Privacy policy

Reputae is a reputation and operations platform for restaurant groups. It is operated by Central Solutions, Mumbai, India (“we”, “us”). This policy explains what personal data Reputae processes, why, where it is kept, how long we keep it, and the rights you have under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”).

1. Who is responsible

Reputae is used by restaurant groups (our “clients”) and their staff. Access is by invitation only. For the data a client and its staff put into Reputae, the client decides why and how it is used, and we process it on the client’s behalf. For your account with us, and for this website, Central Solutions is responsible. Either way, you can contact us at ansh@centralsolutions.in and we will act on your request or pass it to the right client.

2. What personal data we process, and why

User account details

Name, email address, phone number (if provided), job title, role, and the brands and outlets you can access. Your password is stored only as a secure hash; we never see it. Sign-in cookies keep you signed in.

Why: to give you secure access to Reputae with the permissions your role allows, and to send account emails such as invitations and password resets.

Staff work records

• Checklists: who filled each checklist and when, the answers given, and photos taken as proof of completion, with the time each photo was captured.
• Tasks: titles, descriptions, owners, approvals, due dates, attached files and a history of changes.
• Review tickets: who closed a ticket or marked a review as replied, and when.
• In-app notifications sent to you, and a record of changes to checklists and their schedules (who changed what, and when).

Why: to run checklists, tasks and review tickets for the client, and to give the client an accurate record of what was done, by whom and when.

Review data

Publicly available reviews and ratings that guests have posted on third-party review platforms, including the reviewer’s display name as shown publicly.

Why: to show the client what guests are saying about its outlets; to identify sentiment, recurring complaint themes and urgent issues; to raise review tickets with reply deadlines; and to draft suggested replies, which a person at the client reviews before posting.

This website

The public pages of this website (the home page, this policy and the terms) set no cookies and use no analytics or advertising trackers. Our hosting provider keeps standard server logs, such as IP address and browser type, to run and protect the service.

We do not sell personal data, and we do not use it for advertising.

3. Where it is stored

Reputae’s database, file storage and application servers run on cloud infrastructure in Mumbai, India. Some processing by the service providers in section 5 may take place outside India.

4. How long we keep it

• Account details: for as long as the account is active under a client’s agreement with us.
• Deleted tasks: kept for 90 days so they can be restored, then permanently deleted.
• The publishing history of checklists: kept for 90 days.
• Checklist records, including when a checklist was not done and why: kept for as long as the client’s agreement runs, because they form the client’s compliance record.
• Review data: kept while the client uses Reputae. When a review is no longer publicly available, we stop showing it and stop counting it.

When a client’s agreement ends, or a client asks us to, we delete that client’s data, except where the law requires us to keep it.

5. Service providers

• Cloud hosting and database — Supabase (database, file storage and sign-in) and Vercel (application hosting), in their Mumbai, India regions.
• Email delivery — Resend, for account emails such as invitations and password resets. Receives your name and email address.
• AI processing— OpenAI, and another AI provider used to check the quality of AI output. They receive review text and ratings, the reviewer’s display name and the outlet name. When a manager asks Reputae to rewrite a suggested action item, OpenAI also receives that task’s title and description and any note the manager typed. This processing may take place outside India.

Account details (names, email addresses, phone numbers), checklist records and photos are not sent to AI providers.

6. Your rights under the DPDP Act

You can ask us to:

• tell you what personal data about you we process, and who we have shared it with;
• correct, complete or update personal data that is wrong or incomplete;
• erase personal data that is no longer needed for the purpose it was collected for;
• withdraw consent, where we process data on the basis of your consent;
• nominate another person to exercise these rights if you die or are unable to; and
• address a grievance about how your personal data is handled.

If you are a member of a client’s staff, some requests (for example, erasing a checklist record) may need the client’s decision, and we will forward them. If you posted a review, you can edit or delete it where you posted it; once it is no longer publicly available, we stop showing it.

We will respond within a reasonable time. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

7. Security

Data is encrypted in transit. Each client’s data is kept separate by access rules enforced in the database itself, and each user sees only the outlets their role allows. Passwords are stored only as hashes.

8. Children

Reputae is a business service for adults. It is not directed at children.

9. Changes

If we change this policy we will update the date at the top of this page.

10. Contact, data requests and grievances

Write to ansh@centralsolutions.in. Central Solutions, Mumbai, India.