Privacy Policy
Effective date: 24 August 2026
1. Introduction
Abmiro Solutions Private Limited ("Rekart", "we", "us", "our") is committed to protecting your privacy and handling your data responsibly. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you have over your information when you use rekart.io, app.rekart.io, our white-label customer applications, the Rekart Store App, the Rekart Mobile App for delivery agents, or any other product or service we provide (together, the "Services").
By using our Services, you acknowledge that you have read and understood this Privacy Policy.
2. Who we are
- Legal name: Abmiro Solutions Private Limited
- Trading name: Rekart
- Registered office: 7A, 701, Raichandani Galaxy, Baner Road, Near Croma, Baner, Pune – 411045, Maharashtra, India
- Contact for privacy matters: help@rekart.io
- Grievance Officer (as required under the Digital Personal Data Protection Act, 2023): help@rekart.io
We operate in India, the United Arab Emirates, Ireland (European Union) and Canada.
3. How we use your data — two distinct roles
Rekart handles data in two different roles, depending on the type of data. Understanding the difference matters for your rights.
| Data | Rekart's role | Who is responsible |
|---|---|---|
| Personal data about our business customers — company representatives, billing contacts, users of app.rekart.io | Data Controller | Rekart determines how this data is used |
| Personal data about the end-customers of our business customers — the individuals who subscribe to a dairy, tiffin, water or other delivery service running on Rekart | Data Processor | Our business customer is the Data Controller; Rekart processes this data only on their instructions |
If you are an end-customer using an app or service built on Rekart, please refer first to the privacy policy of the business you subscribe to. That business is the Data Controller of your data; Rekart acts on their behalf.
4. What data we collect
4.1 Data we collect from our business customers (where we are Controller)
- Identity and contact data — name, business name, designation, email address, phone number, business address
- Account credentials — username, hashed password, multi-factor authentication tokens
- Billing and payment data — GST information, invoice history, payment reference IDs. We do not store full card numbers; payment card details are processed and stored by our payment partners (see Section 6)
- Usage data — pages visited, features used, session logs, IP address, device information, browser type
- Communications data — records of your correspondence with our support, sales and success teams
4.2 Data we process on behalf of our business customers (where we are Processor)
When our business customers use Rekart to run their delivery operation, the following data about their end-customers passes through our systems:
- Name, phone number, email address, delivery address
- Order history, subscription details, delivery status
- Wallet balance, transaction history, invoice records
- Communications history — WhatsApp, SMS, email and push notification content
- Support tickets and complaints
- Device information and IP address (for the customer app)
We process this data strictly on instructions from our business customers and in accordance with our Data Processing Addendum, which forms part of our Terms of Service.
4.3 Data we collect automatically
- Cookies and similar technologies — for essential functionality, analytics, and (where applicable) marketing. See our Cookies Policy for details
- Server and application logs — request logs, error logs, performance metrics
- Analytics data — via Google Analytics and Firebase Analytics
5. Why we use your data and our legal basis
We use personal data for the purposes below. The legal basis for each purpose is listed where applicable under the EU General Data Protection Regulation (GDPR).
| Purpose | Legal basis (GDPR) |
|---|---|
| To provide, operate and maintain the Services | Performance of a contract |
| To process payments and issue invoices | Performance of a contract; legal obligation |
| To provide customer support and respond to enquiries | Performance of a contract; legitimate interests |
| To send service announcements, security notices and important operational updates | Legitimate interests; legal obligation |
| To send marketing communications about Rekart | Consent (where required); legitimate interests |
| To improve our products, develop new features and understand usage patterns | Legitimate interests |
| To detect, prevent and address fraud, abuse, security or technical issues | Legitimate interests; legal obligation |
| To comply with legal, regulatory and tax obligations | Legal obligation |
Under the Digital Personal Data Protection Act, 2023 (India), we process personal data on the basis of consent or in furtherance of a legitimate use as permitted under that Act.
6. Who we share your data with
We do not sell personal data. We share personal data only in the following circumstances:
6.1 Our sub-processors
We use trusted third-party service providers to help deliver the Services. Each is bound by contractual obligations to protect your data. We share personal data only within the following categories of sub-processors:
- Cloud hosting and storage providers
- Payment processing providers
- WhatsApp Business Solution Providers (BSPs)
- SMS delivery providers
- Email delivery providers (transactional and marketing)
- Push notification providers
- Artificial intelligence and large-language-model providers
- Route optimisation providers
- Website and application analytics providers
- Internal operations and collaboration tools
The specific list of sub-processors we use within each category is available on request at help@rekart.io.
6.2 Our business customers
If you are an end-customer, your data is accessible to the business you subscribe to (the Data Controller).
6.3 Legal, regulatory and safety disclosures
We may disclose personal data to comply with applicable laws, respond to lawful requests from public authorities, enforce our Terms of Service, or protect the rights, property or safety of Rekart, our users or others.
6.4 Business transfers
If Rekart is involved in a merger, acquisition, restructuring or sale of assets, personal data may be transferred to the successor entity. We will notify affected individuals.
7. AI processing
Rekart uses artificial intelligence, including large-language-model services provided by Google (Google Gemini), Anthropic, OpenAI and other leading model providers where applicable, to power our conversational commerce and related features. When an end-customer interacts with a business's WhatsApp channel powered by Rekart:
- The customer's message, subscription state, wallet balance and order history may be sent to the AI service
- The AI service uses this data to interpret the customer's intent and generate a response
- Every action taken by the AI (for example, pausing a subscription or recording a payment) is confirmed with the customer before it is executed
- We do not use customer conversation content to train third-party AI models unless the business customer has explicitly opted in
- All AI interactions are logged and available for audit
If you have questions about AI processing of your data, contact help@rekart.io.
8. International data transfers
Rekart operates in India, the United Arab Emirates, Ireland and Canada. Personal data may be transferred to and processed in any of these locations, or in other countries where our sub-processors operate.
For transfers of personal data from the European Economic Area, the United Kingdom or Switzerland to countries not deemed to offer an adequate level of data protection (including India), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent safeguards.
For transfers from India, we comply with the Digital Personal Data Protection Act, 2023 and any notifications issued by the Government of India regarding cross-border transfers.
9. How long we keep your data
We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law.
| Data category | Typical retention period |
|---|---|
| Business customer account data | Duration of the contract + 7 years for tax and audit records |
| End-customer data processed on behalf of a business | As directed by the business customer, subject to legal minimums |
| Payment and billing records | 8 years (India tax law) |
| Website analytics data | Up to 26 months (as configured in Google Analytics) |
| Support communications | 3 years after resolution |
| Marketing communications | Until you opt out or the underlying consent is withdrawn |
When personal data is no longer needed, we securely delete or anonymise it.
10. How we protect your data
We apply reasonable technical, organisational and administrative security measures to protect personal data, including:
- Encryption of data in transit using TLS
- Encryption of sensitive data at rest
- Role-based access control for our staff
- Access logging and audit trails
- Regular security reviews of our systems and sub-processors
- Employee training on data protection
- A documented process for responding to data security incidents
No system is completely secure. If you suspect any unauthorised access to your account or believe your data has been compromised, contact us immediately at help@rekart.io.
11. Your rights
Depending on the law that applies to you, you may have some or all of the following rights over your personal data:
- Right to access — obtain a copy of the personal data we hold about you
- Right to rectification — ask us to correct inaccurate or incomplete data
- Right to erasure — ask us to delete your personal data ("right to be forgotten"), subject to legal exceptions
- Right to restrict processing — ask us to limit how we use your data in certain circumstances
- Right to data portability — receive your data in a structured, machine-readable format
- Right to object — object to certain types of processing, including direct marketing
- Right to withdraw consent — where processing is based on your consent, withdraw that consent at any time
- Right to complain — lodge a complaint with the relevant data protection authority in your jurisdiction
To exercise any of these rights, contact help@rekart.io. We will respond within the time limits set by applicable law (typically 30 days).
If you are an end-customer of a business using Rekart, please raise your request first with that business, as they are the Data Controller of your data.
12. Children's data
Rekart is a business-to-business service and is not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided data to us, contact help@rekart.io so we can take appropriate action.
Business customers using Rekart are responsible for compliance with applicable laws regarding data of minors in their end-customer base.
13. Cookies
We use cookies and similar technologies on rekart.io and within our Services for essential functionality, analytics and (where applicable) marketing. You can manage cookies through your browser settings. Certain features of the Services may not function correctly if cookies are disabled.
14. Changes to this Privacy Policy
We will make our best effort to update this Privacy Policy at the earliest to reflect changes in law, technology, business practices or user feedback. When we make material changes, we will notify affected users by email or through a notice in the Services. The "Effective date" at the top of this Policy indicates when it was last updated.
Continued use of the Services after changes take effect constitutes acceptance of the revised Policy.
15. Contact us
For any questions, requests or complaints about this Privacy Policy or how Rekart handles your personal data, contact:
Grievance Officer / Data Protection Contact Abmiro Solutions Private Limited 7A, 701, Raichandani Galaxy, Baner Road, Near Croma Baner, Pune – 411045, Maharashtra, India Email: help@rekart.io
If we are unable to resolve your concern to your satisfaction, you have the right to lodge a complaint with the Data Protection Board of India (under the DPDPA, 2023) or with your local data protection authority.