Privacy Policy

1. Who we are and who this covers

ReVisit is operated by Navya Tech Solutions, Dandi pada, Boisar, Maharashtra, India - 401501 (“ReVisit”, “we”, “us” or “our”). This policy explains how we handle personal data about:

• Merchants — business owners and people who use a business account;
• Customers — people who join a shop’s loyalty program on ReVisit;
• Partners: people in our referral partner program; and
• Visitors — people who browse our website, public shop pages and menus.

2. ReVisit’s role and the merchant’s role

2.1. Where we decide how data is used. We are responsible for the personal data we use for our own purposes: merchant accounts, subscriptions and payments, sign-in and account security, fraud prevention, customer accounts on the ReVisit platform, support, our website, and meeting our legal obligations.

2.2. Where we act for merchants. When a merchant runs its loyalty program on ReVisit, the merchant decides its program rules and how it uses its own customers’ information (for example, which customers it rewards, blocks or contacts, and what it does with an exported customer list). For that program data, we process the information to provide the loyalty features to the merchant.

2.3. Merchant responsibilities. Merchants must use customer information obtained through ReVisit only to run their own loyalty program and serve their own customers, must have a lawful basis for any information they add or export, and are responsible for their own use of exported data. This does not reduce our own responsibilities under this policy or the law.

3. Information we collect

4. How we use information

• To provide the Service: running reward cards, recording visits, stamps and coins, showing rewards, menus and shop pages.
• To sign you in and protect accounts, including sending one-time passcodes.
• To process subscriptions and payments and keep accounting and tax records.
• To run the partner program: linking referred businesses, working out commission and paying it.
• To send service messages, such as passcodes, notifications about your loyalty activity, and subscription expiry reminders.
• To prevent fraud and abuse, such as fake visits, self-scanning and referral abuse.
• To provide support and respond to your requests.
• To understand how our public website is used and improve it (see section 9).
• To meet legal obligations and to establish, exercise or defend legal claims.

Marketing: service messages are needed to run your account. We do not use customer loyalty data to send our own marketing. Merchants may send optional notifications to their customers through ReVisit; customers can control browser notifications in their browser and notification settings.

5. Who we share information with

We do not sell, rent or trade personal data. We share it only as follows:

• With the shop you visit. A merchant can see the name, phone number, and any optional profile details (email, date of birth, anniversary) of customers in its program, along with their activity at that merchant only. Merchants can export their customer list. Other merchants cannot see your activity elsewhere.
• Public information. Shop names, addresses, menus and other business information merchants choose to publish appear on public pages.
• With service providers who help us run the Service, under contracts or terms that restrict how they may use the data:

We also use a small number of other technical services (for example, website analytics, looking up a city from location coordinates, estimating a visitor’s country from their IP address, reading menus that merchants upload for import, delivering browser notifications you turn on, and generating QR code images), which receive the data needed for that task. These providers may also have their own legal responsibilities and privacy policies for the data they handle. We update this list when our providers change.

• For legal reasons. Where required by law, by a court or by a government authority, or where reasonably necessary to protect the rights, safety or security of our users, the public or ReVisit.
• Business transfers. If our business is reorganised or transferred, data may be transferred to the new operator, who must keep protecting it in line with this policy.

6. Where data is stored and processed

6.1. Primary storage in India. The ReVisit application, its database and uploaded files run on servers that we manage ourselves on AWS infrastructure in the Mumbai, India region. We do not use an AWS-managed database service.

6.2. Processing outside India. Some of our service providers may store or process data outside India, in the locations they use under their own terms.

6.3. Legal basis for transfers. We transfer data outside India only as permitted by Indian law, including any restrictions notified by the Government of India. If you use ReVisit from outside India, your data will be processed in India and in the locations described above.

7. How long we keep information

7.1. General rule. We keep personal data for as long as your account is active and the data is needed to provide the Service, and afterwards only as long as needed for the purposes below.

• Payment, invoice and tax records, including partner commission and payout records, are kept for the periods required by Indian tax and accounting law.
• Security logs and records needed for fraud or dispute handling are kept as long as needed for that purpose or as required by law.
• Loyalty activity is kept while it is needed to show balances and history to the customer and the merchant, or until it is deleted at the customer’s or merchant’s request, subject to the exceptions above.

7.2. Backups. When data is deleted from our live systems, copies may remain in backups until those backups are deleted in the normal course. We do not restore deleted data from backups except to recover from data loss or as required by law, and we keep backups protected in the meantime.

8. Your choices and rights

Subject to applicable law, you can ask us to:

• tell you what personal data we hold about you and how we use it;
• correct, complete or update inaccurate information (you can also edit your own profile in the app);
• delete your account and personal data, unless we must keep certain records as explained in section 7;
• withdraw consent you have given (for example, by turning off browser notifications or location in your browser); and
• nominate another person to exercise your rights if you die or become incapacitated, where the law provides for this.

How to make a request. Email sales@navyats.com, preferably from the email address on your account, and tell us your registered mobile number and what you would like us to do. We may need to verify that the request comes from you before acting on it, and we will only ask for what we need to do that. We will acknowledge your request and tell you the outcome.

Requests about a shop’s program. If your request concerns how a particular shop uses your information (for example, a customer list it has exported), you may also contact that shop directly. We will help pass on or handle requests about data held on ReVisit.

Deleting a merchant account. Merchants can ask us to close their business account. Please export any customer records you need first. We will delete or anonymise the account’s data in line with section 7.

9. Cookies, local storage and analytics

• Necessary cookies: we use session, sign-in (“remember me”) and security (CSRF) cookies to keep you signed in and protect forms. The Service does not work without them.
• Local storage: your browser stores a few small preferences, such as your chosen city on the Explore page and whether you have installed the app on your home screen.
• Analytics: our public pages (such as the home page, sign-in page, public shop pages and these policy pages) load Google Tag Manager, which may set cookies or collect information about how the pages are used, such as pages visited, device and browser type, and approximate location. You can block or delete these cookies through your browser settings without affecting your ability to use the Service. We do not use advertising cookies inside the signed-in owner or customer app.

10. Security

We use reasonable security measures appropriate to the data we handle, including encrypted connections (HTTPS), hashed passwords, one-time-passcode sign-in, access controls that limit each merchant to its own data, rate limits, and logging of staff access to merchant accounts. No system is completely secure. If a personal data breach occurs, we will act to contain it and notify affected users and the authorities where the law requires.

11. Children

ReVisit is intended for people aged 18 and over. We do not knowingly collect personal data from children without the consent of a parent or lawful guardian. If you believe a child has given us personal data without that consent, please contact us so we can deal with it.

12. Changes to this policy

We will update this policy when our practices or providers change, and update the “Last updated” date. For material changes, we will also notify merchants by email or in the dashboard.