Privacy Policy

Last updated: 23 October 2026

The rest of this page explains these promises in detail. It covers how SPAS Solutions ("we", "us"), the business behind ReapGains, collects, uses and protects personal data when you visit reapgains.com or use the ReapGains service. We follow the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the Information Technology Act, 2000 and the rules made under them.

1. Who we are

SPAS Solutions is a sole proprietorship of Ms. Surbhi Garg, with its registered address at X-306, 3rd Floor, Amrapali Silicon City, Sector 76, Noida, District Gautam Buddha Nagar, Uttar Pradesh 201301.

• For your own account details (your name, phone number and email), we are the Data Fiduciary under the DPDP Act.
• For the business data you connect or upload, including any details of your own customers, you remain the Data Fiduciary. We act only on your behalf, as your data processor.

2. What we collect, and what we do not

• Your account details: your name, business name, email address, mobile number and your role in the business.
• Business data you choose to connect or upload: orders, products, costs, fees, settlements, returns, shipping and advertising figures from the services you connect (for example Shopify, Amazon, Flipkart, Shiprocket or Meta), and the spreadsheets you upload. Order data can include your customers' delivery city and PIN code. We ask only for the data needed to calculate profit.
• Access keys: the API keys or tokens that let ReapGains read your accounts. Where a platform lets you choose, we ask only for read access.
• Message preferences: if you opt in to WhatsApp or email updates, your number or email, your consent and a record of the messages we sent.
• Technical data: log-in times, pages used, IP address, device and browser type, kept to run and secure the service.

We do not collect your payment card or bank login details (payments are handled by a licensed payment gateway), your passwords for marketplaces or stores, or anything from your devices beyond what your browser sends. The reapgains.com website uses no advertising or tracking cookies.

3. How we use it, and only for this

• To create your account and confirm it is you when you log in, with a one-time code.
• To calculate your profit figures and send you the reports, briefings and alerts you asked for.
• To answer your questions and fix problems you report.
• To keep the service secure, prevent misuse, and meet legal duties such as tax and accounting rules.
• To send product news, only if you have agreed to receive it.

We will not use your data for any other purpose without asking you first. Your profit figures are calculated by our own fixed formulas from your data, not by an AI model.

4. Your consent

We ask for your consent when you sign up, in plain language, and record when and how you gave it. Connecting each data source is a separate choice that you make. You can withdraw consent at any time by disconnecting a source, turning off messages, or deleting your account. Withdrawing consent does not affect processing that already happened.

5. WhatsApp and email messages

We send WhatsApp messages only to numbers whose owners have opted in. Reply STOP or change your settings to stop them at any time. Every marketing email has a one-click unsubscribe link. Messages carry your own figures only, never another customer's, and never your access keys. Log-in codes are sent by email or SMS, never over WhatsApp.

6. Who else handles your data

We never sell your data or share it with other businesses, data brokers or advertisers. A few service providers help us run ReapGains. Each one handles data only to provide its service to us, under a contract that requires it to protect that data:

• Microsoft Azure (India region): hosts our servers, databases and file storage.
• Our log-in provider: verifies your phone number or email when you sign in.
• Email and SMS delivery providers: deliver log-in codes and the emails you asked for.
• Meta's WhatsApp Business Platform: delivers WhatsApp briefings, only if you opt in.
• A payment gateway: processes subscription payments, once paid plans start.

We will disclose data to a court or government authority only where the law requires it, and we will tell you unless the law forbids us.

7. Where your data is stored

Your business data and uploaded files are stored on Microsoft Azure servers in India, in a database used only by your business. Log-in details are held by our log-in provider, and WhatsApp and email messages pass through the delivery providers above, which may process them outside India.

8. How we protect it

• Encryption: all connections use encrypted HTTPS (TLS), and stored data and files are encrypted at rest.
• Separation: each business has its own database with its own database login. Our software works out which business you belong to from your verified log-in on our servers, never from anything your browser sends, so one customer cannot reach another's data.
• Keys in a vault: access keys are stored in a key vault and referenced by name. They are never shown on screen, written to logs or included in messages.
• Logged, limited staff access: only our operations team can open customer data, only to fix a problem you report, and each access is recorded in an audit log. Personal details are hidden by default.
• Clean logs: our system logs record what happened, never your keys or your financial figures.
• Test systems use made-up data only. Real customer data exists only in our live system, never in development or test systems.

No system is perfectly secure. If a personal data breach happens, we will tell affected users without delay, explain what happened and what we are doing, and report it to the Data Protection Board of India as the law requires.

9. How long we keep it

• Business data: while your account is active. If you disconnect a source, we stop reading it immediately. You can also ask us to delete the data already imported from it.
• When you delete your account: you have 7 days to change your mind. After that, we delete your database, files and access keys, and email you a written confirmation. Encrypted backups are overwritten in the normal backup cycle, within 35 days.
• Enquiries from people who are not customers: deleted after 30 days if you do not confirm your interest, and after 12 months of inactivity otherwise.
• Invoices and tax records: for as long as Indian tax law requires.
• Security logs: only as long as needed to protect the service.

10. Your rights

Under the DPDP Act you can:

• ask what personal data we hold about you and how we use it;
• correct, complete or update it;
• have it erased;
• withdraw your consent;
• nominate someone to exercise these rights for you if you cannot; and
• raise a grievance with us, and then with the Data Protection Board of India.

You can disconnect sources, download your reports and delete your account from Settings in the app. For anything else, email support@reapgains.com. We reply within 48 hours and complete your request within 7 days, unless the law requires us to keep something.

11. Children

ReapGains is a business service for people aged 18 and over. We do not knowingly collect children's data.

12. Grievance Officer

Name

Ms. Surbhi Garg, Proprietor, SPAS Solutions

Email

support@reapgains.com (subject: Grievance)

Address

X-306, 3rd Floor, Amrapali Silicon City, Sector 76, Noida, District Gautam Buddha Nagar, Uttar Pradesh 201301

Response time

We acknowledge within 48 hours and resolve within 30 days.

If you are not satisfied with our response, you may approach the Data Protection Board of India.

13. Changes to this policy

We will never weaken these promises quietly. We will post changes on this page and update the date at the top. For any significant change, we will email account users at least 30 days before it takes effect, and you can delete your account before then if you disagree.