Privacy Policy

Who we are and what this covers

Repeatt is a product operated by Shivarth Softtech ("Repeatt", "we", "us", or "our"). This policy applies to Repeatt's website, web and mobile customer experiences, merchant dashboard, APIs, waitlist, and related messages and support.

Repeatt operates the platform and decides how data is used for account administration, security, platform communications, diagnostics, and service improvement. A participating merchant separately decides how it runs its loyalty programme, configures offers, reviews visits, views its customers, and sends merchant communications. Depending on the context and applicable law, the merchant may therefore be a separate data controller or data fiduciary and Repeatt may process data for it.

Information we collect

Customer account and profile data. We collect the mobile number used for OTP sign-in, name, date of birth, gender, and signup consent record. Customers may also add or have associated an email address and anniversary date, and may change their gender, birthday, anniversary, push preference, and per-merchant marketing choices. We store account identifiers, account status, and sign-in timestamps.

Merchant and team data. We collect owner and team-member names, email addresses, optional phone numbers, password hashes, roles, permissions, assigned brands and outlets, login activity, and audit events. We also process business information such as company and brand names, contact and billing details, outlet addresses and map coordinates, logos, menus, loyalty settings, campaigns, communications, and reward configurations.

Loyalty and transaction activity. We record QR check-ins, outlet and visit times, approval or rejection, recorded bill amount and currency, purchased items or service information, stamps or points, wallet and ledger activity, offers, reward grants and redemptions, scratch cards, challenges, social-reward requests, and customer-to-customer reward shares. A merchant and its authorised staff can view customer profile details, visit and spend history, balances, rewards, redemptions, and insights for customers who interact with that merchant.

Location and camera.When an outlet requires geofencing, the customer app or browser asks for precise location at check-in and sends the current coordinates to verify distance from that outlet. Repeatt stores the resulting distance, permitted radius, and verification time with the request and visit, but the current implementation does not store the customer's raw check-in coordinates. Camera access is used to scan an outlet QR code; QR camera frames are processed on the device and are not uploaded as part of scanning. Merchant users may use location to position an outlet on a map.

Files and content. Authorised merchant staff may upload receipt photos, PDFs, proof-of-purchase files, logos, and menu images. Receipts may contain transaction details or other information visible in the image. Messages, offer copy, support requests, waitlist submissions, and reward-share recipient phone numbers or email addresses are also processed when those features are used.

Technical and diagnostic data.We process IP addresses, request IDs, user-agent and device information, authentication and OTP records, rate-limit events, push tokens, platform and app version, server logs, security events, and audit records. The mobile app uses Firebase Crashlytics and associates crash reports with an internal account ID, not the customer's phone number or email. Repeatt does not use an advertising ID, serve third-party ads, or use product data for cross-app advertising tracking.

Website and device storage.The web apps store session tokens, a user snapshot, theme and selected-brand preferences, and a push token in browser local storage. The mobile app stores tokens in the operating system's secure keychain and a cached user profile and theme preference in app storage. A service worker is used for web push. We do not currently use advertising cookies.

We obtain information directly from customers, merchant owners and team members, participating merchants, a person's device or browser, another customer who sends a reward, and the service providers used to operate Repeatt.

How we use information

We use information to verify phone numbers and identities; create and secure accounts; provide merchant workspaces; operate check-ins, loyalty wallets, offers, rewards, redemptions, sharing, birthday and anniversary campaigns, and notifications; personalise customer-facing features; calculate programme history and reports; prevent duplicate, fraudulent, or out-of-range check-ins; investigate errors and misuse; answer support requests; maintain audit trails; and comply with legal obligations.

Repeatt creates deterministic and AI-assisted customer, outlet, and brand insights from visit, spend, item, reward, and engagement data. Google Vertex AI is used to generate limited narrative insights and recommendations, and to read uploaded receipt images for a suggested total and line items. Customer names, phone numbers, and email addresses are not included in the current AI insight prompts. Receipt images sent for extraction may, however, contain whatever is visible on the receipt. AI output assists authorised merchant staff; it does not automatically approve a visit, change a balance, issue an offer, or make a legally significant decision about a customer. Staff review receipt suggestions and choose whether to act on recommendations.

New customer accounts currently require agreement to receive Repeatt account and service updates on WhatsApp at the registered number, and a welcome message may be sent after signup. This is separate from merchant marketing. After a customer joins a participating business, that business's marketing email and, where used, personal-offer messages on WhatsApp are enabled unless the customer turns that business off in Profile. Push notifications require device or browser permission and can be turned off in Profile or device settings. Transactional or security messages may still be sent where needed to operate the service.

How information is shared

Participating merchants. A merchant and team members with the relevant permissions receive the customer and loyalty information needed to review visits, operate rewards, serve customers, communicate, and view reports. A merchant is responsible for its staff access, its offer terms, and its own lawful use of the data.

Other people.If a customer shares a reward, we use the recipient's phone number or email to locate or invite them and may show the recipient the sender's name, brand, reward, and expiry. The sender and recipient can see the status and details needed to manage the transfer.

Service providers. We use providers that supply infrastructure and operational services, including Cloudinary for uploaded files, Google Cloud Vertex AI for AI processing, Google Firebase for push delivery and mobile crash reporting, Google Maps and Places for outlet location tools, SMS and WhatsApp delivery providers such as Message Central, APITxT, and Fast2SMS where configured, an email delivery provider, and Sentry for backend error reporting where configured. These providers process only the information needed for their service under their own terms and our arrangements with them. Providers and hosting infrastructure may process data in India or other countries.

We may also disclose information when required by law, to protect people or the service, to investigate fraud or security incidents, or as part of a merger, financing, acquisition, or transfer of the business. We do not sell personal information or share it with data brokers or advertising networks.

Retention

We keep data only for as long as it is needed for the purposes described above, a merchant's programme records, security and dispute handling, or legal obligations. Retention differs by record. Current default schedules delete pending OTP records after expiry (normally within 15 minutes), OTP send logs after 90 days, inactive push tokens after 90 days, completed AI caches and jobs after 30 days, resolved insight signals after 90 days, and completed reward-share records after 12 months. Read in-app notifications and completed email-delivery rows are generally removed after 90 days, while delivered email bodies are cleared earlier. Some schedules can be changed for operational or legal requirements.

Core account, visit, reward, redemption, consent, ledger, policy-version, and audit records may be kept longer while an account or merchant programme is active and where necessary to preserve programme integrity. Merchant data can be permanently erased by an authorised platform administrator as part of company erasure.

When a customer deletes their account through Profile and verifies the request by OTP, Repeatt removes their name, phone number, email, profile dates, gender, notifications, push tokens, customer insights, memberships, OTP records, and stored receipt or supporting-file references, and attempts to delete the underlying uploaded files. Marketing choices are withdrawn, active balances and unused rewards are forfeited, pending requests are rejected, pending shares are cancelled, and sessions are invalidated. An inactive record labelled "Deleted customer" and pseudonymous visit, request, reward, redemption, ledger, and audit history remain so merchant financial and loyalty records stay internally consistent. Those retained records no longer contain the deleted customer's direct contact or profile details.

Security

We use role- and outlet-based access controls, hashed passwords and OTPs, expiring access tokens, encrypted platform transport, audit logs, rate limits, redacted application logs, and restricted production configuration. Mobile session tokens are stored using the operating system's secure credential storage. No system can guarantee absolute security, so users must also protect their devices and credentials and promptly report suspected misuse.

Your choices and rights

Customers can review their profile and activity, correct supported profile fields, manage each participating merchant's email marketing choice, control push notifications, and permanently delete their account from Profile. Device permissions for camera, location, and notifications can be changed in device or browser settings, although camera and location are needed for the check-in features that use them.

Depending on applicable law, a person may ask for access, correction, completion, erasure, withdrawal of consent, or grievance handling. Contact contact@repeatt.me. We may need to verify the request and may retain or refuse to erase limited information where law or legitimate record-integrity requirements permit. For data controlled by a participating merchant, we may direct the request to that merchant or assist it in responding.

Children

Repeatt is not designed for a child to create and manage an account without the involvement of a parent or lawful guardian where parental consent is required. If you believe a child provided personal information without the required permission, contact us so we can review and delete it where appropriate.

Updates to this policy

We may update this policy when the product, providers, or legal requirements change. We will post the revised policy with a new effective date and provide additional notice when a change materially affects how personal information is handled.

Contact and grievance requests

Email contact@repeatt.meor write to Shivarth Softtech, Block F-601, Adarsh Tulip Sky View, opposite Bhamariya Kuvo, near Pooja Bungalows, Narol, Ahmedabad 382405, Gujarat, India. Please use the subject "Privacy request" and identify the Repeatt account or merchant concerned.