Privacy

1. Who we are

Invicity is a curated membership community for ambitious professionals who live and move between cities. In this policy, “Invicity”, “we” and “us” means Invicity, operated by Stephanie Liu in London, United Kingdom. We are the data controller for the personal data described here. Contact: stephliu58@gmail.com.

2. What we collect

• Your account: your email address, and how you signed in.
• Your application: your name, WhatsApp number, LinkedIn and Instagram, what you do, your move to London, and your answers to our questions.
• Your profile: your photo, headline, company, interests, the places you've lived and anything else you add. You choose what to share.
• Membership: your cohort and circle, the events you sign up for and check in to, your connections with other members, and your answers to questions like whether you're staying next quarter.
• Signature introductions and hosting: where and when you're travelling, who you'd like to meet, your host profile, and the feedback you leave after a meetup.
• Payments: our payment provider, Stripe, processes your card. We see the amount, date, your name and email, never your full card number.
• How the app is used: which pages and features are used (for example, that a profile page was opened, not whose), linked to your member number only. See section 8.
• Messages: what you send us by email, WhatsApp or social media.
• Photos and video: we sometimes take photos at events. See section 9.

We don't ask for sensitive information such as health, religion or political views. Please don't include it in your answers.

3. How we use it, and why

4. Who can see what in the app

• Members: see your profile in the member directory. In Settings you can show it only to people you're connected with.
• Your contact details: (WhatsApp, LinkedIn, Instagram) are shown only to people you're connected with, unless you choose to show them to all members.
• People who aren't members yet: see only a first name, headline, city and a small blurred photo.
• Hosts and travellers: in a Signature introduction see each other's first name, what you do, your dates, how you'd like to meet and your profile link: nothing else.
• Event hosts: see who's coming to the events they host, to check people in.

5. Who we share it with

We never sell your personal data. We share it only with service providers who help us run Invicity, under contracts that protect it:

• Supabase: the app's database and sign-in (stored in London).
• Vercel: hosts the app (served from London).
• Resend: sends our emails (EU).
• Stripe: payments.
• PostHog: app usage analytics (EU; see section 8).
• Luma: registration for our public events.
• WhatsApp: circle group chats and introductions.
• Tally and Airtable: our application form and member records for the founding cohort.

And with authorities, if the law requires it.

6. International transfers

We keep the app's data in the UK and EU where we can. Some providers are based in the United States. Where your data is transferred abroad, we rely on recognised safeguards such as the UK Extension to the EU–US Data Privacy Framework or the UK's International Data Transfer Addendum.

7. How long we keep it

• Applications we don't take forward: deleted within 12 months.
• Members: kept while you're a member and for up to 2 years after you leave, so you can rejoin easily, unless you delete your account sooner.
• When you delete your account: it's hidden at once and deleted for good 30 days later (sign in before then to change your mind).
• Payment and invoice records: kept for 6 years, as UK tax law requires, no longer linked to your account.

8. Cookies and analytics

The app uses only the cookies it needs to work: one to keep you signed in, one to remember an invite link you opened (for 30 days), and one to take you back to the right page after signing in (for an hour). There are no advertising or tracking cookies, so there's no cookie banner.

To understand how the app is used we use PostHog, hosted in the EU, without cookies. It records actions like “an event was viewed” or “a payment went through”, linked to your member number only: never your name, email or anything you type, and pages by type (“a profile page”), not whose. There are no screen recordings.

9. Photos at events

We sometimes take photos and short videos at Invicity events and may share them on our website and social media. If you'd rather not appear, tell the host on the night or email us, and we'll leave you out or take the image down.

10. Your rights

Under UK data protection law, you can:

• Get a copy of your data: in Settings → Download my data, any time.
• Correct it: edit your profile, or ask us.
• Delete it: in Settings → Delete my account, or ask us.
• Object to, or limit, how we use it
• Withdraw your consent: including to marketing, in Settings.
• Have it transferred: to you or another organisation.

Email stephliu58@gmail.com and we'll respond within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, though we'd appreciate the chance to put it right first.

11. Keeping it safe

We use reputable providers with strong security. In the app, rules in the database decide what each person can see, so members only ever receive what they're allowed to. We limit access to the people who need it to run Invicity, and review what we keep regularly.

12. Changes to this policy

We'll update this page if how we use your data changes, and change the date at the top. For significant changes, we'll tell members directly.