Privacy policy

This policy explains what personal data RewardLoop collects, why, and your rights. We follow India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

Merchants (our customers)

• What we collect: your business name, email address, password (stored only as a secure hash by our authentication provider), your campaigns, and billing status.
• Payments: handled by Razorpay. We never see or store your card or UPI details; we keep only a subscription ID and its status.
• Why: to provide the service, bill you, send account emails such as verification and password reset, and answer support requests.

Players (people who spin a wheel)

• What we collect: the email address entered (if any), the prize and code won, the time, and a one-way hash of the IP address used to limit abuse. We do not store raw IP addresses.
• Who controls it: the business running the wheel decides why it collects your email and is responsible for how it uses it. We process it on their behalf. Contact that business, or us, to access or delete your data.
• Browser storage: the wheel stores a random ID in your browser so a wheel that doesn't ask for email can limit you to one spin. We don't use advertising cookies or trackers.

Service providers

We use Supabase (database and login), Vercel (hosting), Razorpay (payments) and an email delivery provider. They process data only to run our service. Some may store data outside India under appropriate safeguards.

Retention

We keep merchant data while the account is open and delete it within 30 days of closure, except records we must keep by law (such as invoices). Player data is kept until the merchant deletes the campaign or asks us to delete it.

Security

Data is encrypted in transit, access is limited by database row-level security so each merchant sees only their own data, and passwords are hashed.

Your rights

You can ask to access, correct or delete your personal data, or withdraw consent, by writing to hi@nabl.in. We reply within 30 days. You may also complain to the Data Protection Board of India.

Changes

We will post changes here and email merchants about significant ones.