Privacy Policy

Rebaar (“Rebaar”, “we”) operates the Rebaar ERP platform at rebaar.in. We are the data processor for the workspace data you upload (you, the workspace Owner, are the data fiduciary under DPDP terminology). We are the data fiduciary for the small set of operational data we collect about you as a Rebaar user.

Contact for privacy and DPDP-related correspondence: [email protected].

Two categories:

2a. Account & usage data (Rebaar is the fiduciary)

• Identity: name, email, phone (optional), workspace name, GSTIN (optional)
• Authentication: password (bcrypt-hashed; we never see it), 2FA secret (encrypted), session cookies, and — if you register a passkey — its public key, a credential identifier, the device name you choose, and when it was added and last used. A passkey's private key is generated and held by your device and can never be extracted, so there is nothing about it for us to lose.
• Billing: plan, billing cycle, last 4 digits of payment method (via Razorpay; full PAN never touches our servers)
• Audit: every mutation in your workspace is logged with actor + timestamp + diff. Kept as described under Retention below — while the workspace exists, and the latest 500 entries for 8 years after it is deleted.
• Telemetry: server-side error logs (Sentry). On the public marketing site only, Google Analytics 4 measures aggregate page views — but only if you accept the analytics cookie category (off by default; it never runs inside the logged-in product). No advertising or cross-site tracking cookies. See Section 8.

2b. Workspace data (you are the fiduciary; we are the processor)

• Project records, BOQs, schedules, daily progress, photos, drawings, contracts
• Client records (names, emails, phones, GSTINs of the people you bill)
• Vendor records, materials, indents, POs, GRNs, vendor bills
• Quotations and invoices
• Payroll: worker register, attendance, salary slips, PF/ESI/PT/TDS computations
• Integration credentials you connect (encrypted at rest — see Section 4)

We process this data only on your instructions (i.e. only when you or your team triggers an action in the product). We don't mine it, sell it, or use it to train models.

2c. Rebaar mobile app (the field app)

The Android / iOS field app collects the following, only while you actively use the relevant feature:

• Precise location (GPS): captured only when you check in for attendance or take a geo-tagged site photo, to record where the action happened. When you open the daily log or a weather record, the app can also fill in the weather where you are: your location is sent to Rebaar rounded to about 1 km and passed to a weather service only to look up the weather; it is not stored. Foreground only — we never collect location in the background.
• Camera & photos: used to capture geo-tagged site photos you choose to upload. We access the camera only when you take a photo; we do not scan or read your photo library.
• Push notification token: a device token used solely to deliver app notifications. You can disable notifications in your device settings.
• Biometric / PIN app-lock: handled entirely by your device's operating system (Face ID / fingerprint / device PIN). The biometric data never leaves your device and is never transmitted to or stored by Rebaar. The same is true of passkeys on web and mobile: your device checks your face, fingerprint or PIN locally and then sends us a cryptographic signature. We receive the signature. We never receive, process or store the biometric itself, and we could not reconstruct it from what we hold.
• Sign-in tokens: stored in the device's secure keystore (iOS Keychain / Android Keystore), never in plain text.
• Phone maker and model: each time you sign in, the app sends your phone's maker and model (for example “Xiaomi Redmi Note 8”), which we store with that sign-in and use only to name the phone in your list of signed-in phones under Settings → Security.

All app data is transmitted over HTTPS/TLS. You can request deletion of your account and data at any time — see Section 6.

Strictly to operate the product. Specifically:

• Authenticate you and your team
• Render projects, invoices, reports requested by users in your workspace
• Relay communications you initiate (invoice emails, WhatsApp reminders) to the integrations you've connected
• Bill you for your subscription
• Send service emails (welcome, password reset, payment receipts, security alerts)
• Detect anomalies that might indicate abuse or compromise
• Improve the product (aggregate, anonymised usage signals only — never per-user)

We don't use your data for: marketing, ad targeting, third-party data brokers, ML training. If we ever change this, we'll ask for affirmative consent first.

Rebaar relies on a small number of third-party services to operate. The current list, with what each one handles:

• Infrastructure & storage: DigitalOcean, Cloudflare — all primary data stays in India
• Subscription billing: Razorpay
• Email delivery: Resend
• Error monitoring: Sentry (PII redacted before transmission)
• Rate limiting: Upstash (Redis) — holds short-lived request counters keyed by user or hashed IP
• Marketing-site analytics: Google Analytics 4 (Google LLC) — consent-gated; loads only on the public rebaar.in marketing pages after you accept the analytics cookie category, never inside the logged-in product. Used for aggregate visit measurement only.
• Optional, per-workspace: Meta WhatsApp, Anthropic Claude (OCR), Zoho Books / QuickBooks — only active when you opt in

Material changes to subprocessors are announced at least 14 days in advance via the workspace Owner's email.

• Active workspaces: kept indefinitely while your subscription is active
• After cancellation: workspace remains accessible in read-only mode for 90 days; after that we may permanently delete it unless you re-subscribe
• Audit log: kept while the workspace exists, unless an Owner sets a shorter period under Settings → Data & retention (never less than 1 year). When a workspace is deleted, its latest 500 entries are retained 8 years (Indian tax law requires it for financial records)
• Invoices we issued to you: Rebaar-issued invoices for your subscription are retained 8 years as issued, with the payment references needed to reconcile them — Indian law requires it, and an altered voucher is not a valid record. Used only for accounting, tax and dispute resolution, never to contact you.
• When you delete your workspace: deletion is scheduled 30 days ahead. The workspace is read-only meanwhile — you can export everything, and any Owner can cancel. Billing stops straight away. If you cancel the deletion, the workspace works normally again until the end of the period already paid for. After 30 days your workspace data is deleted from our active systems.
• When a subscription stops being paid: the workspace becomes read-only when the paid period ends. After 30 days only the Owner can sign in, to pay or to export. After 60 days we email every Owner that the workspace will be deleted, and after 90 days it is deleted. A free trial that never became a paid subscription stays read-only after the trial ends, and is deleted only after 120 days in which nobody from the company has signed in: we email every Owner at 90 days, and signing in at any point before the deletion stops it. (A company opened again with an email address whose free trial was already used keeps that trial’s dates: it is deleted 30 days after the original trial ended, and at least 7 days after our email.) Apart from that case, the deletion is never less than 30 days after our first email about it; every email carries a link to export your data, and paying at any point before the deletion stops it.
• When we suspend a workspace: we email the reason and a link to object. You have 30 days to object, and a person decides within 15 days. Only a person can then close the workspace, with 30 days’ notice, during which the Owner can ask for a copy of the workspace’s data. A suspension made automatically is reviewed by a person within 24 hours. A legal hold (a police or court request) pauses every deletion until it is lifted.
• Backups: daily encrypted off-site archives, held in a private bucket and used only to restore the service after a failure, are deleted automatically after 365 days; our database provider also keeps rolling backups for 7 days. So a copy of a deleted workspace may exist in those archives for up to a year — never used for anything else and never returned to service.
• When a team member leaves a company: a member cannot delete their own account — it belongs to their company. They ask to be removed (Settings → Danger zone → Request removal, or the Can't sign in? page); their company removes them or objects, and if nobody answers in 30 days their access ends and their login email is released so another company can add them. Their login and every way into the account are removed; the work they did stays with the company, with their name on it. Their personal details (phone, address, photo, personal fields) are erased when they ask and the company accepts. If their employer must keep wage, attendance, leave or tax records about them — Indian law requires it (the Code on Wages rules and the ESI and EPF rules for 5 years from the last entry, and income-tax record-keeping for longer) — those records stay with the employer as issued, with the person's name, for 8 years after the last entry; an accepted erasure is recorded in the company's privacy register with that date. Once 8 years have passed since the last record, work or history entry that names them, those kept records are deleted, anything personal left is erased, and their name on the company's work and in its history of changes becomes “Former member” — the work stays, the person can no longer be identified from it.
• After deleting a free-trial workspace: we keep a one-way hash of the email address, together with the trial end date, solely so a deleted trial cannot be restarted. The hash cannot be reversed to identify you, and that record itself holds no email address, phone number or device identifier. It is deleted after one year.

You have the following rights at any time, exercisable from Settings → Privacy:

• Access & export (§11(1)(a)) — download every row of every table in your workspace as a JSON bundle plus your uploaded files. Available immediately, no waiting period.
• Correction (§11(2)) — edit any record at any time via the product UI
• Erasure / right to be forgotten (§12) — an Owner schedules the workspace for permanent deletion 30 days later (cancellable until then, see Section 5); any other member asks their company to remove them (Request removal), and their login email is released if the company does not answer within 30 days. The latest 500 audit-log entries and the invoices we issued to you are retained as issued per legal requirement, an employer's wage, attendance, leave and tax records about a member are kept for the period in Section 5, and for a never-paid trial only the irreversible trial-abuse hashes described in Section 5.
• Withdraw consent — cancel your subscription, request deletion. We don't hold you in.
• Grievance redressal (§13) — escalate to [email protected]. We reply within 7 working days and resolve within 30 days.

Operational controls in place:

• TLS 1.3 in transit, AES-256 at rest (database + file storage)
• Third-party tokens (Razorpay key secrets, GST credentials, WhatsApp access tokens) encrypted with AES-256-GCM at the application layer, key derived from a deployment-level master secret
• 2FA TOTP available; Owners can require it via env-var policy
• Every query is scoped to your workspace, and isolation between workspaces is tested automatically before every release
• Daily encrypted off-site backups retained 12 months; approximately 7-day database point-in-time recovery
• Annual third-party penetration test planned once we cross paying-customer scale. SOC 2 Type II and ISO 27001 are on our post-launch roadmap — not certified today.

For more detail, see Security overview.

We use necessary cookies always, and analytics cookies only after you opt in. We never use advertising, ad-network, or cross-site tracking cookies.

Necessary (always on)

• construct_session — your authenticated session. Required for login.
• Short-lived OAuth and SAML state cookies during sign-in flows. Deleted on completion.
• A small cookie that remembers your cookie-consent choice so we don't ask again.

Analytics (off until you opt in)

On the public marketing site (rebaar.in), if and only if you accept the “analytics” category in the cookie banner, we load Google Analytics 4, which sets first-party cookies:

• _ga, _ga_* — distinguish anonymous visitors and measure aggregate page views. They expire after about 13 months.

These do not load before you consent, and they never load inside the logged-in product. If you decline, or later withdraw consent from the cookie banner, Google Analytics is switched off and the_ga cookies are deleted. IP addresses are anonymised, and the data is never used for advertising or to identify you personally. Google LLC processes this analytics data — see Sections 4 and 10.

Rebaar is a B2B product. We don't knowingly collect personal data from anyone under 18. If you discover a minor's data in your workspace (e.g. a worker register), it's your responsibility to handle it per Indian child-labour law.

Primary data lives in India, on DigitalOcean's Bangalore region. Some sub-processors have offices or sub-processors outside India (Resend, Anthropic, Meta, Sentry, Google, Upstash) — see Section 4 for specifics. By using Rebaar you consent to data being transferred to these processors for the specific purposes listed. We use Standard Contractual Clauses where applicable.

We'll announce material changes 14 days in advance via Owner email. Minor edits (typos, clarifications) are made silently with the “Last updated” date refreshed at the top of this page.

Data protection contact (DPDP Act 2023): [email protected] — replies within 7 working days and resolves within 30 days.
Grievance officer (per IT Act 2000, Rule 3(11) IT Rules 2021): [email protected] — responds within 7 working days.
Security vulnerabilities: [email protected] (see also /.well-known/security.txt).
Postal: Rebaar, Bengaluru 560102, Karnataka, India