Privacy Notice

MORROWLINE GLOBAL (Registration No. 202603116289 (NS0322389-P)), as operator of the application known as invAIte (“invAIte”, “we”, “our” or “us”) sets out this Privacy Notice to explain the purposes, types, sources, uses, disclosures, retention, security measures, choices and rights relating to personal data processed in connection with invAIte.

For the avoidance of doubt, MORROWLINE GLOBAL is a sole proprietorship registered in Malaysia. This public Privacy Notice identifies the registered business name and registration number only, and does not publish owner identity details or residential address details.

This Privacy Notice applies to our mobile applications, hosted web RSVP flows, Event pages, notification systems, calendar subscription tools, support channels, launch waitlist pages or forms, experience feedback prompts, legal-document delivery and acceptance flows, business metrics and analytics systems, optional Account Recovery, phone-transfer and Linked Devices features where enabled, Quick Tutorial guidance, account deletion request pages, privacy-choice pages and related services. It also applies where another User provides your details to invite or identify you in connection with an Event, or where an Account associated with a phone number is affected by a security or transfer process.

The purpose of this Privacy Notice is to explain to you:

• the type of personal data we collect and how we collect it;
• how we use personal data;
• the parties to whom personal data may be disclosed;
• how personal data may be stored, transferred, retained and protected; and
• how we intend to deliver the rights and choices available to you under Applicable Laws.

1.1 We strive to protect the confidentiality and security of personal data provided to, collected by or processed through invAIte (“Data”).

1.2 For the purposes of this Privacy Notice, “Data Controller” means the person or organization that determines the purposes and means of processing Data. For invAIte, the Data Controller is MORROWLINE GLOBAL (Registration No. 202603116289 (NS0322389-P)), as operator of the application known as invAIte, unless and until a different operator is formally identified in an updated notice or policy.

1.3 “Data Processor” means a service provider or other party that processes Data on behalf of the Data Controller. “Data Subject” means the identifiable individual to whom Data relates.

1.4 This Privacy Notice is intended for Account holders, Hosts, co-hosts, Invitees, Web RSVP guests, waitlist subscribers, persons whose details are uploaded or selected by another User, persons who enroll a Recovery Email or use an Account Recovery, PIN-reset, phone-transfer, Linked Devices or tutorial feature, support requesters, persons submitting reports, and any individual whose Data may be processed in connection with the Service.

1.5 Any service provider that we engage to process Data on our behalf is expected to process Data in accordance with applicable contractual, operational and legal obligations. Please understand that we may share Data with service providers and certain third parties as described in this Privacy Notice.

1.6 We will assess whether Applicable Laws require us to appoint a Data Protection Officer. If appointment is required, or if we choose to appoint one, we will publish or provide the relevant business contact details through this Privacy Notice or another appropriate public channel.

2.1 Certain Data is needed to enable us to provide the Service, process account creation, verify phone numbers, secure invite-gated access, operate Web RSVP flows, deliver notifications, administer Subscriptions, operate the launch waitlist and send launch notifications, record and verify legal-document acceptance, maintain privacy-safe business metrics and behavior analytics, protect linked sessions, respond to support requests, investigate abuse and comply with Applicable Laws. Additional Data may be required only when you choose to use an optional feature such as Account Recovery, phone transfer, Linked Devices, AI, Travel Time Assist, feedback or referrals.

2.2 If you decline to supply Data that is required for a particular feature, we may not be able to provide that feature or the Service to you. For example, without a verified phone number and certain account information, we may not be able to create or secure your Account or permit access to invite-only Event details.

2.3 Other Data is optional and tied to particular features, such as contact access, location access, camera access, photo-library access, media-library access, document access, Recovery Email enrollment, tutorial progress, experience feedback and certain referral or personalization functions. If you choose not to provide the optional Data or grant the relevant permission, some parts of the Service may not work or may be limited. Declining a Recovery Email does not by itself prevent normal Account use, but may mean that self-service recovery is unavailable if you later lose both your phone number and access to a trusted or linked device.

2.4 invAIte does not sell personal data. invAIte does not disclose Data to third parties for their own unrelated advertising purposes. We disclose Data only as described in this Privacy Notice, including to service providers, to other Users where Service functionality requires it, for legal and safety purposes, and in limited business-transfer situations.

3.1 Personal data generally refers to information that relates directly or indirectly to an individual who is identified or identifiable from that information. The types of Data we collect may vary according to the relationship, feature or Event context involved.

3.2 invAIte does not currently collect or process biometric identifiers or biometric templates as part of the Service. If we later introduce a feature that directly collects biometric data or another particularly sensitive category, we expect to provide additional notice and, where required, obtain consent before the relevant processing.

4.1 We may collect Data from the following sources:

5.1 Data may be used or processed by us, or by our service providers, for the following purposes:

1. to create, maintain, verify and secure Accounts;
2. to authenticate Users through Firebase phone verification or other verification mechanisms;
3. to secure Accounts, devices, sessions, invite flows, Web RSVP access and calendar tokens;
4. to match selected Invitees to registered Users through privacy-preserving methods where appropriate;
5. to route invitations and support Event access controls;
6. to display and manage Event details, guest lists, RSVPs, polls, threads, co-host workflows, reminders, galleries and expense coordination records;
7. to provide Web RSVP access tied to invite status, phone verification, session restrictions and Event rules;
8. to send push notifications and other operational or service-related communications;
9. to enable optional features that rely on permissions such as contacts, location, camera, photo library, media library or document access;
10. to process, validate, normalize or extract data from uploaded images or documents where a feature requires it;
11. to generate, serve, revoke and secure tokenized calendar subscription feeds;
12. to administer Subscriptions, trials, entitlement checks, plan status, cancellations and store-managed refund or billing status;
13. to respond to support requests, problem reports, safety issues, complaints and moderation reports;
14. to investigate abuse, spam, fraud, unauthorized access, safety concerns, violations of Terms and Conditions or suspicious activity;
15. to improve reliability, troubleshoot errors, debug issues, maintain service integrity, perform audit and risk management and protect the Service;
16. to operate launch waitlist pages or forms, understand launch demand by preferred platform and country, and send invAIte launch notifications to waitlist subscribers;
17. to request, evaluate and act on optional experience feedback, ratings and support context;
18. to record, verify and audit legal-document acceptance, versions, effective dates, hashes and related consent metadata;
19. to generate privacy-safe business metrics, behavior analytics, usage, reliability, DAU/MAU, funnel, Premium, AI, referral and product trend reporting, including aggregated or de-identified rollups where appropriate;
20. to enroll and verify an optional Recovery Email, administer PIN reset and Account Recovery, apply security-settling or transfer-hold periods, verify phone ownership, send security notices, prevent account takeover, resolve recycled-number or ownership conflicts, support manual review and converge an approved account or phone transfer;
21. to create, display, validate, limit, revoke and audit Linked Devices and server-controlled sessions, show sanitized device and last-active information to the Account holder, bind notification delivery to an active session, permit remote logout or unrecognized-device reporting, and enforce session limits;
22. to store, display and notify the relevant parties about private RSVP notes, pre-reply edits and private Host or co-host replies under the applicable invitation permissions;
23. to provide, resume, skip and replay bundled tutorials, synchronize Account tutorial progress, retain anonymous installation-suppression state, and measure bounded tutorial reliability without using tutorial progress to grant access or make security decisions;
24. to issue, validate and administer referral codes, determine qualification and rewards, preserve anonymous qualified credit, and prevent self-referral, duplicate claims, repeated identity cycling, fraud and abuse;
25. to deliver announcements, changelogs and legal notices, record seen, acknowledged, dismissed or popup-suppressed state, and require existing Account holders to re-accept specified legal-document versions where the applicable runtime policy or law requires it;
26. to enforce our contracts, protect legal rights and defend claims;
27. to comply with legal, regulatory, court, law-enforcement, App Store or governmental requirements; and
28. for all other purposes incidental and associated with any of the above or otherwise permitted by Applicable Laws.

5.2 Where AI Features are used, Data may be processed to receive the User’s prompt or instruction, generate or repair a draft, validate the draft against app rules, generate Host Dashboard AI Summary, Guest Event AI Brief, Signals AI Brief, Home Dashboard AI Brief or AI translation output where available, enforce Premium entitlement and usage caps, apply safety filters, prevent abuse, debug failures and improve reliability. AI Features are optional and are not intended to make legal, financial, medical, employment, credit, housing, insurance or similarly significant decisions about individuals. For supported translation, the server may retrieve authorized source text by identifier, redact phone-, email- or contact-like literals before model processing, restore placeholders only in the authorized response, and avoid caching a translation where contact details are detected.

5.3 Where App Check, reCAPTCHA, OTP, Web RSVP or invite-gated access is used, we may process technical and security signals to verify requests, prevent fraud, protect invite-membership privacy, enforce lockouts and throttles, stop unauthorized access, avoid unnecessary SMS sends, preserve system integrity and comply with platform or legal obligations.

5.4 Where location, places, Event scheduling, timezone, recurring-Event, calendar subscription, Travel Time Assist or reminder features are used, we may process Event dates, times, time zones, location search terms, selected places, venue coordinates, foreground-location permission state, one-off origin information for a user-requested estimate, privacy-safe origin bucket hashes, travel mode, duration, distance, suggested leave-by or estimated-arrival metadata, reminder state, calendar-token metadata and access logs to create, display, secure and update Event details and user-private travel guidance. Mobile venue autocomplete may use a bounded native Google Places search session or an authenticated server fallback. Autocomplete tokens and unselected prediction content are intended to remain memory-only and end on selection, cancellation, timeout, app backgrounding or session closure. Raw current-location origin coordinates are not intended to be stored as persisted travel-estimate records.

5.5 Where experience feedback, business metrics, behavior analytics, legal consent receipts, telemetry, observability or connectivity/offline-state features are used, we may process ratings, optional feedback text, prompt cadence, product activity receipts, session or period counters, legal document versions, effective dates, hashes, acceptance timestamps, runtime policy identifiers, app version/build, platform, locale, device/app context, connectivity state, operation identifiers and related diagnostics to understand quality, support Users, improve reliability, verify legal acceptance, plan the Service, prevent abuse and troubleshoot issues. Experience feedback records are restricted to authorized operational, support or back-office access and are not public User Content.

5.6 Where the launch waitlist is used, we may process email address, preferred launch platform, country, submission timestamp, source page or form, consent/confirmation status, opt-out or suppression status, email delivery status such as bounce or unsubscribe signals, and basic technical/security metadata needed to operate the form and send launch notifications. The country field is intended for launch planning and availability communication, not precise location tracking. Huawei or other platform preference information is used for interest assessment and does not mean that platform support is guaranteed at launch.

5.7 Where Account Recovery, PIN reset or phone transfer is enabled, we may process Recovery Email and phone proof, command, challenge, settling, hold, cooldown, consent, delivery, acknowledgement, objection, session-revocation, manual-review and audit data to assess ownership, protect existing Accounts, complete or reject a request, preserve account-data separation and respond to security disputes. A security warning to an Account already associated with a destination number is intended to be generic and limited to information reasonably necessary to protect that Account.

5.8 Where Linked Devices is enabled, we may process session and installation identifiers, session generation, state, creation, expiry and last-active information, sanitized device metadata, PIN step-up, revocation and replacement commands, security notices, session-bound notification endpoints and limited local encrypted presentation cache to secure the Account, display active sessions, enable remote logout and deny future access to revoked or expired sessions.

5.9 Where private RSVP-note features are used, we may process the note or question, RSVP status, revision, edit count and timestamps, Host-read state, private reply text, replying Host or co-host identity and reply timestamp. This Data is shown only to the relevant Invitee and authorized Host or co-host side, subject to operational support, legal preservation and security access described in this Privacy Notice.

5.10 Where tutorial, referral, runtime-message or existing-account legal-acceptance features are used, we may process tutorial version and progress, anonymous installation suppression, referral relationship and qualification records, message receipt state, and versioned legal-acceptance metadata to provide the feature, prevent abuse, coordinate presentation, prove acceptance and maintain audit records.

5.11 Behavior analytics may derive aggregate or host-scoped insights from naturally occurring Event-coordination activity, including RSVP source and timing, explicit attendance records, plus-ones, Web RSVP verification and supported thread, poll or bill engagement. invAIte does not intend to create a public platform-wide guest rating, sell these insights, use them for unrelated advertising profiling, or use them as the sole basis for a decision that bans an Account, removes Event access, changes payment truth, grants Premium, or determines employment, credit, housing, insurance or similarly significant rights. Indicators and forecasts may be incomplete and are not guarantees of attendance or future conduct.

6.1 Contact access is optional and is intended to help Users invite people more easily. If a User grants contact access, invAIte may read contacts locally on the device so the User can search, filter and choose who to invite.

6.2 We do not describe invAIte as automatically uploading a User’s entire address book to our backend by default for invitation matching. For invitation routing and registration checks, the product is designed around the contacts or phone numbers the User actually selects, enters or submits for an invite flow.

6.3 We do not use imported contact data for unrelated marketing to those contacts.

6.4 invAIte may process limited Data about persons who do not yet have an Account, including a name supplied by a Host or inviter, phone number, phone hash, invitation status, guest-list placement, RSVP-related data, Event access records, verification records and support or moderation records related to an invitation or Event.

6.5 Non-user Invitee Data may come from Hosts, inviters, co-hosts, the Invitee’s own Web RSVP interaction, Firebase phone verification or our security and logging systems. Such Data may be used to deliver or route invitations, match Invitees to existing Accounts where appropriate, protect Web RSVP flows, maintain guest lists, preserve Event records, investigate abuse and comply with law.

6.6 Non-users may contact us through support@invaite.app or https://invaite.app/privacy-choices.html to request access, correction, deletion or limitation of certain processing, or to ask us to stop further invitations where appropriate.

6.7 Where a person asks us not to send or route further invitations, we may retain limited suppression data, such as a phone number hash or similar identifier, for the purpose of honoring that request, preventing future unwanted invitations, preserving safety controls and maintaining abuse-prevention or compliance records.

6.8 We may not be able to delete or alter information that forms part of a Host’s Event records, invite history, moderation records, legal records or records we must keep for security, fraud prevention, dispute resolution or compliance reasons. In those cases, we may instead limit future use, suppress certain routing or de-identify Data where feasible.

6.9 If a phone-transfer request affects a number already associated with another Account, we may process limited participation, warning, acknowledgement, objection and cooldown Data for that Account. We do not intend to disclose the requester’s unnecessary identity or give either person access to the other Account’s Event, billing, legal, referral, report or audit records merely because the same phone number is involved.

7.1 For the purposes above and for the purpose of providing, securing and operating the Service, Data may be disclosed to the following parties:

8.1 invAIte may use service providers or infrastructure that process, store or access Data outside Malaysia. As a result, Data may be transferred to, stored in, or accessed from jurisdictions that may not have privacy laws equivalent to those in Malaysia.

8.2 Where we transfer Data across borders, we intend to do so where we have an appropriate basis and with reasonable safeguards, contractual commitments or operational controls appropriate to the circumstances and Applicable Laws.

9.1 We use administrative, technical and organizational measures designed to help protect Data, including access controls, authentication flows, hashed identifiers in certain contexts, role-based restrictions, logging, rate-limiting, storage controls and security rules.

9.2 No system is completely secure. We cannot guarantee absolute security, uninterrupted availability, successful recovery or that unauthorized access will never occur. You also play an important role in security and should keep your phone, email account, OTPs, PINs, invite links, calendar subscription URLs, devices and other credentials secure, review Linked Devices where available, and promptly report a lost device, compromised Recovery Email or suspicious transfer request.

9.3 If you receive Data or information through the Service which is not intended for you, you should notify us promptly at support@invaite.app and should not misuse, disclose, copy or retain the information except as necessary to report the issue.

9.4 Security controls may include hashed identifiers, encryption of selected recovery-delivery targets, short-lived challenges, TTL cleanup, rate limits, security-settling and transfer-hold periods, fresh proof requirements, session generations, server-controlled revocation, generic warnings, per-device acknowledgements, manual review and audited support actions. These controls reduce risk but cannot eliminate delivery failures, third-party compromise, recycled-number disputes or user error.

10.1 We retain Data for as long as reasonably necessary for the purposes described in this Privacy Notice, including service delivery, Event integrity, recordkeeping, legal compliance, security, enforcement, dispute resolution, audit, fraud prevention, backup and archival purposes. The periods below are operational targets and may be extended where law, disputes, safety incidents, fraud prevention or technical constraints require longer retention.

11.1 If you created an invAIte Account, you may generally initiate Account deletion from within the app through the account settings, profile flow or another deletion mechanism made available by invAIte. We also provide a public outside-app request channel at https://invaite.app/delete-account.html.

11.2 For broader privacy choices, including rights requests and non-user Invitee requests, we also provide https://invaite.app/privacy-choices.html.

11.3 We may require identity verification before completing deletion, including phone verification, in-app confirmation, a current PIN, supporting information or similar checks appropriate to the circumstances.

11.4 A completed and verified deletion request generally results in disabling or deleting account access and associated authentication access, deleting or detaching certain profile data, deleting certain User-linked records where operationally appropriate, and anonymizing or de-linking certain historical records where full removal would break Event history or record integrity.

11.5 Account deletion does not necessarily mean every historical or downstream record will be erased. We may retain, archive, anonymize, de-identify or preserve certain information where reasonably necessary to maintain Event integrity, preserve invite history, keep safety or moderation records, comply with law, resolve disputes, enforce rights, honor suppression requests, maintain backups or preserve system integrity.

11.6 Deleting an invAIte Account does not by itself cancel an Apple App Store or Google Play Subscription. If you have an active store-managed Subscription, you must also cancel it through the relevant store interface to stop future renewals.

11.7 Account deletion may revoke active linked sessions, remove Account tutorial progress, disable Recovery Email factors and terminate or restrict pending recovery, PIN-reset or phone-transfer processes. We may retain or de-identify limited security, consent, referral, suppression, ownership-conflict, audit and fraud-prevention records where reasonably necessary and permitted by Applicable Laws. A security process involving another Account may continue or be preserved where necessary to protect that other Account or resolve a dispute.

11.8 Deleting an Account removes cloud tutorial progress associated with that Account where operationally supported, but it may not erase an anonymous local installation-suppression flag that contains no Account identifier. That local state may remain until the app is uninstalled, its local application data is cleared or the state otherwise expires. A qualified referral credit may also remain in anonymous form to prevent repeated reward claims.

12.1 Subject to Applicable Laws and lawful limitations, you may have rights in relation to your Data, including the right to request access, request correction of inaccurate or outdated Data, withdraw consent where processing is based on consent, request limitation or cessation of certain processing, request data portability where provided by law and technically feasible, object to direct marketing or certain profiling, request information about how Data is used or disclosed, and make a complaint regarding our processing practices.

12.2 To exercise a request, contact us at support@invaite.app or use https://invaite.app/privacy-choices.html. We may need to verify your identity, request additional information or decline a request where Applicable Laws permit us to do so. Where allowed by law, we may charge a reasonable fee for an access request.

12.3 We aim to respond within the timeframes required by Applicable Laws. If we need more time where the law permits, we will tell you. If you act for a minor or another person and the law permits it, we may request proof of your authority.

12.4 Malaysia is our primary compliance baseline because the operator is established in Malaysia and the Service is operated from Malaysia. Depending on where a Data Subject is located, other privacy laws may also provide non-waivable rights or require additional notices.

12.5 Where Malaysian law provides a right to data portability, you may request that personal data supplied by you and processed through automated means be transmitted to you or, where technically feasible and compatible, directly to another data controller, subject to verification, security, the rights of other persons and lawful exceptions. We may provide the Data in a commonly used electronic format or another appropriate form depending on the request and available systems.

12.6 Where the EU General Data Protection Regulation, UK GDPR or similar laws apply, a Data Subject may have rights to be informed, access Data, rectify Data, erase Data, restrict processing, receive portable Data, object to certain processing, withdraw consent where processing is based on consent, and complain to a competent supervisory authority, subject to legal limits and verification.

12.7 Where California or similar U.S. state privacy laws apply, a consumer may have rights to know/access, delete, correct, opt out of sale or sharing, limit certain use or disclosure of sensitive personal information and not be discriminated against for exercising privacy rights, subject to legal thresholds, exceptions and verification. invAIte does not sell personal data and does not disclose Data to third parties for their own unrelated advertising purposes.

12.8 If a request relates to Data supplied by another User, Event integrity, security or Account Recovery, another account holder’s rights, safety, fraud prevention, billing, legal claims, backup systems, account deletion boundaries, invite security or the rights of other Users, we may limit, delay, refuse, anonymize, preserve or otherwise handle the request as permitted or required by Applicable Laws. We may need to verify identity and authority before acting on a request.

12.9 Where Applicable Laws provide a right to object to profiling or request human review of an automated decision, you may contact us through the channels in Clause 12.2. The current Service does not intend to use behavior analytics or AI as the sole basis for a decision producing legal or similarly significant effects about an individual. We may still use automated security, fraud, access-control, rate-limit and abuse-prevention checks where permitted by law and subject to appropriate safeguards.

13.1 invAIte may send operational or service-related communications such as verification messages, security notices, Event invitations, Event reminders, support replies, account-related notices, Subscription status notices and legal notices.

13.2 If we use Data for direct marketing in a way that requires notice, consent or choice under Applicable Laws, we will provide the relevant opt-out or control mechanism. You may also contact us to object to direct marketing through support@invaite.app or https://invaite.app/privacy-choices.html.

13.3 Operational, security, billing and service-critical messages may still be sent where reasonably necessary even if you opt out of marketing communications.

13.4 If you join an invAIte launch waitlist, we will use the email address you provide to send launch-related notifications only, such as availability, early-access or launch-status messages relevant to invAIte, your preferred platform or your country. We do not treat launch waitlist emails as consent to unrelated newsletters, third-party advertising or promotional marketing. If we later wish to use waitlist details for a broader newsletter or promotional marketing, we expect to provide a separate notice, consent or opt-out mechanism where required by Applicable Laws.

13.5 If you verify a Recovery Email, we use it for account-security, PIN-reset, recovery, transfer, session-revocation and related protection messages only. We do not treat a Recovery Email as consent to newsletters or promotional marketing. Security-critical notices may be sent through in-app notice, push, email or SMS notwithstanding ordinary notification-category preferences where reasonably necessary to protect an Account or affected account holder.

14.1 invAIte is not intended for children under thirteen (13) years old.

14.2 If you are under the age of majority where you live but at least thirteen (13), you may use invAIte only with parent or guardian involvement and acceptance of the applicable terms.

14.3 Because invAIte involves real-world coordination, Event attendance, guest interactions, media sharing, location-related features and possible document uploads, parents and guardians should supervise use by minors appropriately.

14.4 Users should not upload minors’ personal data, images, documents or sensitive information unless they have lawful authority and any required consent. If you believe a child under thirteen (13) has provided Data through invAIte without authorization, contact us at support@invaite.app.

15.1 Our web surfaces may use essential technical mechanisms such as session identifiers, local storage, server-side session controls, request logs, throttling tools and similar technologies to maintain Web RSVP flows, support security, preserve session state, diagnose errors and operate the Service.

15.2 We may collect limited telemetry and technical diagnostics, including analytics events, performance timings, crash reports, non-fatal error information, device/app context, connectivity state and debugging signals, to help maintain and improve reliability, security, support and product quality. Hidden staging or TestFlight diagnostic surfaces may generate a sanitized report held locally in memory for a tester to review or copy; those reports are not intended to be uploaded as production telemetry or to contain raw phone numbers, email addresses, OTPs, PINs, tokens, invite secrets, Event content or exact coordinates. We do not describe the current invAIte product as relying on third-party advertising cookies, cross-site ad tracking or similar advertising profiling tools as a core part of the present implementation.

15.3 If we later introduce non-essential tracking technologies, we may provide additional notice or choices as required by Applicable Laws.

16.1 If we become aware of a personal data breach that triggers notification obligations under Applicable Laws, we will assess the incident and take steps we consider reasonably necessary in the circumstances, which may include containment, investigation, remediation and notification.

16.2 Where required by Applicable Laws, we will notify the relevant Commissioner or authority without unnecessary delay and within the required timeframe after becoming aware of the breach, and notify affected Data Subjects where such notification is legally required.

16.3 The timing, content and recipients of any notification will depend on Applicable Laws, the nature of the incident, the risk involved and the information reasonably available at the time.

17.1 We may amend, supplement or replace this Privacy Notice from time to time. If we make material changes, we may provide notice through the app, website, support channels or other reasonable means.

17.2 The revised Privacy Notice will apply from the updated effective date unless otherwise stated.

17.3 For a material change, invAIte may provide a notice-only update or may require an existing Account holder to review and affirmatively accept specified Terms and Conditions and Privacy Notice versions before continuing to use all or affected parts of the Service. Where acceptance is required, we may record a versioned legal-consent receipt and the bounded policy identifier that caused the gate. Continued use will not be treated as the sole acceptance method where Applicable Laws or the nature of the change requires affirmative agreement.

18.1 If you have questions, concerns, requests or complaints about this Privacy Notice or our handling of Data, contact:

• Email: support@invaite.app
• Privacy Contact: Privacy Contact (support@invaite.app)
• Legal Notices / Privacy Requests: support@invaite.app. A physical service address is not published in this public version and may be provided where legally required or through a designated representative if appointed.
• Data Controller: MORROWLINE GLOBAL (Registration No. 202603116289 (NS0322389-P)), as operator of the application known as invAIte
• Account Deletion Request Page: https://invaite.app/delete-account.html
• Privacy Choices Page: https://invaite.app/privacy-choices.html

18.2 If you are dissatisfied with our response, you may also have the right to complain to the relevant Malaysian personal data protection authority or other competent regulator.

18.3 This Privacy Notice may be made available in English and Bahasa Malaysia. If there is any inconsistency between versions, the English version shall prevail except where Applicable Laws require otherwise.