Privacy Policy

If you are a business owner (account holder):

• Business information: business name, type, address, city, state, country, Google Maps URL, logo
• Personal information: owner name, email address, phone number, hashed password (bcrypt)
• Payment information: processed through Razorpay — we do not store full card details
• Usage data: login activity, feature usage, QR code scans, feedback responses, dashboard analytics
• IP address: used to detect your country for regional pricing (via geoip-lite)

If you are an end customer (submitting feedback):

• Feedback you provide: ratings, comments, answers to custom questions
• Optional personal information: name, phone, email (only if the business owner enables these fields)
• Device and browser information: derived from your user-agent (e.g., mobile/desktop, Chrome/Firefox/Safari)
• No account is created — feedback is submitted anonymously unless you choose to provide your details

If you sign up for early access:

• Name and email address
• Discount code generated for you

Technical data collected automatically:

• IP address (for country detection and security), browser type, device type, operating system
• Pages visited, time spent, referral source
• We use localStorage for authentication tokens (ownranks_token), pending registration data (ownranks_registration_id), and theme preference (next-themes)

For business owners:

• To create and manage your account
• To process subscriptions and payments via Razorpay
• To generate QR codes and feedback forms for your business
• To display feedback and analytics on your dashboard
• To send service emails (welcome emails, OTP verification, invoices, billing notices)
• To send marketing emails only with your explicit consent
• To improve and troubleshoot the platform

For end customers (feedback submitters):

• To deliver your feedback to the business owner
• To enable the gift/reward and Google review redirect feature (if enabled by the business)
• We do not use end-customer data for marketing or profiling

Legal basis (GDPR):

• Contract performance: to provide the service you signed up for
• Consent: where you explicitly opt in (e.g., marketing emails)
• Legitimate interest: to improve our platform and prevent fraud
• Legal obligation: to comply with applicable laws

Service providers (processors):

• Razorpay — payment processing (they receive billing data necessary to process transactions)
• Brevo (Sendinblue) — email delivery service (email address for transactional and marketing emails)
• MongoDB Atlas — database hosting (all data stored securely)
• Cloud hosting provider — application hosting

With your consent:

• Google Maps / Google Reviews — if you enable the review redirect feature, customers are offered the option to be redirected to your Google Maps listing. No personal data is shared with Google beyond the redirect URL.

Legal requirements:

• If required by law, court order, or government authority
• To protect our rights, property, or safety, or that of our users

Business transfers:

• In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you via email.

Business owner accounts:

• Account data is retained while your account is active.
• After cancellation, feedback data is retained for 90 days, after which it is deleted.
• You can request earlier deletion by emailing hello@ownranks.com.

End customer feedback:

• Feedback data is retained as long as the business owner's account is active.
• Once the business owner deletes their account, associated feedback is deleted within 90 days.

Pending registrations (OTP verification):

• Registration data is automatically deleted 15 minutes after initiation via a database TTL (time-to-live) index.
• This includes all form data entered during registration if the OTP process is not completed.

Early access signups:

• Retained until launch, after which you may request deletion.

Backups:

• Encrypted backups are retained for up to 30 days after deletion.

India (DPDP Act 2023):

• Right to know: what data we collect and why
• Right to correction: update inaccurate data
• Right to deletion: request erasure of your data
• Right to grievance redressal: file a complaint with our Grievance Officer

European Union (GDPR):

• Right to access: obtain a copy of your data
• Right to rectification: correct inaccurate data
• Right to erasure ("right to be forgotten"): request deletion
• Right to restrict processing: limit how we use your data
• Right to data portability: receive your data in a machine-readable format
• Right to object: object to processing for marketing or legitimate interests

California (CCPA):

• Right to know: what personal information we collect and share
• Right to delete: request deletion of your data
• Right to non-discrimination: we will not discriminate against you for exercising your rights
• California residents may also request the categories of personal information disclosed for business purposes