Privacy Policy

RepairFlow is operated by Vaseem Khan, a sole proprietor based in Faridabad, Haryana, India. In this policy, "RepairFlow", "we", and "us" mean that operator. This policy covers the RepairFlow website (repairflow.app), the RepairFlow mobile app, and RepairFlow Web at app.repairflow.app. Contact [email protected] for any privacy question or request.

For shop owner and staff accounts, billing, support, and security, RepairFlow is the controller of the personal data and decides how it is used.

For a shop's own customer, repair, inventory, and sales records, the shop is the controller and RepairFlow processes that data on the shop's behalf to provide the Service. Customers of a shop should contact that shop first about their data; we will help the shop respond.

• Account data: name, email, phone number, authentication provider, role, shop membership, and session information.
• Shop data: business name, contact details, country and region defaults, tax identifiers, invoice settings, logos, and staff settings.
• Customer and repair data: customer contact details, device details such as models and IMEI or serial numbers, issue descriptions, photos, repair status, staff notes, estimates, invoices, labels, and receipts.
• Inventory and sales data: suppliers, stock items, purchase orders, POS sales, device purchases and sales, pricing, and transaction records.
• Billing data: for Web Pro, the Paddle customer, subscription, transaction, status, billing-period, cancellation, and refund identifiers needed to verify access and support billing requests; for the mobile app, subscription status from Google Play or the Apple App Store through RevenueCat; and trial and founder-price status.
• Support data: messages or requests you send to RepairFlow support.
• Technical data: device type, operating system, app usage, crash reports, and performance data from the mobile app; and general website usage from Google Analytics on repairflow.app.
• Web usage data, if enabled: account ID, organization ID, shop ID, role, and the latest date and time a signed-in RepairFlow Web page was used. It does not include page URLs, searches, clicks, or customer records.

The mobile app asks for these permissions to provide its features. You can manage them in your device settings at any time.

• Camera: to take photos of devices for repair records and to scan QR codes and barcodes.
• Storage / Photos: to upload existing photos of devices and to save generated invoices (PDFs) to your device.
• Contacts: optional, only if you choose to import customer details from your device contacts.
• Notifications: to send important updates about your account, subscription, and app features.
• Internet: to sync your data with our cloud servers.

• Provide shop management workflows, including intake, repair tracking, documents, inventory, POS, and settings.
• Authenticate users, enforce roles, secure sessions, and protect shop data from unauthorized access.
• Generate documents such as estimates, invoices, receipts, labels, and customer-facing repair summaries.
• Run free trials and subscriptions, and verify plan access.
• Send service emails such as staff invitations and account, trial, or billing notices.
• Provide support, diagnose issues, prevent abuse, and improve reliability.
• Comply with legal, security, fraud-prevention, and data-rights obligations.

Where the GDPR or UK GDPR applies, we rely on these legal bases:

• Contract: to create and run your account, provide the Service, and manage your subscription or trial.
• Legitimate interests: to secure the Service, prevent abuse and fraud, measure use, and improve reliability, balanced against your rights.
• Legal obligation: to keep billing and tax records and respond to lawful requests.
• Consent: only where we ask for it, and you can withdraw it at any time.

You need to give us account and shop details to use RepairFlow; without them we cannot provide the Service. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

We use trusted providers to operate RepairFlow. Each has its own privacy policy.

• Firebase (Google): authentication, Firestore database, app analytics, crash reporting, file storage, and abuse prevention (App Check and reCAPTCHA Enterprise). Firebase privacy
• Cloudinary: repair photos and business images such as shop logos. Cloudinary privacy
• Vercel: hosting for RepairFlow Web. Vercel privacy
• Paddle: Merchant of Record and subscription billing for RepairFlow Web Pro. Paddle privacy
• RevenueCat: mobile subscription status for purchases made through Google Play or the Apple App Store. RevenueCat privacy
• Resend: service emails such as staff invitations and account or billing notices. Resend privacy
• Telegram: internal alerts to the RepairFlow team about mobile subscription events, containing an account ID and subscription status only.
• Google Analytics: aggregate visitor statistics for the repairflow.app website. Google privacy

One-click WhatsApp messages open WhatsApp on your own device with a pre-filled message. The message is sent from your WhatsApp account under WhatsApp's terms; RepairFlow does not send it on your behalf.

RepairFlow Web uses an essential session cookie to keep signed-in users authenticated and a small number of browser storage keys for interface preferences. See the RepairFlow Web Cookie Notice for details. The repairflow.app website uses Google Analytics cookies to measure visits.

Paddle handles Web Pro checkout and billing as the Merchant of Record under its own terms. Google Play and the Apple App Store handle mobile app purchases. RepairFlow stores only the billing identifiers and subscription state needed for access, reconciliation, support, and refunds. We never receive or store your card or bank details.

RepairFlow records payments that shops collect from their own customers outside RepairFlow. It does not process, hold, route, or settle those shop-customer funds.

• All data is encrypted in transit (HTTPS) and at rest in our cloud database.
• Access is controlled through Firebase Authentication, shop membership, role-based permissions, server checks, and database security rules.
• Automated daily backups protect against data loss.

RepairFlow is operated from India, and our service providers process data in the United States and other countries. When personal data from the EU or UK is transferred to a country without an adequacy decision or UK data bridge, we rely on safeguards the law recognizes, such as the EU-US Data Privacy Framework and its UK Extension where a provider is certified, or the providers' standard contractual clauses with the UK Addendum.

Depending on where you live, you can ask us to access, correct, delete, or export your personal data, to restrict or object to how we use it, and to withdraw consent you have given. You can also opt out of marketing emails at any time. Email [email protected] from the account email, or with enough shop-identifying information for us to verify the request. We respond within one month of verifying it. For complex or numerous requests, the law lets us extend this by up to two more months, and we will tell you if we do.

If you are unhappy with how we use your personal data, email [email protected] with the subject "Data protection complaint". We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome. In India, this is also how to raise a grievance with us.

You can also complain to a data protection authority at any time: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the supervisory authority in the country where you live, work, or where the issue happened.

RepairFlow is a business tool for people aged 18 or over. We do not knowingly collect personal data from children for our own purposes.

We will update this policy when our practices change and email shop owners about material changes before they apply. The effective date at the top shows when it last changed.