Privacy Policy

1. Who We Are

Mr.Repo ("we", "us", "our") operates a Mr.Repo platform for local businesses. Our platform allows businesses to collect customer feedback via QR codes and manage their online presence.

For privacy inquiries, contact us at: support@mrrepo.ai

2. Data We Collect

Business Account Data

When a business creates an account, we collect: name, email address, phone number (optional), business name, and a hashed (bcrypt) password. We never store plain-text passwords.

Customer Feedback Data

When a customer submits feedback via a QR code, we collect: star rating, written feedback message, and — only when the customer explicitly opts in — their name, email address, and/or phone number. Contact information is never collected without a clear, unchecked-by-default opt-in checkbox.

Usage Data

We collect standard server logs including IP addresses, browser type, and pages visited for security and abuse prevention. We use a session cookie to keep business users logged in.

3. How We Use Your Data

• To deliver the platform services (feedback collection, analytics, alerts)
• To send follow-up messages to customers — only when they have explicitly consented via an opt-in checkbox
• To send transactional communications (account verification, billing receipts)
• To detect and prevent fraud and abuse
• To improve our product (aggregate, anonymized analytics only)

We do not sell personal data to third parties. We do not use personal data for advertising targeting.

4. Third-Party Processors

We share data with the following processors, each operating under a data processing agreement:

• Our hosting and database provider — database hosting for all stored data
• Resend — transactional and consent-based email delivery
• Twilio — SMS delivery (consent-based only)
• Google Cloud Storage — business logo uploads
• Amazon S3 — file attachments in support conversations

If you use AI features such as suggested replies or complaint themes, the text of the relevant feedback is sent to our AI provider, OpenAI, to produce the result.

5. Data Retention

When you delete your account, we switch it off straight away and, after 7 days, delete your business profile, customer feedback records and uploaded files from our live systems. During those 7 days you can undo the deletion using the link in the email we send you. If a file cannot be deleted at that moment, the failed step is recorded so our team can run it again. After that we keep a minimal record that does not include your name or your email address in readable form: an internal member ID, a keyed hash of your email, a keyed hash of your Google account ID if you signed in with Google, how you signed in, a log of account events such as plan changes and deletion, plan and billing history (invoice amounts and dates, without card details), and the dates you first and last used the service. If the same person appears to have more than one account, we also keep a flag and a short note that refers only to internal member codes. We keep this record to prevent repeated use of free trials and to keep billing records. 12 months after your data is deleted we replace or remove everything in it that could identify you: the email hash, the Google account hash, the sign-in method, the account event log, the flag and note, and the first and last used dates. What remains is the internal member ID and the invoice records (plan, amount, status and date), which no longer identify you. We also keep a keyed hash of the email address and of the Google Business listing used to start each trial, together with the trial's end date, so the same trial cannot be restarted. These cannot be turned back into the original email address or listing, and we delete them 12 months after your data is deleted.

Customer feedback data is retained according to the business's configured retention window (default: 365 days). After this period, personally identifiable information (name, email, phone) is automatically anonymized. The feedback content and metadata are retained for analytics.

Customers who consented to follow-up communications can request full deletion of their feedback record at any time using the unsubscribe link included in every message.

6. Your Rights (GDPR & CCPA)

Depending on your jurisdiction, you may have the following rights:

• Right of access — request a copy of your personal data
• Right to rectification — correct inaccurate personal data
• Right to erasure — request deletion of your personal data ("right to be forgotten")
• Right to restriction — restrict processing in certain circumstances
• Right to portability — receive your data in a machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to opt out of sale — we do not sell data, so this right is automatically satisfied

To exercise any of these rights, email support@mrrepo.ai. Customers who submitted feedback can also use the unsubscribe link in any message they received to request full deletion of their record.

7. Cookies

We use the following cookies:

• We use Google Analytics on our public website pages, such as the home page, pricing and blog, to understand how visitors find and use them. We do not use it in the logged-in app, the admin and support areas, sign-in pages or customer review pages, and we do not send it web addresses that carry sign-in or reset tokens. It sets cookies (their names begin with _ga) and sends page-visit data, such as pages viewed, approximate location and device type, to Google, which acts as our service provider. You can opt out with Google's browser add-on at https://tools.google.com/dlpage/gaoptout or by blocking analytics cookies in your browser.
• Session cookie (essential) — keeps business users logged in. Cannot be disabled.
• UI preference cookie (functional) — stores sidebar state and theme preference in localStorage. No personal data.
• Cookie notice flag — only remembers that you closed the cookie notice, in localStorage.

Our pricing page sends a request to ipapi.co, a geolocation service, which uses your IP address to look up your country so we can show prices in your local currency.

8. Security

Passwords are hashed using bcrypt (12 rounds). All data is transmitted over TLS. Database access is restricted to application servers. We apply rate limiting to all public-facing endpoints.

9. Changes to This Policy

We will notify registered business accounts of material changes to this policy by email. Continued use of the platform after changes take effect constitutes acceptance.