What we keep, and what we never see.

AskRevu is operated by a sole proprietorship based in India, trading as AskRevu. For the purposes of the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described here: we decide why and how it is processed.

This policy covers three groups of people: shop owners who create an AskRevu account; their customers, who scan a printed AskRevu card; and visitors to this website.

• Account details: your shop name, your email address and your password. We store the password only as a one-way bcrypt hash; we cannot read it and nobody at AskRevu ever sees it.
• Shop settings: your Google review link, the language you choose, and the names you give your staff and counter codes. If you connect a Google listing, we store its public name, address and public review count, which Google returns to us.
• Billing records: your subscription status and the identifiers Razorpay gives us for your subscription and receipts. Your card or UPI details go to Razorpay directly; we never receive or store them.
• Security records: when you log in or ask for a password reset, we record the attempt against your IP address and email so repeated guessing can be stopped. These records expire within hours.

A customer who scans your card is never asked for their name, phone number, email or anything else, and there is no field in which to give them.

• The visit: we record that the card was scanned, when, from which of your codes, which draft we showed, and whether the customer tapped the button that copies it and opens Google. None of this identifies the customer.
• Their IP address: written once, together with a short hash of their browser's user-agent string, so one device cannot flood your counts. It is deleted within three hours, is never shown to you, and is never attached to a review.
• What they write: never reaches us. The draft is edited on the customer's own phone, copied from it, and posted by them on Google from their own Google account.
• Google Analytics: runs on this screen as on every page of the site. It sets the _ga cookie on the customer's phone and tells Google the address of the page they opened — which includes your shop's link and the code on the card — with their browser, device and approximate city. Google never receives what they write, and neither do we. Section 4 has the detail.

• Sign-in cookie: when a shop owner logs in we set one cookie that keeps them signed in. It is strictly necessary and holds no information about anyone else.
• Theme: if you choose light or dark, the choice is kept in your own browser's local storage. It is never sent to us.
• Google Analytics: we use it to count visits and see how the site is used. Google receives the address and title of each page you view, the page you came from, your browser, device and screen size, and your approximate location (city and country). It sets one cookie, _ga, holding a random number so that a return visit is not counted as a new visitor. We never send Google your name, email address, phone number or anything you type, and Google discards your IP address after working out the city. It never runs on the password reset page. You can block it with any ad or tracker blocker, and the site works the same.

• To provide the service you signed up for: your dashboard, your cards, the customer screen and your scan counts.
• To keep accounts and the service secure, and to stop abuse such as password guessing or fake scans.
• To bill your subscription and keep the records that billing needs.
• To send the emails the service needs: password resets and notices about your trial and subscription. We do not send marketing email and we do not add you to a mailing list.
• To meet our obligations under Indian law.

We process your data on the basis of the consent you give when you create an account, and for the purposes the Act treats as legitimate uses, such as complying with the law. We do not sell personal data, we do not use it for advertising, and we do not build profiles of your customers.

We use a small number of service providers, who process data only on our instructions and only to run AskRevu:

• Vercel — hosts the website and the application.
• Neon, on Amazon Web Services in Singapore — stores the database: accounts, shop settings and scan counts.
• Razorpay (India) — takes payments and holds your payment details and payment records.
• Resend — delivers the service emails described above to your address.
• Inngest — runs our scheduled jobs, such as deleting expired IP records and sending trial reminders.
• Google — looks up your public Google listing when you connect it, and runs Google Analytics for us.

We may also disclose data where Indian law requires it, for example to comply with a lawful order from a court or government authority.

Our database is in Singapore, and some of the providers above process data in other countries, including the United States. The Act permits these transfers except to countries the Government of India has restricted; we do not transfer data to any such country.

• Your account, settings and scan counts: for as long as your account exists. When you delete your shop they are erased from the live database straight away.
• Customer IP addresses: deleted within three hours.
• Login and reset attempt records: expire within hours.
• Password reset links: work for 60 minutes and only once.
• Payment notifications from Razorpay: kept for 90 days, so we can answer whether a payment arrived, then deleted — or straight away if you delete your shop.
• Backups: our database provider keeps encrypted backups for a limited period, after which deleted data is gone from them too.
• Payment records held by Razorpay are kept by Razorpay for as long as the law requires them to.

Under the Digital Personal Data Protection Act, 2023 you have the right to:

• Access a summary of the personal data we hold about you and how we process it.
• Correct or update it. You can change your shop name, link and language yourself in Settings.
• Erase it. Settings → Delete this shop removes your account and everything attached to it immediately. You can also ask us by email.
• Withdraw consent at any time, which you do by deleting your shop. Withdrawing does not affect what was lawfully done before.
• Nominate another person to exercise these rights for you in the event of your death or incapacity.
• Have a grievance addressed, as set out below.

To use any of these rights, email support@askrevu.in from the address on your account. We will respond within one month.

Because we never learn who your customers are, we cannot link any record to a particular customer. A customer who has a question can still write to us at the same address.

AskRevu accounts are for businesses and must be opened by someone aged 18 or over. We do not knowingly collect personal data from children, and the customer screen asks nobody for anything.

Everything travels over encrypted HTTPS connections. Passwords are stored only as bcrypt hashes. Access to production systems is limited to the people who run AskRevu. We follow reasonable security practices as required by Section 43A of the Information Technology Act, 2000. If a breach affects your personal data, we will tell you and the Data Protection Board of India as the law requires.

Our Grievance Officer can be reached at support@askrevu.in. We acknowledge every grievance within 48 hours and resolve it within one month.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

All contact details are on the contact page.

If we change what we collect or why, we will update this page and its date, and email account holders before a material change takes effect. Questions about this policy go to support@askrevu.in.