Guest invitations, reminders and private replies

Open a wedding’s Guest messages page. Invitations, announcements and RSVP reminders use the existing household invitation and event permissions. A household receives its own private link; sending email does not create a second guest list or share business finances.

Prepare the households and events

Create households and events in Households and event invitations. Select the guests invited to each event, including a rehearsal dinner or another private gathering. In Guest messages, edit the event’s local time zone, start, RSVP deadline, location, dress code and guest instructions. Times in the email use that event’s time zone. To add, remove or reinvite individual guests after creation, open the reviewed event invitation list. That separate review preserves reply history and operational assignments. Previously approved messages hold when the reviewed event audience changes; review the current recipients again before delivery.

Check each household email. A contact edit increments its contact version and holds messages reviewed for its previous contact. It does not merge households that share an address and does not silently reset an opt-out or delivery failure.

Newly created invitation links are retained encrypted when the integration encryption key is configured. Existing links remain valid. If an older link was not retained, paste that household’s current private invitation and choose Verify and retain this existing link. This verifies its fingerprint without changing it. A lost, expired or revoked invitation must be explicitly replaced through the existing Hospitality guest-reply controls. Saved RSVPs and response history remain intact.

Review a message before delivery

Write an invitation or announcement, select its event if applicable, and choose the exact households. A rehearsal invitation contains only the guests in that household invited to the selected event. Saving creates a private draft. Choose Review exact recipients and email to see every selected household, its guest names, the actual message, event instructions, sender, schedule and maximum cost. Private links are represented by labeled placeholders in the review; the retained email contains only its own household’s capability.

The review lasts 30 minutes. Changed content, recipients, contact/access versions, event details or price require a new review. An administrator in the owning workspace must approve the exact delivery and its cost. A connected business needs an explicit guest communication grant to prepare drafts; that grant does not authorize spending from another business’s account.

Email price comes from deployment configuration. The owning workspace must explicitly enable its usage account and set a spending cap, including when the configured unit price is zero. Each email reserves its reviewed rate before dispatch. Unknown provider acceptance keeps that reservation in place; confirmed acceptance settles it. A later price change does not reprice an existing delivery.

RSVP-aware deadline reminders

Choose RSVP deadline reminders, an event, and up to four offsets before its deadline. Each occurrence preserves the deadline’s local clock time, including daylight-saving changes. Only the reviewed households enter that schedule. New guests, changed contacts, invitation replacements and changed event details require another review.

Before each delivery, the service checks the current invitation and event. It stops that household’s reminder when all its invited guests have answered, including declines, or when a verified email reply arrives for that approved sequence. A private Guest Hub message is not automatically treated as an authenticated email reply. A closed event, expired link, stopped household email or expired delivery window prevents sending. Past scheduled reminders are not silently sent days later.

Pause, cancellation and interrupted delivery

Pause future delivery from the draft’s history. Resume only the retained approved schedule; an edited draft needs a fresh review. A held delivery can be checked and explicitly retried using its original message and provider key. Cancelled communications require a new draft. Controls retain the original approval and receipt history.

Sent means the email provider accepted the message. Delivered requires a verified provider callback. Uncertain means acceptance could not be confirmed. An uncertain retry keeps the same payload, sender, recipient, provider identity and usage reservation. Never create a second message to work around an uncertain result. After the provider’s safe retry window closes, further automatic sends are held for reconciliation of the original receipt. Stop future retries cannot retract a message the provider already accepted.

Contact changes, revoked links, lost approver access, disabled usage, an emergency delivery stop or changed provider credentials are checked again immediately before sending. Credential rotation cannot send an old attempt through a new provider account. Historical callbacks require an explicit server-side binding between the verified webhook signing secret and the retained provider generation; tags by themselves are not authority.

Household-private replies and stopping email

Every delivered message has a household-specific reply address. A reply must match the current household contact and invitation generation, refer to exactly one private destination across To/Cc/Bcc, and have trusted provider-computed sender authentication. Verified replies appear in that household’s private Guest Hub conversation and stop its applicable reminder sequence. They are not copied into another household’s feed or a business CRM conversation.

Unverified replies stay in the host’s email review list and do not stop reminders. They are never automatically published to a guest. Confirm their content through a trusted channel before acting. For verified replies, attachment metadata can be reviewed separately. A named operator must explicitly approve each private copy and its storage cost. See private files from guest replies. Files are never automatically copied into the Guest Hub feed.

Guests can follow Stop guest emails in a message. This stops future guest emails while preserving their private invitation and RSVP history. Already accepted messages may still arrive. Bounces and complaints also stop further email to the current household contact. A host cannot clear those stops merely by editing an address. For a delivery failure, save a different email address verified directly with the household, record how it was verified, and review corrected recipient recovery. An owning administrator can then permit newly reviewed messages; the original failed message is never resent. This recovery cannot clear recipient opt-outs, complaints or an unknown legacy stop. A recipient opt-out can be restored only through the current emailed preference link: the recipient reviews the exact notice and confirms a fresh choice. See stop or resume guest emails. Earlier stopped deliveries stay stopped; a fresh host review is required. Complaints and unknown legacy stops remain held.

Delivery, draft and reply histories have separate pagination and totals, so older uncertain messages remain available for recovery.

Activation boundaries

This workflow is implemented and exercised with deterministic transports and an isolated PostgreSQL database. Actual email requires the coordinated provider activation: verified sender and reply domains, provider webhook signatures and trusted authentication evidence, encryption, HTTPS application links, explicit pricing, spending approval and delivery controls. Some receiving-provider responses do not expose trusted sender authentication; those messages must stay unverified until the planned trusted ingress is available. SMS, automatic marketing enrollment and a generic mailing list are not included here. Private attachment retention has its own reviewed storage workflow. No provider is activated by creating a draft or running the local rehearsal.

Workspace operations follow-up

Workspace owners can open Operations → Guest delivery and website follow-up to see held, uncertain or failed guest email, overdue queued delivery and domain connections needing attention. The two lists paginate independently. This overview contains status and project links, not private household addresses, message bodies, invitation tokens or raw provider errors. Open the original wedding’s guest messages or website screen to review the retained approval and recovery choices.

For example, an uncertain invitation stays on the follow-up list until its original provider receipt is reconciled. Opening that item does not send again or release its usage reservation. A domain marked Simulator remains a development observation and cannot make the customer’s hostname live.