This policy explains how Repwave ("we", "us") handles personal data in DarkScan, under India's Digital Personal Data Protection Act, 2023 and other applicable law.
What we collect
Website scanner: your email address, the store address you enter, your statement that you are authorised to scan it, and whether you chose to receive updates. We also briefly hold your IP address in memory to limit abuse.
Shopify app: your shop domain, plan, and Shopify access tokens (encrypted). If you choose to provide them, a test customer login and a storefront password (both encrypted).
Scans: screenshots, page copies, network logs and findings from the store pages we visit. These are about stores, but they could incidentally show personal data if a store displays it publicly.
Payments: Shopify and Razorpay process payments. We do not receive or store card details.
The Shopify app does not request access to customer data, and the scanner does not enter payment details. We do not set advertising or tracking cookies.
How we use it
We use this data to run scans, show reports, review uncertain findings, process payments, prevent abuse, fix problems, measure how accurate the scanner is, and meet legal duties. We send product updates only if you opted in, and you can withdraw that at any time.
Who processes it
Oracle Cloud (Mumbai, India): hosting, database and scan evidence.
Groq: an AI language model that assesses short pieces of store text, such as popup wording and checkbox labels. This text may be processed outside India.
Shopify: the app platform and subscription billing.
Razorpay: payments for one-time audits.
We do not sell personal data, and we do not publish findings about any store. We may disclose data where the law requires it.
How long we keep it
Scan evidence and reports are deleted after 12 months.
When you uninstall the Shopify app, its access tokens are removed immediately. Your shop's data and scans are deleted when Shopify sends a shop redaction request, about 48 hours later.
Website scanner contact details are kept until you ask us to delete them, or until they are no longer needed.
We may keep records longer where the law requires it.
Security
Connections use HTTPS, and tokens and logins are encrypted at rest. Report links are long and hard to guess, but anyone you give a link to can open that report, so share them with care. No system is perfectly secure.
Your rights
You may ask to access, correct or delete your personal data, withdraw consent, nominate someone to act for you, or raise a grievance. Email info@rakshiq.com, and we will respond within a reasonable time. If you are not satisfied, you may complain to the Data Protection Board of India once it is able to receive complaints.
Children
The Service is for businesses and is not meant for anyone under 18.