Privacy Policy

Effective date: 10 November 2026 · Last updated: 10 November 2026

This policy explains what personal data the Giorti app and the giorti.kz website process, why we do it, where the data is stored and what rights you have. We process personal data in accordance with the Law of the Republic of Kazakhstan "On Personal Data and Its Protection" of 21 May 2013 No. 94-V. We try to collect as little data as possible — only what the service cannot work without.

1. Who processes the data

The owner and operator of the personal data database is the owner of the Giorti app: [Operator name, BIN]. For any questions about personal data, please write to us at support@giorti.kz.

2. What data we process

Organizers (app users)

The anonymous user identifier that Apple provides when you use Sign in with Apple. We do not store the email address or name from your Apple ID.
The events you create: title, type, date and time, place, texts, hosts, dress code, RSVP deadline and invitation images.
Guest names that you type for personal invitation links. The name is part of the link itself.
Purchase information: Apple transaction identifiers and the event each purchase belongs to.
Your device's push notification token.

Guests

Only what a guest enters in the answer form: their name, their answer ("I'll come", "I can't come" or "Not sure yet"), the number of people coming with them and a wish to the hosts.
If a guest follows the event in the Giorti app — the push notification token of their device.

Guests do not need to register or give a phone number or email address.

Technical data

IP addresses are processed briefly, only to protect against abuse (rate limiting). The IP address itself is not stored in the database: with a guest's answer we keep only an irreversible hash of it, computed with a secret key separately for each event. It lets the organizer block someone who abuses the answer form, and it is deleted together with the answer.
Openings of invitation pages are counted only as aggregated totals, without any identifiers.

What we don't do

We don't upload your address book. Contacts are picked with the standard iPhone picker, and only the names you choose reach the app.
We don't see or store bank card details — payments are processed by Apple.
We don't show ads, don't track you across other apps and websites, and don't use third-party analytics SDKs.
We don't sell personal data or share it for marketing.

3. Why we process the data

So that you can sign in, create events and invitations and share them.
So that guests can open an invitation, answer it and change the answer later.
So that the organizer can see the list of answers, the number of guests and their wishes.
To send notifications: to organizers about their events, and to guests with the app about changes of date or place.
To record purchases and unlock paid features for the right event.
To protect the service from spam, fraud and prohibited content, and to review reports.
To comply with the legislation of the Republic of Kazakhstan.

4. Consent

An organizer consents to the processing of their data by signing in to and using the app. A guest consents by submitting the answer form: next to the button there is a consent line with a link to this policy. Before your first AI image generation, the app asks for your consent separately.

An organizer who types guest names for personal links is responsible for having grounds to enter those names (for example, they are relatives, friends or colleagues the organizer is inviting).

You can withdraw your consent: an organizer by deleting their account, a guest by asking the organizer or our support to delete their answer. Withdrawal does not affect the lawfulness of processing carried out before it.

5. Where the data is stored

All personal data is stored on servers in the Republic of Kazakhstan, with a hosting provider located in Kazakhstan. Daily backups are kept in a second storage that is also located in Kazakhstan.

6. AI image generation

Invitation backgrounds are created with third-party artificial intelligence services: Replicate (the FLUX model) and Google (Gemini). These services are located outside Kazakhstan.

We send them only a text description of the background: the event type, the chosen style and, if you added them, your wish words for the design. For a high-quality redraw, the draft background image is sent as well. We never send them names, dates, addresses, phone numbers or any other personal data. The AI draws only a background without text — the app adds all the wording itself.

Please do not enter personal data in the custom description or wish field. A content filter blocks prohibited requests.

7. Who we share data with

Apple — for Sign in with Apple, processing purchases and delivering push notifications through the Apple Push Notification service.
A hosting provider in Kazakhstan — stores the data on our servers and does not use it for its own purposes.
AI services (Replicate, Google) — receive only the background description without personal data, as described in section 6.
Government authorities — only in the cases and manner provided by the legislation of the Republic of Kazakhstan.

A guest who opens an invitation sees what the organizer put in it. The organizer sees the answers, names, number of people and wishes of their guests.

8. How long we keep data

AI background variants that were not selected are deleted after 7 days.
Events, guest answers and images are deleted 12 months after the event date.
When you delete your account (in the app: Settings → Delete account), your account, all events, answers, invitations, images and linked devices are deleted immediately. The data disappears from backups within 30 days as they are overwritten.
A guest can ask the organizer to delete their answer (organizers delete answers in the app) or write to us at support@giorti.kz. An organizer can also delete an abusive or fake answer and stop its author from answering that event again.
If an account is blocked for violating the Terms of Use, all its invitations are hidden and signing in to it stops. The data is kept and deleted on the usual schedule described above.

Reminders for guests (a day and two hours before the event) are scheduled on the device itself and do not require storing extra data on the server.

9. Your rights

Under the legislation of the Republic of Kazakhstan, you have the right to:

know whether we process your personal data and get access to it;
ask us to correct inaccurate data;
ask us to delete your data;
withdraw your consent to processing;
file a complaint with the authorized body — the Ministry of Digital Development, Innovations and Aerospace Industry of the Republic of Kazakhstan — or with a court.

To use these rights, write to us at support@giorti.kz. We will reply within the time limits set by law. Organizers can also edit and delete their events and account directly in the app.

10. Data protection

We take the necessary legal, organizational and technical measures to protect personal data from unauthorized access, alteration, disclosure and destruction. Only those who need access to run the service have it.

11. Children

Accounts and events may be created by people aged 18 or over, or by minors with the consent of their parents or legal guardians. Anyone who has been invited may answer an invitation. If you believe we have received a child's data without the necessary consent, please write to us and we will delete it.

12. Changes to this policy

We may update this policy. The new version is published on this page with the date of the update. We will also let you know about significant changes in the app.

13. Contact

Operator: [Operator name, BIN]. Email: support@giorti.kz.