google Analytics applies Consent Mode signals so that subsequent activity is processed under denied flags. We may still send a minimal first-party conversion event (for example, that a purchase occurred and its value) to Google Analytics so that we can continue to measure aggregate revenue without identifying the marketing source. In opt-in jurisdictions, when you decline or withdraw a previously granted consent, we also remove the first-party analytics and attribution cookies from your device. In opt-out jurisdictions, those cookies may remain on your device after a decline but are no longer read by us to send attribution data to our analytics providers; you can clear them at any time through your browser settings.

Note that disabling essential cookies may prevent you from using certain features of the Service, such as staying logged in.

9.3 Do Not Track and Global Privacy Control

Some browsers offer a "Do Not Track" (DNT) feature. We currently do not respond to DNT signals because there is no industry-standard interpretation.

We do, however, honor the Global Privacy Control (GPC) browser signal (delivered as theSec-GPC: 1 request header or via navigator.globalPrivacyControl). When GPC is enabled, we treat your visit as a request to opt out of the sale or sharing of personal information for cross-context behavioral advertising and apply denied analytics and advertising consent signals by default. If you affirmatively accept analytics cookies through our banner after GPC has been applied, your explicit choice for this site overrides the GPC default.

You can also opt out of analytics and advertising-related processing at any time through our cookie consent banner.

10. Data Security

We have organizational and technical processes and procedures in place designed to protect your personal information, including:

• Encryption of data in transit using TLS/HTTPS
• Encryption of sensitive data at rest
• Secure authentication via OAuth 2.0 and SMS verification
• Regular security assessments and vulnerability testing
• Access controls limiting employee access to personal data
• Secure cloud infrastructure with industry-standard protections

However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. If you believe your account has been compromised, please contact us immediately at security@lemonvite.com.

10.1 Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you and relevant authorities as required by applicable law, typically within 72 hours of becoming aware of the breach.

11. Your Privacy Rights and Choices

We offer you choices that affect how we handle the personal information that we control. Depending on your location and the nature of your interactions with our Service, you may request the following in relation to your personal information. The easiest way to exercise your rights is by contacting us at privacy@lemonvite.com. We may ask for specific information from you to help confirm your identity. You are entitled to exercise these rights free from discrimination.

11.1 Managing Your Account

If you would at any time like to review or change the information in your account or terminate your account, you can do so through your account Settings or by contacting us.

Upon your request to terminate your account, we will immediately and permanently delete your account and all associated data (events, guests, payments) from our active databases. This action is irreversible. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms, and/or comply with applicable legal requirements.

11.2 Rights Available to All Users

• Access: Request a copy of the personal data we hold about you. Where applicable, we will provide the information in a portable, machine-readable, readily usable format.
• Correction: Request correction of personal information that is inaccurate or out of date
• Deletion: Request deletion of personal data that we no longer need to provide the Service or for other lawful purposes
• Withdrawal of Consent: Where we have collected and processed your personal information with your consent, you may withdraw that consent at any time

11.3 Additional Rights for EEA/UK Residents (GDPR)

If you are in the European Economic Area or United Kingdom, you also have the right to:

• Portability: Receive your data in a structured, machine-readable format
• Restriction: Request restriction of processing in certain circumstances
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time where processing is based on consent
• Lodge a Complaint: File a complaint with your local data protection authority

Legal Basis for Processing (GDPR):

• Contract: Processing necessary to provide the Service you requested
• Consent: Where you have given explicit consent (e.g., marketing emails, analytics cookies)
• Legitimate Interests: Improving the Service, security, fraud prevention
• Legal Obligation: Compliance with applicable laws

11.4 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you
• Right to Delete: Request deletion of your personal information
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing:We do not sell personal information. As described in Section 5.5, we share a limited set of conversion and attribution data with Google Analytics and Google Ads for advertising measurement, which may be considered "sharing" for cross-context behavioral advertising under California law. You can opt out of this sharing at any time by declining analytics cookies in our cookie banner or by enabling the Global Privacy Control browser signal. After you opt out, we stop sending campaign click identifiers and other attribution data to Google.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

CCPA Categories Disclosure (Last 12 Months)

To submit a verifiable consumer request, email privacy@lemonvite.comwith "CCPA Request" in the subject line. We will verify your identity before processing your request.

12. International Data Transfers

Lemonvite is based in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.

For transfers from the EEA/UK, we rely on Standard Contractual Clauses approved by the European Commission and/or the UK Information Commissioner's Office, as well as other lawful transfer mechanisms.

By using the Service, you consent to the transfer of your information to the United States and other countries where our service providers operate.

13. Children's Privacy

The Service is intended for users who are at least 18 years of age. We do not knowingly collect personal information from anyone under 18.

If you are a parent or guardian and believe that your child under 18 has provided us with personal information, please contact us immediately at privacy@lemonvite.com. We will take steps to delete such information from our systems.

If we learn that we have collected personal information from a person under 18, we will delete that information as quickly as possible.

14. Third-Party Links

The Service may contain links to third-party websites or services that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. If we make material changes, we will notify you by:

• Posting a notice on the Service
• Sending you an email notification
• Updating the "Last updated" date at the top of this page

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after any changes constitutes your acceptance of the updated Privacy Policy.

16. Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of the State of Delaware, United States, without regard to its conflict of law provisions. The formation, internal affairs, and liability limitations of the Master LLC and its series, including the Lemonvite series, shall be governed by the Delaware Limited Liability Company Act (6 Del. C. § 18-101 et seq.), and specifically the provisions relating to series limited liability companies (6 Del. C. § 18-215).

17. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

• Email: privacy@lemonvite.com
• Security Issues: security@lemonvite.com
• General Support: support@lemonvite.com

We will respond to your request within 30 days, or sooner as required by applicable law.