Privacy policy

Last updated 30 October 2026. This explains what personal data mysanaa holds, why, who sees it, how long we keep it, and the choices you have.

Who we are

mysanaa is run by a company registered in Nigeria. Write to us at hello@mysanaa.com; our company details and registered address are available on request.

We play two roles. For hosts (people and businesses who create events), we decide how your account data is used, so we are its controller. For guests, the host decides who to invite and what to ask, so the host is the controller of the guest list and we process it on the host’s behalf. If you were invited by someone, they are your first point of contact, and you can also come to us.

Data protection contact: hello@mysanaa.com.

What we hold

Hosts: your name, email and phone, your account and business names, the events you create, your designs, logos and brand kits, the messages you send, and your settings. When paid features launch, payment details are handled by our payment provider; we keep records of what was paid.

Guests: what the host gives us (your name, and the email or phone used to reach you), your reply and how many are coming, your answers to the host’s questions, the names of anyone you bring, and whether you checked in. Guests never create an account; you reach your invitation through a private link.

Health details: some questions (dietary needs, allergies) can reveal health information. We only keep your answer if you tick the box agreeing to share it with the host, only the host and the co-hosts they allow can see it, and it is deleted 30 days after the event.

Everyone: to keep the service secure we briefly process technical data such as your IP address and browser, for example to stop abuse. We do not log phone numbers, emails or invitation links in plain text.

Why we use it, and on what basis

We do not sell personal data, show advertising, or make decisions about you by automated means that have legal or similarly significant effects.

Who sees it

The host of an event, and the co-hosts and helpers they add, see the guest list for that event. Vendors and print partners never see dietary or allergy answers. We share data with the service providers below, who process it only on our instructions, and with authorities only where the law requires it.

When these features launch, we’ll also use: Meta (WhatsApp Business) (delivering invitations by WhatsApp), Termii (delivering invitations by SMS), Paystack (payments), Anthropic (the Anna assistant). We’ll update this list before they do.

Data outside your country

Our main systems run in the European Union, and some providers are in the United States. When data leaves Nigeria, the European Economic Area or the United Kingdom, we rely on contracts with our providers that carry recognised data protection safeguards, as the Nigeria Data Protection Act and the GDPR allow. Ask us for a copy of the relevant safeguards.

How long we keep it

Your rights

Wherever you are, you can ask us to: tell you what we hold about you and give you a copy; correct it; delete it; stop or limit a use of it; object to a use based on our legitimate interests; and move it to another service. Where we rely on your consent, you can withdraw it at any time, and every email we send to guests has an unsubscribe link.

• Hosts can change their details in Settings, and delete their account in Settings › Your data.
• Guests can change their reply from their invitation link (unless the host has closed changes).
• Anyone can ask for a copy of their data, or for it to be deleted, on the data request page. We confirm it’s you by email and reply within 30 days.

If you’re unhappy with how we’ve handled your data, tell us first at hello@mysanaa.com. You can also complain to a regulator: in Nigeria, the Nigeria Data Protection Commission; in the EU, your local data protection authority; in the UK, the Information Commissioner’s Office.

Children

Hosts must be 18 or over. A host who invites anyone under 18 must have their parent’s or guardian’s agreement to share their details with us.

Keeping it safe

Each account can only reach its own data, enforced in the database itself. Invitation links can’t be guessed, admin access needs two-factor sign-in and every admin action is recorded, data travels encrypted, and we review our security regularly. If a breach puts your data at risk, we’ll tell you and the relevant regulator promptly, within 72 hours where the law requires.

Cookies

We only use cookies that the site needs to work. We don’t use advertising or analytics cookies, so there’s nothing to accept or reject. If that ever changes, we’ll ask you first.

Guests viewing an invitation get no cookies at all.

Changes

We’ll update this page when something changes, and tell hosts by email about important changes before they take effect.