Privacy

Varna is a digital-invitation platform. A host chooses a card design, personalizes it, and sends each guest their own private link; guests reply, and after the event they can send back the photographs and videos they captured.

This policy covers everything you do on Varna as a host, and everything a guest does when they open an invitation we delivered. It does not cover the websites, messaging apps or payment providers you reach by leaving Varna — those have their own policies, and we encourage you to read them.

We collect four kinds of information, and no more than each one requires:

• Your account. The phone number or email address you sign in with, your name, and your language and market preferences. We use a one-time code rather than a password, so we never hold one.
• Your event. The card you chose, the names, dates, places, photographs and words you put on it, and the settings you picked for it.
• Your guest list. The names and phone numbers or email addresses you add so we can deliver each invitation, along with each guest's reply and whether their invitation was delivered.
• Technical information. Device type, browser, approximate region, and the pages viewed on Varna — the ordinary record any website keeps in order to work, stay secure, and be improved.

Your guests' details come to us from you, not from them. That places a real obligation on both of us: you should only add someone you have a genuine reason to invite, and we treat what you add as strictly yours.

A guest's own record on Varna is small on purpose — their name, the way to reach them, whether the invitation arrived, and what they answered. We do not build a profile of a guest, we do not combine what one host tells us about them with what another host does, and a guest who has never signed in has no Varna account for us to track.

To run the service you asked for: to build and show your card, to deliver each guest their personal link, to collect and count the replies, to take payment, and to keep the whole thing secure against abuse.

We also use aggregate, non-identifying figures to understand which designs are chosen and where the product frustrates people. That work never involves reading your guest list, and nothing in it is sold on.

Invitations are delivered by SMS through a telecommunications provider, which necessarily receives the recipient's number and the message in order to send it. The provider acts on our instructions and may not use that information for anything else.

Delivery to a phone network is never guaranteed. We record whether the network accepted the message so you can see who to follow up with — not whether a guest read it on their lock screen, which is not something anybody can honestly report.

Payments are handled by our payment provider — Zarinpal for hosts paying in Iran. Card numbers are entered on the provider's own secure page and never reach Varna's systems; what we receive back is whether the payment succeeded, the amount, and a reference we can use for support and refunds.

We keep records of what was purchased for as long as tax and accounting law requires, which is longer than we keep the event itself.

After the event, guests can send you the photographs and videos they took. Those arrive in a private inbox that only you can see, and nothing appears anywhere until you approve it.

We do not use your guests' photographs to promote Varna, to train any model, or for any purpose other than showing them to you and building the album you asked for.

We do not sell, rent or trade your information or your guest list. There is no advertising on Varna, which removes the commercial reason most services have for sharing anything at all.

Information reaches a third party in only three situations:

• Service providers who make the product work — hosting, SMS delivery, payments — each bound to use it only for the task we hired them for.
• A legal requirement, where a valid order compels disclosure. We disclose the minimum the order actually demands.
• A change of ownership, where the company or its assets are transferred. Any successor inherits this policy, and you would be told before anything moved.

Your account and its cards remain for as long as you have an account. An event's guest list, replies and analytics stay with the card they belong to, so you can look back at an evening a year later.

Delete a card and it is removed, along with its guest list and replies, within thirty days — including from our backups on their own rotation. Close your account and the same happens to everything in it, except the payment records we are legally obliged to retain.

Whatever your jurisdiction requires of us, these are available to anyone who asks:

• A copy of what we hold about you, in a form you can take elsewhere.
• Correction of anything inaccurate, which for most fields you can do yourself in settings.
• Deletion of your account and its contents, subject only to records the law requires us to keep.
• For a guest: removal from a host's list on Varna. Write to us and we will act on it, and tell the host that we did.

Varna uses the smallest possible set: one to keep you signed in, one to remember your language, and one to remember whether you prefer the light or dark theme. There are no advertising cookies and no third-party trackers, because we have nothing to advertise to you.

Blocking them will sign you out and reset those preferences, but nothing else about the product depends on them.

Traffic is encrypted in transit, access to production data is limited to the people who need it to do their job, and sign-in uses a one-time code rather than a password you might reuse elsewhere. No system is perfect; if a breach ever affects you, we will tell you plainly and quickly rather than quietly.

If this policy changes materially we will say so on this page and, for anything that affects an event already in flight, by message. Questions, requests and complaints all reach a real person at the address on our contact page.