Privacy policy.

Last updated August 18, 2026

Who this covers

Mabrook is operated by Dprime Solutions for mabrook.com.lb. This policy covers two kinds of people: clients who purchase a package and build an event, and guests who receive an invitation link from a client. It does not cover third-party sites you reach through links on this site.

What we collect

From clients

• Account details: name, email, phone number, password (stored hashed, never in plain text).
• Event content: event details, themes, custom questions, and any text or images you add to invitations.
• Billing details processed through WooCommerce at checkout: billing name, email, phone, and country. Card or bank details are handled by the payment method itself; Mabrook does not store card numbers.

From guests

• RSVP responses: attendance, guest count, and answers to any custom questions the client added.
• Contact details a guest chooses to share on the RSVP form, such as a phone number or email, when the client's event asks for one.
• Photos and videos a guest uploads to a client's event gallery, plus the approximate time and the upload page they were sent from.

How we use it

• To run the invitation, RSVP, and gallery features a client's package includes.
• To send transactional email and WhatsApp messages tied to an event: invitations, reminders, and RSVP confirmations.
• To process payments, provision or renew a package, and apply any add-ons or discounts.
• To protect the platform: rate limiting logins, auditing sensitive admin actions, and blocking abuse.

Where it is stored

Event data lives in the Mabrook database on our WordPress hosting. Uploaded photos and videos are never placed at a public, guessable URL: they are served either from a protected folder behind a token-checked link, or from private object storage such as Cloudflare R2 through short-lived signed links. A client's storage provider is chosen by the client or Mabrook staff at setup.

Who we share it with

• Payment processors, to complete a checkout through WooCommerce.
• Messaging providers, to deliver WhatsApp notifications when a client enables Cloud API sending, or the guest's own device when share-link sending is used instead.
• Cloudflare, when a client's event storage or custom domain uses Cloudflare services.

We do not sell personal data, and we do not share guest data with anyone outside the client's own event.

How long we keep it

Client and event data is kept for the life of the subscription and for a reasonable period after expiry in case the client renews. Guest uploads follow the storage window set on each event; once an event's storage period ends, files are scheduled for removal along with the event's public links.

Your choices

• Clients can edit or delete event content, guest households, and uploaded media from their portal at any time.
• Guests can ask the client who sent their invitation to remove their RSVP or uploaded photos.
• Anyone can contact us using the details below to ask what data we hold and to request its deletion, subject to what we need to keep for billing and legal record-keeping.

Contact

Questions about this policy can be sent to hello@mabrook.com.lb or through our contact page.