This Privacy Policy explains how Central Solutions (“Central Solutions”, “we”, “us”) collects, uses, stores, and protects information in connection with Reputae, our operations and reputation platform for multi-outlet restaurant and hospitality groups, and this website at centralsolutions.in.
Central Solutions is a sole proprietorship registered in India (Udyam) and based in Mumbai, India. For any question about this policy or about your data, contact ansh@centralsolutions.in.
1. Who this policy covers
Reputae is business software sold to hospitality groups. There are two kinds of people whose information we handle:
- Our customers and their staff — the businesses that license Reputae, and the head office, general managers, and outlet staff who hold accounts in it.
- Members of the public who leave reviews — where a customer connects a review platform, Reputae processes the review content that platform makes available, on that customer’s behalf.
For data belonging to a customer’s business, that customer is the data controller and Central Solutions acts as a processor, handling the data only on the customer’s instructions.
2. What we collect and why
Account and contact information
Names, work email addresses, phone numbers where provided, assigned role (head office, general manager, outlet staff), and the outlets a user is assigned to. We collect this to create accounts, authenticate users, apply role-based access control, and contact customers about the service.
Business and outlet information
Outlet names, addresses, operating hours, holiday and closure calendars, and area structure such as kitchen, bar, front of house, and housekeeping. We collect this to schedule checklists per outlet and to report on the group correctly.
Operational data entered in the product
Checklist completions, timestamps, the user who completed an item, notes, and any photographs a user attaches to a checklist item. We collect this to run daily opening and closing checklists, track compliance across a group, and generate the daily operational brief.
Review data from connected platforms
Where a customer connects a review platform such as Google or Zomato, we process the reviews and business information that platform makes available for that customer’s own listings — review text, rating, review date, reviewer display name as published by the platform, and the customer’s replies. We process this to display reviews to the customer, allow the customer to respond, and include review activity in the daily brief. See section 7 for specific commitments about Google user data.
Technical and security logs
Sign-in events, IP address, browser and device type, and application error logs. We collect this to keep the service secure, investigate faults, and detect unauthorised access.
We do not collect payment card details in the product. We do not buy personal data from third parties, and we do not run advertising.
This website
This website sets no cookies, runs no analytics, and does not track visitors. If you email us, we hold that correspondence in order to reply to you.
3. Legal basis and how we use data
We use the data described above only to provide, secure, support, and improve Reputae for the customer it belongs to, and to meet legal obligations. Specifically, we use it to operate the features the customer has signed up for, to authenticate and authorise users, to provide support when asked, to diagnose and fix faults, and to detect and prevent abuse.
We do not sell personal data. We do not share it for advertising.
4. How data is stored and secured
Reputae runs on established cloud infrastructure providers under their standard security and confidentiality terms. Our security measures include:
- Encryption in transit using TLS for all connections.
- Encryption at rest for databases and file storage.
- Role-based access control inside the product, so users see only the outlets and functions their role permits.
- Restricted administrative access, limited to personnel who need it to operate or support the service.
- Credentials and platform access tokens held in encrypted secret storage, never in application code or logs.
- Logging of access and administrative actions.
No system can be guaranteed perfectly secure. If we become aware of a breach affecting personal data, we will notify affected customers without undue delay and comply with applicable Indian law, including the Digital Personal Data Protection Act, 2023 and reporting requirements that apply to us.
5. How long we keep data
- Account data — kept while the account is active. Deleted within 30 days of a user being removed, or of the customer’s contract ending.
- Operational and checklist data — kept for the term of the customer’s contract, because customers rely on it for compliance history. Deleted within 60 days of contract termination unless the customer asks us in writing to delete it sooner or to export it first.
- Review data from connected platforms — kept only while the connection is active. If a customer disconnects a platform or revokes access, we delete the stored data from that platform within 30 days. See section 7.
- Technical and security logs — kept for up to 12 months, then deleted.
- Business records — invoices and contracts are kept for as long as Indian tax and company law requires.
Backups are held on a rolling cycle and are overwritten within 90 days, so deleted data may persist in backups for up to that period before being permanently removed.
6. Who we share data with
We share data only with service providers who help us run Reputae, and only to the extent they need it. These currently fall into these categories:
- Cloud hosting and database providers.
- Email delivery providers, for transactional email.
- Error monitoring and logging providers.
- Review platforms a customer has chosen to connect, such as Google and Zomato, in order to read and post on that customer’s behalf.
These providers act on our instructions and are bound by confidentiality and data protection obligations. We may also disclose data where we are legally required to by a valid order under applicable law. We do not sell data to anyone, and we do not share it with data brokers, advertisers, or ad networks.
7. Google user data
This section describes specifically how Reputae handles data obtained through Google APIs, including the Google Business Profile API.
What we access and why
When a business connects its Google Business Profile to Reputae, the business authorises us through Google’s OAuth consent screen. Reputae then accesses that business’s Google Business Profile data — its business locations and details, and the reviews and review replies on those locations — for the sole purpose of displaying and managing that information on that business’s behalf inside Reputae. Concretely, this means showing the business its reviews, letting authorised users reply to them, and including review activity in the daily operational brief we produce for that business.
We request the narrowest scopes needed for those functions. We do not access Gmail, Google Drive, Google Contacts, or any other Google service.
Limited Use commitment
Central Solutions’ use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular:
- We use Google user data only to provide and improve the user-facing features of Reputae described above.
- We do not sell Google user data, and we do not transfer it to anyone except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with the customer’s consent.
- We do not use Google user data for advertising, ad targeting, ad personalisation, or any advertising purpose whatsoever.
- We do not use Google user data to develop, train, improve, or fine-tune any generalised or non-personalised artificial intelligence or machine learning model. Where Reputae uses automated analysis to generate a business’s own daily brief, that processing serves only that business, its output is visible only to that business, and the data is not retained by or used to train any third-party model.
- Humans do not read Google user data, except where the business has given explicit consent for a specific issue, where it is necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymised for internal operations such as capacity planning.
Storage and retention of Google data
Google data is stored on the same encrypted infrastructure described in section 4, and is segregated so that each business’s data is accessible only to users of that business. OAuth tokens are stored encrypted and are used only to make API calls on that business’s behalf. We retain Google data only while the connection is active.
Revoking access and deletion
A business can revoke Reputae’s access at any time, either by disconnecting Google inside Reputae, or directly from their Google Account at myaccount.google.com/permissions. On revocation we stop making API calls immediately, delete the stored OAuth tokens, and delete the Google Business Profile data we hold for that business within 30 days, subject to the backup cycle described in section 5. Revocation does not require contacting us, and we do not charge for it.
8. Your rights and how to request deletion
Subject to applicable law, including India’s Digital Personal Data Protection Act, 2023, you may ask us to give you access to the personal data we hold about you, correct it if it is inaccurate, delete it, or provide it in a portable form. You may also withdraw a consent you previously gave.
To make a request, email ansh@centralsolutions.in with the subject line “Data request”, telling us what you want and which business or outlet you are associated with. We will acknowledge within 7 days and respond substantively within 30 days. We may need to verify your identity before acting.
If you are a member of staff at one of our customers, your employer controls your account, so we may need to direct your request to them and will tell you if that is the case. If you are a customer of a business that uses Reputae and want a review you posted removed, that review belongs to the platform you posted it on — contact that platform — but we will delete our stored copy of it on request.
9. Children
Reputae is business software and is not directed at children. We do not knowingly collect personal data from anyone under 18. If we learn we have, we will delete it.
10. International transfers
Our infrastructure providers may process data in locations outside India. Where that happens, we rely on those providers’ contractual data protection commitments and take reasonable steps to ensure an equivalent level of protection.
11. Changes to this policy
If we change this policy we will update the date at the top of this page. Where a change materially affects how we handle personal data, we will notify affected customers by email before it takes effect.
12. Contact
Central Solutions
Mumbai, India
ansh@centralsolutions.in