Privacy Policy

RepairFlow is operated by Vaseem Khan, a sole proprietor based in Faridabad, Haryana, India. In this policy, "RepairFlow", "we", and "us" mean that operator. Contact support@repairflow.app for any privacy question or request.

For shop owner and staff accounts, billing, support, and security, RepairFlow is the controller of the personal data and decides how it is used.

For the shop's own customer, repair, inventory, and sales records, the shop is the controller and RepairFlow processes that data on the shop's behalf to provide the service. Customers of a shop should contact that shop first about their data; we will help the shop respond.

• Account data: name, email, authentication provider, role, shop membership, and session information.
• Shop data: business name, contact details, country/region defaults, tax identifiers, invoice settings, logos, and staff settings.
• Customer and repair data: customer contact details, device details, issue descriptions, repair status, notes intended for staff use, estimates, invoices, labels, and receipts.
• Inventory and sales data: suppliers, stock items, purchase orders, POS sales, device purchases, device sales, pricing, and transaction records.
• Billing data: Paddle customer, subscription, transaction, status, billing-period, cancellation, and refund identifiers or states needed to verify Web Pro access and support billing requests.
• Support data: messages or requests you send to RepairFlow support.
• Web usage data: the days a shop saved work on RepairFlow Web, which areas were used (tickets, customers, POS, stock, devices), and which staff accounts saved that work.

When staff save work on RepairFlow Web, such as a ticket, customer, POS sale, stock change, or device record, our server keeps one record per shop per day. It lists the areas used that day (tickets, customers, POS, stock, devices) and the staff accounts that saved work. It does not contain the contents of tickets, customers, or sales, prices, page views, clicks, searches, or device identifiers.

We use this only to improve RepairFlow Web and to offer help to shops. It is not used to monitor individual staff.

Only internal RepairFlow administrators can see this data, per shop, with staff shown only as counts. Shop owners and staff do not see it in the app. We keep each record for 13 months and then delete it automatically, or earlier when the account or shop is deleted.

• Provide shop management workflows, including intake, repair tracking, documents, inventory, POS, and settings.
• Authenticate users, enforce roles, secure sessions, and protect shop data from unauthorized access.
• Generate operational documents such as estimates, invoices, receipts, labels, and customer-facing repair summaries.
• Provide support, diagnose issues, prevent abuse, and improve product reliability.
• Understand how shops use RepairFlow Web, and contact shop owners about support, setup help, or feedback.
• Comply with applicable legal, security, fraud-prevention, and data-rights obligations.

Where the GDPR or UK GDPR applies, we rely on these legal bases:

• Contract: to create and run your account, provide the service, and manage your subscription or trial.
• Legitimate interests: to secure the service, prevent abuse and fraud, measure how shops use RepairFlow Web and contact them about support or feedback, and improve reliability, balanced against your rights.
• Legal obligation: to keep billing and tax records and respond to lawful requests.
• Consent: only where we ask for it, and you can withdraw it at any time.

You need to give us account and shop details to use RepairFlow; without them we cannot provide the service. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

RepairFlow Web uses trusted providers to operate the service:

• Firebase Authentication for account identity and secure login.
• Firestore for shop, staff, repair, customer, inventory, settings, and transaction data.
• Firebase App Check and reCAPTCHA Enterprise for abuse prevention on selected public or signup-related requests.
• Cloudinary for selected uploaded media such as shop logos and business images used by documents.
• Vercel for hosting the RepairFlow Web application.
• Paddle as the Merchant of Record and subscription billing provider for RepairFlow Web Pro.
• Resend for sending service emails, such as staff invitations and account or billing notices.
• Telegram for internal alerts to the RepairFlow team about mobile subscription events, containing an account ID and subscription status only.

The public marketing website may describe mobile app permissions or mobile billing tools. This policy describes RepairFlow Web specifically.

RepairFlow Web uses an essential HTTP-only session cookie to keep signed-in users authenticated and a small number of local browser storage keys for UI preferences. See the Cookie Notice for details.

Customer-facing documents should only include public repair and transaction information. Internal staff notes are not intended for customer receipts, labels, invoices, estimates, or printable customer documents.

Paddle handles RepairFlow Web Pro subscription checkout and provider-side billing as the Merchant of Record under its terms. RepairFlow stores limited billing identifiers and subscription state needed for access, reconciliation, support, and refunds; we do not store payment-method details, addresses, complete Paddle objects, or raw webhook payloads in the Web billing projection.

RepairFlow is shop-management SaaS that records repair-customer payments collected by shops outside RepairFlow. It does not process, hold, route, or settle those shop-customer funds.

RepairFlow is operated from India and our service providers process data in the United States and other countries. When personal data from the EU or UK is transferred to a country without an adequacy decision or UK data bridge, we rely on safeguards the law recognizes, such as the EU-US Data Privacy Framework and its UK Extension where a provider is certified, or the providers' standard contractual clauses with the UK Addendum.

We keep account and shop data while the account exists, including after Web access ends. After we verify a deletion request, we delete the account and shop data from the live database within 30 days. Copies in our backups are overwritten automatically within a further 60 days. We keep billing records as long as tax and accounting law requires, and Paddle keeps its own transaction records as the seller. We keep support emails for 24 months. We keep Web usage records for 13 months, then delete them automatically, or earlier with the account or shop.

Access is controlled through Firebase Authentication, shop membership, custom claims, server checks, and Firestore security rules.

Depending on where you live, you can ask us to access, correct, delete, or export your personal data, to restrict or object to how we use it, and to withdraw consent you have given. Email support@repairflow.app from the account email or with enough shop-identifying information for us to verify the request. We respond within one month of verifying it. For complex or numerous requests, the law lets us extend this by up to two more months, and we will tell you if we do.

If you are unhappy with how we use your personal data, you can complain to us by emailing support@repairflow.app with the subject "Data protection complaint". We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome. In India, this is also how to raise a grievance with us.

You also have the right to complain to a data protection authority at any time: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the supervisory authority in the country where you live, work, or where the issue happened.

RepairFlow is a business tool for people aged 18 or over. We do not knowingly collect personal data from children for our own purposes.

We will update this policy when our practices change and email shop owners about material changes before they apply.

For privacy, security, deletion, export, or support questions, email support@repairflow.app.