Rebota ("Rebota", "we", "us", "our") provides a construction project-management, cost and billing platform ("Service") to contractors and construction businesses through the website rebota.in. This Privacy Policy explains what information we collect, how we use it, and the rights available to you under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000. By creating an account or using the Service, you agree to the collection and use of information as described here.
Under the DPDP Act, the role your data plays depends on who entered it:
If you are a worker, vendor or client whose data was entered into Rebota by a business you work with (not by you directly), that business is the Data Fiduciary responsible for your data — please contact them first with any request; we will assist them as their Processor.
We use the information we collect to:
We do not sell your personal data or your project/business data to third parties, and we do not use your construction project data to train external advertising or AI models.
Subscription payments on Rebota are processed by Razorpay, an RBI-authorised payment aggregator. When you make a payment, your card, UPI or net-banking details are entered directly on Razorpay's secure payment page and are processed and stored by Razorpay in accordance with applicable RBI guidelines and PCI-DSS standards.
Rebota does not receive or store your full card number, CVV or net-banking credentials on our servers. We only receive a payment confirmation, transaction reference ID, amount and status from Razorpay, which we use to activate or extend your subscription and to maintain your billing history inside your account.
We share information only with the service providers below, each engaged under terms requiring them to protect the data and use it only to provide their service to us:
Beyond these, we share information only: (a) if required by law, court order, or a valid request from a government or regulatory authority (including CERT-In); (b) if Rebota is involved in a merger, acquisition or sale of assets, subject to confidentiality commitments; or (c) with your explicit consent.
We use a session cookie strictly necessary to keep you logged in while using the dashboard. This cookie is marked HttpOnly and SameSite=Lax and is deleted when you log out or your session expires. We do not currently use third-party advertising or tracking cookies on the application.
In line with "reasonable security practices" under Rule 8 of the IT (Reasonable Security Practices and Sensitive Personal Data or Information) Rules, 2011, we maintain:
No method of transmission or storage is 100% secure, and while we work hard to protect your data, we cannot guarantee absolute security.
Primary hosting and database infrastructure is located in India. Where a sub-processor (e.g. Meta/WhatsApp) processes data outside India as part of message delivery, that transfer is limited to what is necessary for the service and is subject to that provider's own security commitments. We do not otherwise transfer your personal data outside India.
Under the CERT-In Directions of 28 April 2022, we maintain ICT/security logs for a minimum of 180 days, stored within India, and will report qualifying cyber security incidents to CERT-In within 6 hours of detection.
We retain your account and project data for as long as your account is active, so that your dashboard and historical reports remain available to you. If you wish to permanently delete your account and associated data, write to us at support@rebota.in from your registered email address. We will action verified deletion requests within a reasonable time, except where we are required by law to retain certain records — see our full Data Retention & Deletion Policy for the schedule, including GST records (6 years) and company books of account (8 years).
If a personal data breach is likely to result in harm to you, we will notify affected users and the Data Protection Board of India without undue delay, in the form and manner prescribed under the DPDP Act, in addition to meeting our separate CERT-In reporting obligation described in Section 9.
Subject to verification of your identity and applicable law, you have the right to:
Rebota is a business tool intended for use by contractors, engineers and construction businesses. It is not directed at, and we do not knowingly collect personal information from, individuals under the age of 18.
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal/regulatory reasons. Material changes will be notified in-app or by email at least 15 days before they take effect. We will post the updated policy on this page with a revised "Last updated" date. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.
In accordance with the Information Technology Act, 2000, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023, the contact details of the Grievance Officer are:
We aim to acknowledge grievances within 24 hours and resolve them within 15 days. For any privacy-related questions, also see our Data Processing Agreement (for business customers) and Data Retention & Deletion Policy.