Privacy Policy

1. Introduction & Scope

Welcome to IUsher ("we," "our," or "the Platform"), offering event hospitality, ushering coordination, and digital guest management services based in Amman, the Hashemite Kingdom of Jordan. This Privacy Policy explains how we collect, process, host, and safeguard personal information when event organizers, attendees, and visitors use our website, RSVP portals, WhatsApp messaging workflows, and on-site event coordination tools.

2. Roles & Data Processing Relationships

With respect to event guest information, the Event Organizer (our client requesting ushering services) acts as the Data Controller who determines the guest list, phone numbers, seating allocations, and invitation parameters.

IUsher acts as a Data Processor carrying out instructions to dispatch electronic invitations, collect RSVP confirmations, coordinate seating, and manage physical check-ins during the event.

For direct website service inquiries, administrative staff accounts, and platform security telemetry, IUsher acts as a Data Controller for those limited operational categories.

3. Information We Collect & Process

We process the following categories of information strictly as necessary to deliver our services:

• Guest & Attendee Data: Full or display names (English and/or Arabic), international phone numbers in E.164 format, invited party size, guest group or family affiliation, VIP designation, and dietary or seating assistance notes supplied by the organizer.
• Invitation & RSVP Data: Secure cryptographic tokens generated for individual/group invitations, attendance confirmation status (confirmed, declined, pending), confirmed party size, and submission timestamps.
• Check-In & Seating Data: QR codes, check-in timestamps, entrance gate identifiers, scanning device identifiers, and designated table and area allocations.
• WhatsApp Communications Data: Unique Meta message identifiers, delivery and read receipt status updates (sent, delivered, read, failed), error categories, and timestamps.
• Service Inquiries & Organizer Details: Full name, phone number, WhatsApp contact, optional email, event date, venue name, address, estimated guest count, and service specifications submitted via service request forms.
• Staff & Operational Accounts: Authenticated staff credentials (email and encrypted password hash), role-based access assignments, and administrative audit log records.
• Technical & Security Metadata: IP addresses, request headers, error logs, and security telemetry necessary to prevent malicious activities and ensure infrastructure integrity.

4. Purposes of Data Processing

We process personal data for the following specific purposes:

• Dispatching personalized event invitations and RSVP reminders via the WhatsApp Cloud API.
• Providing secure digital RSVP pages where guests can confirm or decline attendance.
• Coordinating seating allocations and guiding attendees to assigned tables on the day of the event.
• Validating invitations and recording attendee check-ins via QR code scanning at venue entrances.
• Communicating with event organizers regarding service requests, quotes, and event scheduling.
• Protecting the security, integrity, and operational availability of the IUsher platform.

5. WhatsApp Communications

We utilize the official Meta Cloud WhatsApp Business API to deliver approved template messages on behalf of event organizers.

Event organizers are responsible for ensuring they have an appropriate lawful basis (including prior consent where applicable) to provide guest phone numbers for event communications. We do not use guest phone numbers for unsolicited marketing, advertising, or spam.

6. Cloud Service Providers & International Data Transfers

To provide robust security, reliable database storage, and messaging delivery, we engage technical cloud infrastructure providers whose hosting facilities are located outside the Hashemite Kingdom of Jordan:

• Supabase Inc. (Database, Auth & Storage): Encrypted PostgreSQL databases, user authentication, and media storage hosted in Amazon Web Services (AWS) data centers located in Tokyo, Japan (ap-northeast-1). All data is protected with AES-256 encryption at rest, TLS 1.3 in transit, and database Row Level Security (RLS) policies.
• Vercel Inc. (Application Runtime & Edge Hosting): Serverless application hosting and global edge content delivery network infrastructure primarily located in the United States and European Union.
• Meta Platforms, Inc. (WhatsApp Cloud API): Global cloud messaging infrastructure utilized for delivering approved template invitations and receiving webhook delivery status receipts.

We do not sell, rent, or trade personal data to third parties. Cross-border processing is conducted strictly as necessary to deliver platform services, and compliance with statutory cross-border transfer requirements under Article 18 of the Jordanian Personal Data Protection Law No. 24 of 2023 remains subject to ongoing assessment with qualified legal counsel.

7. Data Retention & Immutable Security Audit Records

We implement technical and organizational security measures, including HTTPS/TLS encryption in transit, strict database-level access policies, and role-based operational permissions to protect personal data against unauthorized access, loss, or alteration.

Active guest and event data is retained only as long as necessary to fulfill event management services, provide operational summaries to organizers, and comply with legitimate legal or security auditing obligations.

8. Cookies & Client Telemetry

We use strictly necessary cookies and minimal performance telemetry to ensure secure and functional platform operation:

• Authentication Session Cookies (`iusher-auth.0`, `iusher-auth.1`): Encrypted session tokens with `Secure` flags in production, used strictly to authenticate staff and administrators accessing dashboard tools. Guests accessing RSVP links do not receive permanent authentication cookies.
• Language Selection (`NEXT_LOCALE`): Remembers your chosen interface language (English or Arabic) across visits.
• Performance Telemetry (Vercel Speed Insights): Lightweight performance metrics measuring page load speeds and Core Web Vitals, without deploying behavioral advertising or third-party marketing tracking cookies.

9. Data Subject Rights & Deletion Requests

Guests and users have the right to request access to, correction of, or deletion of their personal data from our active databases in accordance with applicable legal provisions. For detailed instructions on submitting a data deletion request, please refer to our dedicated Data Deletion Instructions page.

10. Security Incident Handling & Notification

We implement stringent technical controls to safeguard personal data against unauthorized access, loss, or alteration. In the event of a confirmed security incident affecting personal data, IUsher is committed to taking immediate containment and remediation measures, and making required statutory notifications to the competent supervisory authorities in Jordan and affected parties without undue delay in accordance with applicable laws.

11. Children's Privacy

Our services are not directed to individuals under 18 years of age. Where minor guests attend an event, their details are included solely as part of an invited party size under the direction and consent of the adult host or parent.

12. Updates to this Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. Updates will be posted on this page with an updated "Last updated" date.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us at: