Greetings Island

GDPR overview

Concrete, and better documented than most tools at this price. The privacy policy, last updated on 25 September 2025, names the EU and UK GDPR alongside the CCPA, VCDPA, CPA and CTDPA, and the RSVP page states plainly that the service is GDPR compliant. An Article 27 representative is designated: Prighter Group, reachable at https://prighter.com/q/14157699. Transfers from the EEA, the UK and Switzerland to Israel rely on the adequacy decisions those authorities have granted Israel; transfers elsewhere use Standard Contractual Clauses, available on request. Access, rectification, erasure, restriction, objection and portability requests go to privacy@greetingsisland.com, with a right to complain to a supervisory authority. Two gaps remain: no Data Processing Agreement is offered, and no named subprocessor list is published.

Who owns the data?

Under the terms of service the customer keeps ownership of everything they upload - text, photos, images, videos and event details, together called the Customer Content. In exchange the customer grants Clear Coast Ltd. and its subprocessors a broad licence: irrevocable, perpetual, non-exclusive, worldwide, royalty-free and sublicensable, but limited to operating and maintaining the platform. Greetings Island is the data controller for its own users' data and only the data processor for guest data, where the host remains controller. Feedback and suggestions become the publisher's property outright. After termination the publisher may delete Customer Content without keeping a copy, so exporting in advance is the customer's responsibility.

Reuse rights

Customers may reuse their own designs and content freely, without asking permission. The licence runs the other way for the publisher: Clear Coast Ltd. and its subprocessors may access, copy, store, distribute and display Customer Content solely to run the platform and to resolve technical or security problems. Reuse of the platform's own material is tightly bounded - the terms forbid reselling, sublicensing, redistributing or transferring any work created through the service, and forbid using it to build a competing product. Personal data feeds service delivery, analytics, marketing and fraud prevention. Both AI pages state that customer photos and event details are never used to train AI models, though the privacy policy itself says nothing about training and lists generative AI imaging services among its subprocessors. Separately, the publisher declares that it has sold or shared network activity, geolocation and commercial information with advertising partners; users can opt out through the cookie banner, the Your Privacy Choices control, or a Global Privacy Control signal.

Data retention & training

Hosting summary

The privacy policy states that Greetings Island and its authorised service providers maintain, store and process personal data in the United States, Israel, and other locations as reasonably necessary to deliver the service. The company is headquartered in Israel, a jurisdiction the European Commission, the UK Information Commissioner's Office and the Swiss Federal Data Protection and Information Commissioner all treat as offering adequate protection; transfers from the EEA, the UK and Switzerland to Israel rest on that basis. Where data moves to a country without an adequacy finding, Standard Contractual Clauses are used and a copy can be requested from privacy@greetingsisland.com. Customers cannot choose a hosting region and no data residency guarantee is offered. SSL encryption is advertised on the RSVP page. Note that the domain's public IP address resolves to a Cloudflare anycast node, which reflects the CDN edge rather than where the data actually sits.