1. Who We Are and How to Reach Us
Repurai is operated by Khawar Sultan, a sole proprietor trading as Repurai. For the purposes of the UK GDPR, the EU GDPR, and comparable data protection laws, Khawar Sultan is the data controller responsible for the personal data described in this policy. You can reach us at any time at support@repurai.com.
2. Information We Collect
We collect only what we need to operate the service. What we hold falls into four categories:
- Account information you provide directly: your email address, display name, a hashed password, and, if you sign in with Google, the basic profile information Google returns to us.
- Subscription and transaction information: your plan tier, subscription status, renewal dates, and transaction identifiers. Payment card details are never collected, seen, or stored by us. See section 5.
- Service content and configuration: the feeds and sources you add, the spaces you create, saved and read-later items, newsletter campaigns, API keys you generate, and your interface preferences.
- Technical and usage information: IP address, browser and device type, authentication session data, API call counts measured against your plan quota, and error diagnostics.
3. How We Use Your Information
We use personal data to authenticate you and keep your account secure, deliver and synchronise your feeds, generate AI summaries of content you have chosen to follow, send newsletter campaigns you configure, meter API usage against your plan, process subscriptions and send transactional notices, respond to support requests, and detect abuse or protect the integrity of the service. We do not use your personal data for advertising, and we do not sell it.
4. Legal Bases for Processing
Where the UK or EU GDPR applies, we rely on the following legal bases: performance of a contract, for everything necessary to provide the service you signed up for; legitimate interests, for securing the platform, preventing abuse, and improving reliability, balanced against your rights and freedoms; legal obligation, for tax, accounting, and compliance records; and consent, where we ask for it specifically, which you may withdraw at any time.
5. Payments and Card Data
All orders, payments, invoicing, and tax are handled by our Merchant of Record, Paddle.com Market Ltd. Card numbers, security codes, and banking credentials are entered directly into Paddle systems and are never transmitted to, processed by, or stored on Repurai infrastructure. We receive only what we need to provision your plan, such as your subscription identifier, plan tier, status, renewal date, and billing country. Paddle processes your payment data under its own privacy notice.
6. Service Providers and Data Processors
We do not sell your personal data or share it for advertising. We share the minimum necessary data with a small number of providers who process it on our behalf under contractual confidentiality and data protection obligations:
- Paddle.com Market Ltd, our Merchant of Record: order processing, payments, invoicing, tax compliance, refunds, and chargebacks.
- Supabase: managed database infrastructure, authentication, and encrypted data storage.
- Vercel: application hosting, content delivery, and edge request routing.
- Google: OAuth sign-in for accounts that choose it, and Google Gemini models used to generate summaries of content you follow.
- Our email delivery provider: transactional mail such as address verification, password resets, and feed alerts, plus the newsletter campaigns you schedule.
7. AI Processing
When a summary is generated, the relevant source content and the minimum context required are sent to Google Gemini. We do not send your account credentials, payment information, or unrelated personal data for this purpose. Summaries are returned to your account and stored alongside the item they describe. Summaries are generated automatically and may contain inaccuracies.
8. International Data Transfers
Our providers may process data in countries other than your own, including the United States and the United Kingdom. Where personal data protected by the UK or EU GDPR is transferred outside those areas, we rely on appropriate safeguards, such as Standard Contractual Clauses or an applicable adequacy decision.
9. Data Retention
We retain account data for as long as your account remains active. If you delete your account, we remove your personal data and service content within 30 days, except where we are required to keep records for longer. The most common example is transaction and tax records, which our Merchant of Record and we may retain for up to seven years to meet statutory accounting obligations. Backups are cycled out on a rolling basis.
10. Data Security
We apply technical and organisational measures appropriate to the risk, including encryption in transit, encrypted storage of credentials and integration secrets, scoped API keys that you can revoke at any time, and access controls limiting who can reach production data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
11. Cookies and Similar Technologies
We use cookies strictly to operate the service: keeping you signed in, maintaining session state, and remembering interface preferences such as your theme and view mode. We do not use advertising or cross-site tracking cookies. You can block or delete cookies in your browser, though doing so will prevent you from staying signed in.
12. Your Rights
Subject to your local law, you have the right to access the personal data we hold about you, correct inaccurate data, request deletion, object to or restrict certain processing, withdraw consent where processing relies on it, and receive your data in a portable format. You can exercise most of these directly from your dashboard settings, including exporting your data and permanently deleting your account. For anything else, email support@repurai.com and we will respond within 30 days. If you are in the UK or EEA and believe we have not handled your data properly, you also have the right to lodge a complaint with your national supervisory authority.
13. Children's Privacy
Repurai is not directed at children. You must be at least 16 years old, or the minimum age of digital consent in your country if that is higher, to create an account. We do not knowingly collect personal data from children below that age. If you believe a child has provided us with personal data, contact support@repurai.com and we will delete it.
14. Changes to This Policy
We may update this policy as the service evolves or the law changes. The date at the top of this page always reflects the current version. If we make a change that materially affects your rights, we will notify account holders by email or an in-app notice before it takes effect.
15. Contact Us
For privacy questions, data access or deletion requests, or any concern about how we handle your information, contact us at support@repurai.com.