Privacy Policy

Privacy Policy

Last updated: 17 October 2026

The short version

• We use your information to run loyalty programs, sign you in, process subscriptions and keep the Service secure.
• A shop can see the details and activity of customers in its own program only — never your activity at other shops.
• We do not sell personal data.
• Our application servers and database run on AWS in Mumbai, India. Some of our service providers may process data outside India (see section 6).
• You can ask us to access, correct or delete your data by emailing sales@navyats.com.

1. Who we are and who this covers

ReVisit is operated by Navya Tech Solutions, Dandi pada, Boisar, Maharashtra, India - 401501 (“ReVisit”, “we”, “us” or “our”). This policy explains how we handle personal data about:

• Merchants — business owners and people who use a business account;
• Customers — people who join a shop’s loyalty program on ReVisit;
• Partners: people in our referral partner program; and
• Visitors — people who browse our website, public shop pages and menus.

2. ReVisit’s role and the merchant’s role

2.1. Where we decide how data is used. We are responsible for the personal data we use for our own purposes: merchant accounts, subscriptions and payments, sign-in and account security, fraud prevention, customer accounts on the ReVisit platform, support, our website, and meeting our legal obligations.

2.2. Where we act for merchants. When a merchant runs its loyalty program on ReVisit, the merchant decides its program rules and how it uses its own customers’ information (for example, which customers it rewards, blocks or contacts, and what it does with an exported customer list). For that program data, we process the information to provide the loyalty features to the merchant.

2.3. Merchant responsibilities. Merchants must use customer information obtained through ReVisit only to run their own loyalty program and serve their own customers, must have a lawful basis for any information they add or export, and are responsible for their own use of exported data. This does not reduce our own responsibilities under this policy or the law.

3. Information we collect

A. Account information

• All users: name, mobile number and/or email address used to sign in, account role, country and timezone, and (where set) a password, which is stored only in hashed form.
• Customers (optional): email address, profile photo, date of birth and anniversary, if you choose to add them.

B. Business information (merchants)

• Business name, category, branding, branch names and addresses, branch phone numbers, opening hours, contact details, social and ordering links, and, if the merchant chooses, each branch’s map coordinates.
• Content the merchant uploads, such as logos, menu items and photos, rewards and scratch-card prizes.
• Delivery address and contact details for sending you a QR kit, where applicable.

C. Loyalty activity

• Visits: the shop and branch, date and time, and whether the visit was approved.
• Stamps, coin transactions and balances, the purchase amount staff enter to calculate coins, reward and scratch-card records, redemptions and referral links.
• Notes and actions a merchant records, such as a goodwill coin credit or a reason for blocking a customer from its program.

D. Location

• 150-meter visit verification: if a branch has turned this on, we ask for your device’s location only after you tap to verify your visit. We compare it with the branch location and keep only whether the check passed, the approximate distance in meters, and the accuracy your device reported. We do not store your raw coordinates, and we do not track your location continuously or in the background.
• Finding shops near you: if you allow location on the Explore page, we use your coordinates to look up your city (see section 5) and show nearby shops. We do not save these coordinates to your account. Your chosen city may be remembered in your browser.

E. Payments and subscriptions

We keep subscription and transaction records: plan, billing period, amount, currency, status, dates, and the order and payment references from our payment gateway. When you pay, we share your name, phone number and/or email with Razorpay so it can process the payment. Your card, UPI or bank details are entered directly with Razorpay; we do not receive or store your full card number, CVV, UPI PIN or bank credentials.

E2. Partner program

• Your partner code, approval status and commission rate, the businesses linked to you, and the commission earned and paid on their subscription payments (the business name, plan, amount and date).
• Your payout details: either a UPI ID, or a bank account holder name, account number, IFSC, bank name and branch. These are stored encrypted and used only to pay your commission, including a small test transfer to confirm the account. When you enter an IFSC, we look it up in Razorpay’s public IFSC directory to show the bank and branch; only the IFSC is sent.
• If the law requires us to deduct tax from your commission, the tax details we need for that, such as your PAN, which we will ask you for.
• Your choices for partner notifications.

Partners see the names and plan status of the businesses linked to them, never those businesses’ customers.

F. Technical and security information

• IP address, browser and device details, and server and security logs, used to keep the Service working, prevent abuse (for example, rate-limiting scans and sign-in attempts) and investigate problems.
• Your approximate country, worked out from your IP address, to preselect your country and show prices in a suitable currency.
• Browser push-notification details (a delivery address issued by your browser, plus your browser/device type), only if you choose to turn on notifications.
• Records of when authorised ReVisit staff access a merchant account for support.

G. Communications

Messages you send us by email, phone or WhatsApp or our social media accounts, including any contact details you share there.

4. How we use information

• To provide the Service: running reward cards, recording visits, stamps and coins, showing rewards, menus and shop pages.
• To sign you in and protect accounts, including sending one-time passcodes.
• To process subscriptions and payments and keep accounting and tax records.
• To run the partner program: linking referred businesses, working out commission and paying it.
• To send service messages, such as passcodes, notifications about your loyalty activity, and subscription expiry reminders.
• To prevent fraud and abuse, such as fake visits, self-scanning and referral abuse.
• To provide support and respond to your requests.
• To understand how our public website is used and improve it (see section 9).
• To meet legal obligations and to establish, exercise or defend legal claims.

Marketing: service messages are needed to run your account. We do not use customer loyalty data to send our own marketing. Merchants may send optional notifications to their customers through ReVisit; customers can control browser notifications in their browser and notification settings.

5. Who we share information with

We do not sell, rent or trade personal data. We share it only as follows:

• With the shop you visit. A merchant can see the name, phone number, and any optional profile details (email, date of birth, anniversary) of customers in its program, along with their activity at that merchant only. Merchants can export their customer list. Other merchants cannot see your activity elsewhere.
• Public information. Shop names, addresses, menus and other business information merchants choose to publish appear on public pages.
• With service providers who help us run the Service, under contracts or terms that restrict how they may use the data:

We also use a small number of other technical services (for example, website analytics, looking up a city from location coordinates, estimating a visitor’s country from their IP address, reading menus that merchants upload for import, delivering browser notifications you turn on, and generating QR code images), which receive the data needed for that task. These providers may also have their own legal responsibilities and privacy policies for the data they handle. We update this list when our providers change.

• For legal reasons. Where required by law, by a court or by a government authority, or where reasonably necessary to protect the rights, safety or security of our users, the public or ReVisit.
• Business transfers. If our business is reorganised or transferred, data may be transferred to the new operator, who must keep protecting it in line with this policy.

6. Where data is stored and processed

6.1. Primary storage in India. The ReVisit application, its database and uploaded files run on servers that we manage ourselves on AWS infrastructure in the Mumbai, India region. We do not use an AWS-managed database service.

6.2. Processing outside India. Some of our service providers may store or process data outside India, in the locations they use under their own terms.

6.3. Legal basis for transfers. We transfer data outside India only as permitted by Indian law, including any restrictions notified by the Government of India. If you use ReVisit from outside India, your data will be processed in India and in the locations described above.

7. How long we keep information

7.1. General rule. We keep personal data for as long as your account is active and the data is needed to provide the Service, and afterwards only as long as needed for the purposes below.

• Payment, invoice and tax records, including partner commission and payout records, are kept for the periods required by Indian tax and accounting law.
• Security logs and records needed for fraud or dispute handling are kept as long as needed for that purpose or as required by law.
• Loyalty activity is kept while it is needed to show balances and history to the customer and the merchant, or until it is deleted at the customer’s or merchant’s request, subject to the exceptions above.

7.2. Backups. When data is deleted from our live systems, copies may remain in backups until those backups are deleted in the normal course. We do not restore deleted data from backups except to recover from data loss or as required by law, and we keep backups protected in the meantime.

8. Your choices and rights

Subject to applicable law, you can ask us to:

• tell you what personal data we hold about you and how we use it;
• correct, complete or update inaccurate information (you can also edit your own profile in the app);
• delete your account and personal data, unless we must keep certain records as explained in section 7;
• withdraw consent you have given (for example, by turning off browser notifications or location in your browser); and
• nominate another person to exercise your rights if you die or become incapacitated, where the law provides for this.

How to make a request. Email sales@navyats.com, preferably from the email address on your account, and tell us your registered mobile number and what you would like us to do. We may need to verify that the request comes from you before acting on it, and we will only ask for what we need to do that. We will acknowledge your request and tell you the outcome.

Requests about a shop’s program. If your request concerns how a particular shop uses your information (for example, a customer list it has exported), you may also contact that shop directly. We will help pass on or handle requests about data held on ReVisit.

Deleting a merchant account. Merchants can ask us to close their business account. Please export any customer records you need first. We will delete or anonymise the account’s data in line with section 7.

9. Cookies, local storage and analytics

• Necessary cookies: we use session, sign-in (“remember me”) and security (CSRF) cookies to keep you signed in and protect forms. The Service does not work without them.
• Local storage: your browser stores a few small preferences, such as your chosen city on the Explore page and whether you have installed the app on your home screen.
• Analytics: our public pages (such as the home page, sign-in page, public shop pages and these policy pages) load Google Tag Manager, which may set cookies or collect information about how the pages are used, such as pages visited, device and browser type, and approximate location. You can block or delete these cookies through your browser settings without affecting your ability to use the Service. We do not use advertising cookies inside the signed-in owner or customer app.

10. Security

We use reasonable security measures appropriate to the data we handle, including encrypted connections (HTTPS), hashed passwords, one-time-passcode sign-in, access controls that limit each merchant to its own data, rate limits, and logging of staff access to merchant accounts. No system is completely secure. If a personal data breach occurs, we will act to contain it and notify affected users and the authorities where the law requires.

11. Children

ReVisit is intended for people aged 18 and over. We do not knowingly collect personal data from children without the consent of a parent or lawful guardian. If you believe a child has given us personal data without that consent, please contact us so we can deal with it.

12. Changes to this policy

We will update this policy when our practices or providers change, and update the “Last updated” date. For material changes, we will also notify merchants by email or in the dashboard.

13. Questions and complaints

For privacy questions, rights requests or complaints, contact us below. If you are not satisfied with our response, you may have the right to complain to the relevant authority under Indian law, including the Data Protection Board of India once that route is available to you.

Privacy & Grievance Contact — Navya Tech Solutions

Dandi pada, Boisar, Maharashtra, India - 401501

Email: sales@navyats.com

Phone: +91 70666 24254

Support Hours: Monday to Friday, 10:00 AM to 6:00 PM IST