Rebota ("Rebota", "we", "us", "our") provides a construction project-management, cost and billing platform ("Service") to contractors and construction businesses through the website rebota.in. This Privacy Policy explains what information we collect, how we use it, and the rights available to you under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000. By creating an account or using the Service, you agree to the collection and use of information as described here.
Under the DPDP Act, the role your data plays depends on who entered it:
If you are a worker, vendor or client whose data was entered into Rebota by a business you work with (not by you directly), that business is the Data Fiduciary responsible for your data — please contact them first with any request; we will assist them as their Processor.
We use the information we collect to:
We do not sell your personal data or your project/business data to third parties, and we do not use your construction project data to train external advertising or AI models.
Subscription payments on Rebota are processed by Razorpay, an RBI-authorised payment aggregator. When you make a payment, your card, UPI or net-banking details are entered directly on Razorpay's secure payment page and are processed and stored by Razorpay in accordance with applicable RBI guidelines and PCI-DSS standards.
Rebota does not receive or store your full card number, CVV or net-banking credentials on our servers. We only receive a payment confirmation, transaction reference ID, amount and status from Razorpay, which we use to activate or extend your subscription and to maintain your billing history inside your account.
We share information only with the service providers below, each engaged under terms requiring them to protect the data and use it only to provide their service to us:
| Who | What for | What we send them | Where | When |
|---|---|---|---|---|
| Razorpay Software Private Limited | Subscription payment processing | Name, email, phone, billing address and payment amount. Card, UPI and net-banking credentials are entered on Razorpay's own page and never reach Rebota's servers. | India | When you make a payment |
| Hostinger International Ltd | Application and database hosting | All data stored in your account, at rest and in transit through the hosting infrastructure. | India | Always |
| Meta Platforms, Inc. (WhatsApp Business Cloud API) | WhatsApp message and OTP delivery | Recipient phone number and the content of the message sent. | Outside India (United States and Meta global infrastructure) | When WhatsApp notifications are enabled |
| Google LLC (Google Sign-In) | Signing in with your Google account, if you choose to | Google tells us your name, email address and profile picture; we send Google nothing beyond the sign-in request itself. | Global | Only when you choose "Continue with Google" |
| Google LLC (Google Analytics 4) | Counting which public pages and free tools help visitors, so we know what to improve | A random browser ID (cookie), the pages viewed and their type, which free tool was used (not the values you enter), device and browser type, and the approximate area Google derives from your IP address; for a subscription payment, the plan and amount — never your name, email, phone or business details. | Global | Only after you press Accept on the cookie banner; you can withdraw any time (Cookie choices) |
| gstinapi.in (GST API provider) | GSTIN lookup (public taxpayer details), e-Invoice (IRN) registration and e-Way Bill generation, update and cancellation with the Government of India's NIC portals | Supplier and buyer GSTIN, legal name and address, invoice number and date, line items, HSN codes, quantities, rates, taxable value and tax amounts — the full contents of the invoice being registered; transport and vehicle details for e-way bills; your NIC API username and password for filing; and any GSTIN you look up. | India | When you look up a GSTIN, or e-invoicing / e-way bills are enabled for your GSTIN |
| The AI provider configured for your account (Google Gemini, OpenAI, Anthropic or Groq) | Answering questions put to the in-app assistant | The text of your question, and the business context needed to answer it, which may include figures and record details from your account. | Outside India (provider-dependent) | Only when an AI provider is configured and the assistant is used |
| SMS gateway provider | OTP and transactional SMS delivery | Recipient phone number and message content. | India | When SMS delivery is configured |
Beyond these, we share information only: (a) if required by law, court order, or a valid request from a government or regulatory authority (including CERT-In); (b) if Rebota is involved in a merger, acquisition or sale of assets, subject to confidentiality commitments; or (c) with your explicit consent.
We use a session cookie strictly necessary to keep you logged in while using the dashboard. This cookie is marked HttpOnly and SameSite=Lax and is deleted when you log out or your session expires. We do not use advertising cookies.
Analytics (only with your consent). On our public website (home, industry pages, free tools, guides) we use Google Analytics 4 to count which pages and tools help visitors. It loads only after you press Accept on the cookie banner; if you press Decline or ignore the banner, nothing is sent to Google. When you accept, Google sets a random browser ID cookie (_ga) and receives the pages you view, which free tool you used (never the values you enter), your device and browser type, and an approximate area derived from your IP address. If you then create an account or pay for a plan, our server tells Google Analytics that a sign-up or a payment (plan and amount) happened, linked to that random ID, never to your name, email, phone or business details. Google signals and ad personalisation are switched off. We remember your choice in a rb_consent cookie for one year. You can change it at any time: Cookie choices.
In line with "reasonable security practices" under Rule 8 of the IT (Reasonable Security Practices and Sensitive Personal Data or Information) Rules, 2011, we maintain:
No method of transmission or storage is 100% secure, and while we work hard to protect your data, we cannot guarantee absolute security.
Primary hosting and database infrastructure is located in India. Your records are stored in India and are not routinely transferred abroad.
The following transfers do leave India, and only in the circumstances stated:
Each is limited to what the feature requires, and each is optional: if the feature is not enabled for your account, no transfer occurs. We do not otherwise transfer your personal data outside India.
Under the CERT-In Directions of 28 April 2022, we maintain ICT/security logs for a minimum of 180 days, stored within India, and will report qualifying cyber security incidents to CERT-In within 6 hours of detection.
We retain your account and project data for as long as your account is active, so that your dashboard and historical reports remain available to you. If you wish to permanently delete your account and associated data, write to us at support@rebota.in from your registered email address. We will action verified deletion requests within a reasonable time, except where we are required by law to retain certain records — see our full Data Retention & Deletion Policy for the schedule, including GST records (6 years) and company books of account (8 years).
If a personal data breach is likely to result in harm to you, we will notify affected users and the Data Protection Board of India without undue delay, in the form and manner prescribed under the DPDP Act, in addition to meeting our separate CERT-In reporting obligation described in Section 9.
Subject to verification of your identity and applicable law, you have the right to:
Rebota is a business tool intended for use by contractors, engineers and construction businesses. It is not directed at, and we do not knowingly collect personal information from, individuals under the age of 18.
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal/regulatory reasons. Material changes will be notified in-app or by email at least 15 days before they take effect. We will post the updated policy on this page with a revised "Last updated" date. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.
In accordance with the Information Technology Act, 2000, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023, the contact details of the Grievance Officer are:
We aim to acknowledge grievances within 24 hours and resolve them within 15 days. For any privacy-related questions, also see our Data Processing Agreement (for business customers) and Data Retention & Deletion Policy.