Privacy Policy

Who we are

Replate Private Limited (CIN U47912TS2026PTC220495) is a company incorporated in India, with its registered office at H No. 6-3-1093/406, V V Vintage Boulevard, Somajiguda, Nampally, Hyderabad, Telangana 500082. In this policy, "Replate," "we," "us" and "our" refer to Replate Private Limited. We rescue the unsold food of premium bakeries, cafés and other food businesses — stock that is within its shelf life and perfectly good to eat — and sell it as discounted "Surprise Bags," which you can book through the Replate app or over WhatsApp, paying via Razorpay. For any privacy question or request, contact our Grievance Officer at founders@tryreplate.com.

Information we collect

We keep what we collect to the minimum needed to run the service:

• Your phone number: the key to your Replate account. We verify it with a one-time SMS code when you sign in to the app, and use it to confirm bookings and send pickup codes (in the app and/or on WhatsApp).
• Your name and email: if you add them to your profile, or if you sign in with Apple or Google (which share the name and email on your Apple/Google account, under your control). Your first name is shown on the in-app City leaderboard only if you have added a name; entries without a name appear anonymously.
• Your booking history: the bags you reserve, the partner outlet, the amount, the pickup status, and the date and time of each order.
• Ratings and feedback: the ratings and comments you choose to submit after collecting a bag.
• Payment status: whether a payment was successful, refunded or failed. We do not collect or store your card, UPI or bank details: those are handled entirely by Razorpay on their secure systems.

We do not collect your device location. Distances shown in the app are calculated on your device and are not sent to us.

How the app is used

We count how often each part of the app is opened, so we can find the places where it gets in people's way and mend them. These are counts and nothing else: a number of times a screen was opened on a given night, and nothing that says who opened it.

• No account, and no device: a count is not linked to your phone number, your profile, your bookings, or any identifier for your phone or its installation of the app. There is nothing in a count to connect one to another, or to you.
• No location: a count records which city's board was being read, not where the reader was. Someone in Delhi looking at the Hyderabad board counts towards Hyderabad. This remains true of the whole app: we do not collect your device location, and distances are still worked out on your phone and never sent to us.
• Nothing you write: we do not record what you type, what is on your screen, or the contents of any message.

Because a count identifies nobody, it is not personal data, and we keep counts for as long as they are useful for comparing one month with another. We do not use them for advertising, we do not sell them, and we share them with no analytics company. They sit in the same managed database as the rest of the service, covered by the infrastructure and international transfer sections below.

If you choose to share usage data

The app asks once whether you'd like to help us improve it by sharing how you use it. It is off unless you say yes, and you can change your answer at any time in Settings.

If you say yes, we record what you do in the app: which screens you open and for how long, which bags and bakeries you look at, which bag you choose, where you stop before reserving, whether you allow notifications, and when something fails to load. Each record carries a random identifier for this installation of the app, the app version, your phone's operating system and version, the city whose board you were reading, and, once you sign in, your phone number, so the records can be linked to your account.

We never record what you type, what is on your screen, your location or any distance, or payment details. We do not use an advertising identifier, and we do not track you across other apps or websites.

We keep these records for 180 days, then delete them, keeping only totals that identify no one. If you turn sharing off, we stop recording straight away and delete what this installation has sent. Deleting your account deletes them too. We do not use them for advertising, we do not sell them, and we share them with no analytics company.

Crash reports

When the app crashes or hits a serious error, it sends a crash report to Firebase Crashlytics, a Google service we use to find and fix faults. A report contains technical details of the fault (where in the app's own code it happened), your phone's model, operating system and app version, and a random identifier for this installation of the app. It does not contain your name, phone number, bookings or location. Google processes these reports for us under its Firebase terms and keeps them for 90 days.

How we use your information

• To take, confirm and fulfil your Surprise Bag bookings.
• To send you listings, pickup codes and order updates in the app, by SMS and/or over WhatsApp.
• To process payments and refunds through Razorpay.
• To show community features such as the City leaderboard (first name only, and only if you have added one).
• To count how often each part of the app is used, so we can find and fix what gets in the way.
• If you choose to share usage data, to understand how the app is used and fix what gets in the way.
• To find and fix crashes and faults in the app.
• To provide customer support and respond to your questions.
• To keep records required for tax, accounting and legal compliance, and to prevent fraud or misuse.

We process your information on the basis of your consent (given when you sign up and accept this policy) and, for booking and payment records, to perform the service you have requested. We do not use your information for advertising, and we do not sell your personal data to anyone.

Third parties we share data with

We share only what is necessary, only with the service providers that help us operate:

• Razorpay: our payment partner, which processes your payments and refunds. Your payment instrument details are collected and stored by Razorpay, not by us. See the Razorpay Privacy Policy.
• Supabase: our database, authentication and hosting provider, where your account (phone, name, email) and booking records are stored. See the Supabase Privacy Policy.
• Twilio: delivers the one-time SMS codes used to verify your phone number. See the Twilio Privacy Notice.
• Apple / Google: if you choose "Sign in with Apple" or "Sign in with Google," your sign-in is processed by Apple or Google under their own terms, and they share your name and email with us under your control.
• Google Firebase: delivers the app's push notifications (Firebase Cloud Messaging) and, if the app crashes, receives the crash report described above (Firebase Crashlytics). See the Firebase privacy information.
• Meta Platforms / WhatsApp: if you book or receive updates over WhatsApp, your number and messages are processed by WhatsApp under its own terms. See the WhatsApp Privacy Policy.

We may also disclose information where required by law, a court order or a valid request from a public authority.

Where your data is processed

Some of our infrastructure providers (including Supabase) may process or store data on servers located outside India. Where this happens, we take reasonable steps to ensure your information is handled under appropriate safeguards and in accordance with applicable Indian law, including the Digital Personal Data Protection Act, 2023.

How we protect your information

We follow reasonable security practices and procedures appropriate to the data we hold, as required under Indian law: access to personal data is limited to what operating the service requires, connections to our systems are encrypted in transit, payment credentials never touch our systems, and our providers (Supabase, Razorpay, Twilio) maintain their own certified security programmes.

In the unlikely event of a personal-data breach that affects you, we will notify the Data Protection Board of India and affected users as required by the Digital Personal Data Protection Act, 2023, and tell you what happened and what we are doing about it.

Data retention

We keep your information for as long as you use Replate and for as long afterwards as we need it to meet our legal, tax and accounting obligations under Indian law (which can require retaining transaction records for several years). When it is no longer needed, we delete or anonymise it.

Your choices and rights

You can ask us to access, correct or delete the personal information we hold about you, withdraw your consent, or nominate another person to exercise these rights on your behalf (as provided by the Digital Personal Data Protection Act, 2023). Some records may be retained where the law requires it.

Deleting your account: you can delete your Replate account directly in the app (Settings → Delete account) or by emailing founders@tryreplate.com from the contact details linked to your bookings. Deletion removes your profile (name and email) immediately and signs you out on your device; any remaining signed-in session expires automatically shortly afterwards. Booking and payment records are retained in anonymised form for the legal and accounting reasons above. Because they are linked to your phone number for compliance, they will re-associate with you if you later create a new account with the same number.

Children

Replate is intended for adults. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date above reflects the latest version, and material changes will be reflected on this page.

Contact & grievances

For any privacy question, request or grievance, contact our Grievance Officer:

Grievance Officer: Aditya Arya, Replate Private Limited
Email: founders@tryreplate.com
Phone / WhatsApp: +91 75050 02117
Address: H No. 6-3-1093/406, V V Vintage Boulevard, Somajiguda, Nampally, Hyderabad, Telangana 500082, India
Hours: Mon–Sat, 10:00 AM – 7:00 PM IST

We acknowledge grievances within 48 hours and aim to resolve them within 15 days of receipt.