Privacy Policy

ئاهەنگ (Ahang) is a digital invitation service operating from Erbil, Kurdistan Region, Iraq. Our website is ahang.krd.

Contact us by email: support@ahang.krd. Privacy and deletion requests go the same way, because it leaves you with a written record.

There are no analytics tools on this site. No Google Analytics, no Facebook pixel, and no advertising tracker of any other kind.

We do not sell your information and we do not give it to any third party for advertising.

We do not build user profiles and we do not track guests' behaviour.

On the order form we ask for: the names, the date of the event, the venue, a phone number, an email address, and the design and package you chose.

The phone number is only there so we can reach you if something is wrong with your order. We send nothing to it — your edit link goes to your email.

An email address is required, because that is where we send your edit link after payment — the link you use to fill in your invitation. We use it only for that and to talk to you about your order. We send you no marketing and we give your address to nobody.

This information stays in your own browser for up to 24 hours, so you can carry on if you close the page, and then it clears itself.

Payment happens on Wayl's payment page — Wayl is an independent payment company. When you press the pay button you are taken from here to there, and you pay there by FIB, FastPay or bank card.

Your card number, your bank password and your verification code never reach us and are never stored by us. What we record is: the amount, the payment method, an identifier for the payment, and when it was made.

To find out whether your payment arrived, we ask Wayl ourselves. They send us nothing beyond that.

RSVP replies: the guest's name, whether they are coming, how many people, a phone number (optional), and a short message.

Wishes: a name and a message. They appear on the page only after the host has approved them.

This information belongs to the host. We, as the operators of the system, can see it, but we do not use it for anything else.

On some packages guests can upload photos. Those are often photos of other people, who have never had any agreement with us.

The album opens the day after the event at 9 in the morning — before that nobody sees it, not even the host. Uploading closes three days after the event.

If you are in a photo and would rather it did not stay: you can ask the host, or contact Ahang directly by email (support@ahang.krd). We will remove it, without asking the host's permission.

The host decides what stays in their album. We store the photos and are responsible for removing them when we are asked to.

On some packages every guest has their own link and their own QR code. When it is scanned at the door, the person's name and the time they came in are recorded.

That is attendance information about someone who has never used our site. We received the list from the host.

The host's access to these pages closes 14 days after the event.

The edit link, the guest links and the QR codes work without any sign-in. Anyone who has the link has the same access.

That is how the system works, not a fault. Don't send your links to anyone. If a link gets out, tell us and we will lock it.

We send the edit link to the email address you wrote on the order. That means anyone who can reach that inbox can reach your invitation too — so use an address only you open.

The edit link works for 21 days. The management pages close 14 days after the event.

We set three cookies, none of them for advertising: the first remembers the site's language; the second recognises your order, so you can come back to it if you closed the payment page; the third is only for admin sign-in and is only for us.

Your order stays in your browser for up to 24 hours. That is at your end, not ours.

There are no advertising or tracking cookies.

If a host sets music from YouTube, the guest's browser connects to YouTube, and YouTube may set a cookie of its own.

If a map appears on the invitation, Google receives the guest's IP address.

Both of these are outside our hands and fall under those companies' own policies.

We log IP addresses to prevent abuse — so nobody can send a thousand false replies.

We keep a small security log: what changed, when, and via which link. It holds no names, no numbers and no message content.

Data is stored with Supabase and the site runs on Vercel. The servers are outside Iraq.

We use two other services, and each takes only what its job requires: Wayl carries out the payment, and Resend sends the email that carries your link.

Every connection is encrypted.

A published invitation: 6 months after the date of the event. Extended free of charge on request.

Guest names, party sizes and wishes: deleted 30 days after the event.

Album photos: for the life of the invitation. Download your photos before it ends.

The edit link: 21 days from when it was created.

Email address and payment record: for the life of the invitation. The payment record stays after that too, because it is the proof of purchase.

An order that was never paid for: after its link expires and a further seven days, it and everything you uploaded are deleted completely.

You are the one who gives us your guests' names and numbers. They have never had any agreement with us.

You must have the right to use that information, and you must tell your guests that the invitation collects replies, party sizes and photos.

You can ask for a copy of your information, or for it to be corrected, or for all of it to be deleted.

Contact us by email: support@ahang.krd. We carry out deletion requests within 30 days.

You must be 18 or older to buy an invitation.

If we change something, we update the date at the top. Significant changes are announced on this page.