Privacy Policy

Reputoo Technologies Pvt. Ltd. ("Reputoo", "we", "us", or "our") is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform available at reputoo.com (the "Service").

By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, please discontinue use of the Service immediately.

This policy applies to all users of the Reputoo platform globally, and we comply with applicable data protection laws including the General Data Protection Regulation (GDPR) for EU/EEA users, India's Information Technology Act and associated rules, and other applicable regional laws.

We collect the following categories of information:

2.1 Information You Provide Directly - Account registration information: name, email address, phone number, company name - Billing information: payment card details (processed by our payment processors; we do not store raw card data) - Business information: business name, address, Google Business Profile details - Communications: messages sent to our support team, feedback, and survey responses - Customer contact data uploaded to our platform for messaging campaigns (WhatsApp contacts)

2.2 Information Collected Automatically - Log data: IP address, browser type, operating system, referring URLs, pages visited, time stamps - Usage data: features used, messages sent, campaigns created, dashboards viewed - Device information: device type, unique device identifiers, mobile network information - Cookies and tracking technologies (see Section 8)

2.3 Information from Third Parties - Google: If you connect your Google Business Profile, we receive business listing data and review information - Meta/WhatsApp: WhatsApp message delivery status, read receipts (where permitted by WhatsApp's API) - Payment processors: Transaction confirmation data (not raw payment credentials) - Social login providers: If you sign in via Google OAuth, we receive your name, email, and profile picture

We use your information for the following purposes:

Service Delivery - Provide, operate, and maintain the Reputoo platform - Process and complete transactions - Send WhatsApp messages, campaigns, and sequences on your behalf to your customers - Manage your customer contacts and campaign analytics

Communication - Send you service-related notifications, updates, and alerts - Respond to your support requests and inquiries - Send product news, feature announcements (with your consent)

Improvement & Analytics - Analyze usage patterns to improve platform features - Monitor platform performance and security - Conduct A/B testing and product research

Legal Compliance - Comply with applicable laws, regulations, and legal obligations - Enforce our Terms of Service - Protect our legal rights and interests

We process your data based on the following legal bases (where applicable under GDPR): (a) performance of a contract; (b) your consent; (c) our legitimate interests; (d) legal obligation.

We do not sell your personal data. We may share your information in the following circumstances:

Service Providers We engage third-party service providers to perform functions on our behalf: - Cloud infrastructure: Vercel, AWS, Neon Database - Payment processing: Razorpay, Cashfree - Communication: WhatsApp Business API (via Meta) - Analytics: Google Analytics - Error monitoring: Third-party monitoring services

All service providers are contractually bound to use your data only for the purposes we specify and in accordance with this Privacy Policy.

Business Transfers If Reputoo undergoes a merger, acquisition, or asset sale, your information may be transferred. We will notify you before your personal data is transferred.

Legal Requirements We may disclose your information if required by law, court order, governmental authority, or if we believe disclosure is necessary to protect rights, property, or safety.

With Your Consent We may share your information with third parties when you have given us explicit consent to do so.

When you use Reputoo's WhatsApp features, you upload and process contact data for your own customers. Important responsibilities:

Your Obligations as a Data Controller - You are responsible for ensuring your customers have given valid consent to receive WhatsApp messages from your business - You must comply with WhatsApp's Business Messaging Policy and applicable laws when messaging your customers - You are responsible for maintaining accurate opt-out records and honoring unsubscribe requests

How We Handle Your Customer Data - We process your customer contact data solely as your data processor, on your instructions - Customer data is never used for our own marketing or sold to third parties - We store message logs and delivery status to provide campaign analytics - Customer data is retained for the duration of your subscription plus 90 days, after which it is deleted

Meta/WhatsApp API All WhatsApp messages are delivered through Meta's official WhatsApp Business API. Message delivery, read receipts, and user data are subject to Meta's Privacy Policy. Reputoo is not responsible for Meta's data practices.

We retain your personal data for as long as your account is active or as necessary to provide the Service. Specifically:

• **Account data:** Retained for the duration of your subscription and deleted 90 days after account closure, unless longer retention is required by law
• **Campaign and message data:** Retained for 12 months from creation, then archived or deleted
• **Customer contact data:** Retained per your subscription; deleted within 90 days of account closure
• **Payment records:** Retained for 7 years for tax and accounting compliance
• **Log data:** Retained for up to 12 months for security and operational purposes

You may request deletion of your data at any time by contacting privacy@reputoo.com, subject to our legal retention obligations.

Depending on your location, you may have the following rights regarding your personal data:

For All Users - Access: Request a copy of the personal data we hold about you - Correction: Request correction of inaccurate or incomplete data - Deletion: Request deletion of your personal data (subject to legal retention requirements) - Data Portability: Request your data in a structured, machine-readable format

Additional Rights for EU/EEA Users (GDPR) - Object to Processing: Object to certain processing activities (e.g., direct marketing) - Restrict Processing: Request restriction of processing in certain circumstances - Withdraw Consent: Withdraw consent at any time (without affecting prior processing) - Lodge a Complaint: File a complaint with your local data protection authority

Exercising Your Rights To exercise any of these rights, email us at privacy@reputoo.com with your request. We will respond within 30 days (or 72 hours for urgent requests). We may need to verify your identity before processing your request.

We use cookies and similar tracking technologies to enhance your experience on our platform.

Types of Cookies We Use - Essential cookies: Necessary for the Service to function (session management, authentication). Cannot be disabled. - Analytics cookies: Help us understand how users interact with the Service (Google Analytics). Can be disabled. - Marketing cookies: Used for targeted advertising and conversion tracking (Meta Pixel, Google Tag Manager). Can be disabled.

Your Cookie Choices You can control cookies through your browser settings or our cookie consent banner. Note that disabling essential cookies may affect platform functionality.

Third-Party Tracking We may use Google Analytics, Meta Pixel, and Google Tag Manager. These services have their own privacy policies governing their use of data.

We implement industry-standard security measures to protect your data:

• **Encryption:** All data is encrypted in transit using TLS 1.3 and at rest using AES-256
• **Access controls:** Role-based access control; only authorized personnel can access customer data
• **Infrastructure security:** Hosted on SOC 2 Type II compliant cloud infrastructure
• **Regular audits:** Periodic security audits and penetration testing
• **Incident response:** Documented procedures for detecting, reporting, and responding to data breaches

Despite our efforts, no security measure is 100% infallible. We will notify you of any material security breach affecting your personal data within 72 hours of becoming aware of it, as required by applicable law.

Reputoo is headquartered in India. Your data may be transferred to and processed in countries other than your country of residence, including India, the United States, and countries where our service providers operate.

For users in the EU/EEA, such transfers are conducted pursuant to appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission, or other mechanisms permitted under GDPR Chapter V.

By using the Service, you consent to your data being processed in these locations.

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected information from a child, please contact us at privacy@reputoo.com and we will promptly delete such information.

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by: - Sending an email to your registered email address - Posting a prominent notice on our website - Updating the "Last Updated" date at the top of this page

Your continued use of the Service after the effective date of any changes constitutes acceptance of the revised Privacy Policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Reputoo Technologies Pvt. Ltd. Email: privacy@reputoo.com Data Protection Contact: dpo@reputoo.com WhatsApp: +91 7303 600 000

For EU/EEA users: You also have the right to lodge a complaint with your local supervisory authority. To find your authority, visit https://edpb.europa.eu/about-edpb/about-edpb/members_en