Last updated 21 October 2026
Esho (“we”, “us”) makes digital invitations for weddings and celebrations in Bangladesh. This policy covers the Esho website and the invitation pages your guests open. If anything here is unclear, write to us at hello@esho.app.
What we collect
Your account
- Name, and the mobile number or email address you sign in with.
- If you sign in with Google or Facebook: your account ID with that service, your name, your email address and your profile photo link. We never see or store your Google or Facebook password, and we don’t post anything on your behalf.
- If you use an email and password: your password is stored only as a secure one-way hash.
Your invitations
- What you type into an invitation: names, dates, times, venues, wording and RSVP contact details, and any photos you add.
- The design you chose and when you saved or published it.
Payments for Premium designs
- The amount, whether you paid with bKash or Nagad, the number you paid from and the transaction ID, so we can match your payment. We never ask for or see your bKash or Nagad PIN.
Technical information
- A sign-in cookie that keeps you signed in. We don’t use advertising cookies.
- Your IP address, briefly, to limit repeated sign-in attempts and protect accounts from misuse.
- Your browser also keeps your latest draft on your own device, so you don’t lose work.
How we use it
- To run your account, save your invitations and publish them at the link you share.
- To send sign-in codes by SMS, password reset emails and messages about your orders (for example, the link once your payment is confirmed).
- To check Premium payments and keep records of orders.
- To keep the service safe: stopping abuse, spam and fraud, and taking down invitations that break our terms.
We don’t sell your information and we don’t use it for advertising.
Who can see your invitation
A published invitation can be opened by anyone who has its link, so share it with the people you’re inviting. Invitation pages are hidden from search engines. Guests reply to you directly (for example on WhatsApp); we don’t keep their replies.
Services that help us run Esho
We use trusted providers who process data only to provide their service to us:
- Vercel: hosts the website.
- Supabase: stores accounts, invitations and orders in its database.
- Google and Facebook (Meta): only if you choose to sign in with them.
- An SMS provider (for sign-in codes and order messages) and an email provider (for password resets).
These providers may store data on servers outside Bangladesh. We may also share information if the law requires it.
How long we keep it
- Your account and invitations: until you delete them or your account.
- Order records (amount, method, transaction ID): kept after account deletion for accounting, without your account details attached.
- Sign-in codes expire after 5 minutes and password reset links after 1 hour.
Your choices
- Change your name, email, password and sign-in methods in Account → Settings.
- Unpublish or delete any invitation from My invitations.
- Delete your account and all your invitations at any time: see Delete your data.
- Ask us for a copy of your data or to correct it by writing to hello@esho.app.
Children
Esho is for adults planning events. Accounts are not meant for anyone under 18.
Changes
If we change this policy we’ll update the date at the top, and tell you in the app or by email for important changes.
Contact
Questions or requests about your data: hello@esho.app.