Privacy Policy

Reputoo is a product of Bonzor Enterprises. In this policy, "we" and "us" mean Bonzor Enterprises.

This policy explains what we collect, why we collect it, and what you can ask us to do about it.

Who this covers - Everyone who uses reputoo.com, anywhere in the world - Both your own account data and the customer data you upload

Laws we follow - GDPR, if you are in the EU or EEA - India's Information Technology Act and its rules - Other data protection laws that apply where you are

Using the Service means you accept this If you do not agree with this policy, please stop using the Service.

We collect the following categories of information:

2.1 Information You Provide Directly - Account registration information: name, email address, phone number, company name - Billing information: payment card details (processed by our payment processors; we do not store raw card data) - Business information: business name, address, Google Business Profile details - Communications: messages sent to our support team, feedback, and survey responses - Customer contact data uploaded to our platform for messaging campaigns (WhatsApp contacts)

2.2 Information Collected Automatically - Log data: IP address, browser type, operating system, referring URLs, pages visited, time stamps - Usage data: features used, messages sent, campaigns created, dashboards viewed - Device information: device type, unique device identifiers, mobile network information - Cookies and tracking technologies (see Section 9)

2.3 Information from Third Parties - Google: If you connect your Google Business Profile, we receive business listing data and review information - Meta/WhatsApp: WhatsApp message delivery status, read receipts (where permitted by WhatsApp's API) - Payment processors: Transaction confirmation data (not raw payment credentials) - Social login providers: If you sign in via Google OAuth, we receive your name, email, and profile picture

We use your information for the following purposes:

Service Delivery - Provide, operate, and maintain the Reputoo platform - Process and complete transactions - Send WhatsApp messages, campaigns, and sequences on your behalf to your customers - Manage your customer contacts and campaign analytics

Communication - Send you service-related notifications, updates, and alerts - Respond to your support requests and inquiries - Send product news, feature announcements (with your consent)

Improvement & Analytics - Analyze usage patterns to improve platform features - Monitor platform performance and security - Conduct A/B testing and product research

Legal Compliance - Comply with applicable laws, regulations, and legal obligations - Enforce our Terms of Service - Protect our legal rights and interests

Our legal basis (under GDPR) We rely on one of these, depending on what we are doing: - Performing our contract with you - Your consent - Our legitimate interests - A legal obligation

We do not sell your personal data. We may share your information in the following circumstances:

Service Providers We engage third-party service providers to perform functions on our behalf: - Cloud infrastructure: Vercel, AWS, Neon Database - Payment processing: Razorpay, Cashfree - Communication: WhatsApp Business API (via Meta) - Analytics: Google Analytics - Error monitoring: Third-party monitoring services

Every provider is bound by contract to use your data only for what we specify, and only in line with this policy.

Business Transfers If Reputoo undergoes a merger, acquisition, or asset sale, your information may be transferred. We will notify you before your personal data is transferred.

Legal Requirements We may have to share your information when: - The law, a court order or a government authority requires it - We believe it is needed to protect someone's rights, property or safety

With Your Consent We may share your information with third parties when you have given us explicit consent to do so.

When you use Reputoo's WhatsApp features, you upload and process contact data for your own customers. Important responsibilities:

Your Obligations as a Data Controller - You are responsible for ensuring your customers have given valid consent to receive WhatsApp messages from your business - You must comply with WhatsApp's Business Messaging Policy and applicable laws when messaging your customers - You are responsible for maintaining accurate opt-out records and honoring unsubscribe requests

How We Handle Your Customer Data - We process your customer contact data solely as your data processor, on your instructions - Customer data is never used for our own marketing or sold to third parties - We store message logs and delivery status to provide campaign analytics - Customer data is retained for the duration of your subscription plus 90 days, after which it is deleted

Meta/WhatsApp API All WhatsApp messages are delivered through Meta's official WhatsApp Business API. Message delivery, read receipts, and user data are subject to Meta's Privacy Policy. Reputoo is not responsible for Meta's data practices.

When you connect an e-commerce store (such as Shopify or WooCommerce) to Reputoo, we access store data strictly to run the messaging automations you enable.

Data We Access From Your Store - Customer details: name, email address, phone number - Order data: order number, totals, payment method, fulfillment and shipment status - Checkout data: abandoned checkout contents and recovery links - Discount usage: codes applied to orders, for revenue attribution of our messages

How We Use It - Send transactional WhatsApp updates on your behalf. These cover: - Order confirmation and cash-on-delivery verification - Shipping, delivery and cancellation updates - Refund and return updates - A pay-online nudge on cash-on-delivery orders. This carries no discount and is tied to paying for an order you already placed - Send marketing messages (abandoned cart recovery, win-back offers) only where the customer has not declined marketing, with an unsubscribe option in every message - Create single-use discount codes in your store when you enable offer automations - Attribute order revenue to the messages that drove it, for your analytics

If a customer asks for their data We act on the privacy requests your store platform sends us: - Data request: we gather everything we hold about that customer - Redaction request: we erase that customer's personal details from our records - We finish erasure requests within 30 days

If you uninstall the app - Automated messaging stops straight away - We delete our access tokens for your store - We redact the customer records synced from that store, on the platform's schedule (48 hours after uninstall, for Shopify)

Who is responsible You stay the data controller for your store data. Reputoo acts as your processor. Section 5 explains what that means.

We retain your personal data for as long as your account is active or as necessary to provide the Service. Specifically:

• —**Account data:** Retained for the duration of your subscription and deleted 90 days after account closure, unless longer retention is required by law
• —**Campaign and message data:** Retained for 12 months from creation, then archived or deleted
• —**Customer contact data:** Retained per your subscription; deleted within 90 days of account closure
• —**Payment records:** Retained for 7 years for tax and accounting compliance
• —**Log data:** Retained for up to 12 months for security and operational purposes

You may request deletion of your data at any time by contacting privacy@reputoo.com, subject to our legal retention obligations.

Depending on your location, you may have the following rights regarding your personal data:

For All Users - Access: Request a copy of the personal data we hold about you - Correction: Request correction of inaccurate or incomplete data - Deletion: Request deletion of your personal data (subject to legal retention requirements) - Data Portability: Request your data in a structured, machine-readable format

Additional Rights for EU/EEA Users (GDPR) - Object to Processing: Object to certain processing activities (e.g., direct marketing) - Restrict Processing: Request restriction of processing in certain circumstances - Withdraw Consent: Withdraw consent at any time (without affecting prior processing) - Lodge a Complaint: File a complaint with your local data protection authority

Exercising Your Rights To exercise any of these rights, email us at privacy@reputoo.com with your request. We will respond within 30 days (or 72 hours for urgent requests). We may need to verify your identity before processing your request.

We use cookies and similar tracking technologies to enhance your experience on our platform.

Types of Cookies We Use - Essential cookies: Necessary for the Service to function (session management, authentication). Cannot be disabled. - Analytics cookies: Help us understand how users interact with the Service (Google Analytics). Can be disabled. - Marketing cookies: Used for targeted advertising and conversion tracking (Meta Pixel, Google Tag Manager). Can be disabled.

Your Cookie Choices You can control cookies through your browser settings or our cookie consent banner. Note that disabling essential cookies may affect platform functionality.

Third-Party Tracking We may use Google Analytics, Meta Pixel, and Google Tag Manager. These services have their own privacy policies governing their use of data.

We implement industry-standard security measures to protect your data:

• —**Encryption:** All data is encrypted in transit using TLS 1.3 and at rest using AES-256
• —**Access controls:** Role-based access control; only authorized personnel can access customer data
• —**Infrastructure security:** Hosted on SOC 2 Type II compliant cloud infrastructure
• —**Regular audits:** Periodic security audits and penetration testing
• —**Incident response:** Documented procedures for detecting, reporting, and responding to data breaches

Despite our efforts, no security measure is 100% infallible. We will notify you of any material security breach affecting your personal data within 72 hours of becoming aware of it, as required by applicable law.

Reputoo is based in India. Your data may be handled outside the country you live in.

Where your data may go - India, where we are based - The United States - Other countries where our service providers run their systems

If you are in the EU or EEA - We use Standard Contractual Clauses approved by the European Commission - Or another transfer mechanism that GDPR Chapter V allows

Using the Service means you agree to your data being handled in these places.

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected information from a child, please contact us at privacy@reputoo.com and we will promptly delete such information.

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by: - Sending an email to your registered email address - Posting a prominent notice on our website - Updating the "Last Updated" date at the top of this page

Your continued use of the Service after the effective date of any changes constitutes acceptance of the revised Privacy Policy.

Have a question about this policy, or want to make a request? Get in touch.

Bonzor Enterprises (Brand: Reputoo) - Email: privacy@reputoo.com - Data protection contact: dpo@reputoo.com - WhatsApp: +91 7303 608 172

If you are in the EU or EEA - You can also complain to your local supervisory authority - Find yours at https://edpb.europa.eu/about-edpb/about-edpb/members_en