Privacy Policy

Refloat is operated by Refloat Private Limited, India (“Refloat”, “we”). This policy covers three groups of people: business owners who hold a Refloat account; creators who apply to, or are listed in, the Refloat creator directory; and the customers of those businesses, whose information may pass through Refloat when an owner uses our tools. Section 6 deals with customers’ information and section 8 with creators.

Account information. When you sign in with Google or with an email address, we receive your name, email address and, from Google, your profile photo. We store this to identify your account.

Business information. Details you enter during onboarding and afterwards: business name, category, address, opening hours, services and prices, your logo, photos you upload, and your Google Place ID where you have one. Using your Place ID we also fetch public information about your listing and nearby businesses, such as ratings, photos and published reviews.

Sales information. Point-of-sale exports you upload and sales you log in Refloat, including items, amounts, dates and, where you enter one, the customer’s phone number.

Connected platform information. Where you connect a third-party account, the identifiers, access tokens and data needed to act on your instructions. Section 5 sets this out account by account.

Usage information. Logs of requests to our service, used for security, debugging and rate limiting.

We use your data to run the features you choose to use: calculating your business health score and weekly report; drafting posts, posters, captions and review replies; building and hosting your website; running your loyalty card, review requests and sales tracker; answering your questions in the in-app assistant; and publishing or sending what you have approved to the accounts you have connected.

We also keep a searchable memory of your business’s own text, such as reviews, captions, customer messages and the preferences you give us, so that drafts stay consistent with what you have said before. That memory is used only for your business.

We do not sell your data, and we do not use it to train AI models.

Refloat uses AI to draft text and images. Posts, posters, review replies, campaign messages and advertisements are not published or sent until you approve them, and you remain responsible for what you approve.

One feature works differently. When you connect a WhatsApp Business number, Refloat’s assistant replies automatically to customers who message that number, using the business details, services and prices you have given us, and hands the conversation to you when a customer needs a person.

Health scores, insights and recommendations are estimates. They are not financial, legal or professional advice.

Connecting any third-party account is optional and always started by you. For each connection we store only what the feature needs, and access tokens are encrypted before they are stored. We share data from a connected account only with the platform it came from and the service providers in section 9.

Google Business Profile. If you connect your Google Business Profile, we read: your Google account’s list of business locations, so you can choose yours; that listing’s name, phone number, website, address, categories, description, opening hours, service area and open or closed status, and any changes Google has made to them; your reviews and your replies to them; the posts on your listing; the photos and videos you have added, and the number of photos customers have added; the attributes and services you list; daily figures for how often your listing was seen and how often people called, asked for directions, visited your website, messaged, booked or ordered; the search terms people used to find you; and your verification status. We write only two things to Google: replies to your reviews and posts on your listing, and each is published only after you approve it in Refloat.

We store the account and location identifiers, the names and addresses of the locations on your account, and an encrypted refresh token that lets us act on your behalf. If you connect during sign-up, before your business exists in Refloat, we hold the token for up to an hour; if you do not finish, we delete it and ask Google to revoke Refloat’s access, on the condition described below. We also keep what we read: your reviews, the results of your listing audit, the review replies we draft, and copies of your own listing photos in your Refloat photo library. Reviews read through your connection are used only for your own business: we never show them to, or use them for, any other business on Refloat. Review text and ratings are sent to Anthropic to draft replies and insights, and reach Anthropic together with your audit results when you use the in-app assistant. Review text is also sent to Google’s Gemini API to find businesses similar to yours and, where business memory is switched on, to keep drafts consistent. Your listing photos may be sent to OpenAI as references when we make a poster for you. We do not use information from Google to develop, improve or train generalised AI or machine learning models.

We use information received from Google only to provide the features you see in Refloat. We do not sell it, and we do not use it for advertising. People at Refloat do not read it unless you ask us to, it is needed for security purposes such as investigating abuse, or the law requires it. When you disconnect Google Business Profile, we delete the stored token and ask Google to revoke Refloat’s access. Google revokes the whole grant rather than one business’s share of it, so if another of your businesses is still connected through the same Google account we leave that access in place for it and only your stored token goes. We also delete the reviews we read through the connection, the matching data and business memory we built from them, and the listing audits made with it. Three things stay until you delete your account: copies of your own listing photos in your photo library, the replies you drafted and already posted to Google (the review each one answers is removed from them), and your past health scores and reports, which quote reviews. Replies you never posted are deleted. When you delete your account, we revoke Refloat’s access on the same condition and delete all of it, photos included. Whatever we do, you can remove Refloat’s access yourself at any time from your Google Account. Refloat’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Instagram. If you connect your Instagram professional account, we store its account ID, username and an access token, and the IDs of posts we publish for you. We use these to publish posts you have approved, and to read the like, comment, save, reach and impression counts on those posts so we can show you how they performed. We do not read your followers, your direct messages, the text of comments, or figures for posts we did not publish. Instagram access tokens expire after about 60 days, after which you reconnect; we delete the token when you disconnect.

Facebook Pages and advertising. If you connect a Facebook Page, we store the Page ID, a Page access token and the status of the advertising permission you granted us. We use it only to run ads you have approved with your Page as the advertiser, to create the ad posts those ads need, and to read those ads’ spend and performance. We cannot read or reply to your Page’s messages, or change its settings. For ads we run, we store the campaign settings and the spend and performance figures Meta returns. When you disconnect the Page, we remove Refloat’s access to it on Facebook and delete the stored token.

WhatsApp. If you connect a WhatsApp Business number, we store its phone number ID, WhatsApp Business Account ID and an access token, and send and receive messages on that number for you. You remain the owner of the WhatsApp Business account, the phone number, your message templates and your billing relationship with Meta. Messages are delivered by Meta and are also subject to Meta’s privacy policy and the WhatsApp Business Messaging Policy. Section 7 explains how we handle message content and opt-outs.

Some features involve people who are not Refloat users. This can include: the name and phone number of a customer you add to a loyalty card or a sale; the name, phone number or email address you enter when issuing a partner coupon, which we use to send them the coupon; the phone number and messages of a customer who writes to your connected WhatsApp number, and details they share in that conversation such as their name or what they are looking for; what a customer taps and writes on a review request you have shared, and their phone number only if they choose to leave it; and reviews already published publicly about your business. For review requests we do not store the customer’s IP address, only a one-way keyed hash of it, used to prevent abuse.

Under India’s Digital Personal Data Protection Act, 2023, you are the Data Fiduciary for this information and Refloat is your Data Processor. We process it only on your instructions and to deliver the features you use. We never use it for our own marketing, never use it to build profiles for other businesses, never sell it, and never use it to train AI models.

You are responsible for having a lawful basis, including any consent required, for adding a customer to Refloat and for sending them marketing messages. Refloat does not collect or keep that consent for you.

This information is deleted when you delete your account, and you can ask us to delete an individual customer’s records at any time (see section 11).

We store the text of messages sent and received through your connected WhatsApp number, with their delivery status, so that you can see conversation history, so that the assistant can reply in context, and so that delivery problems can be diagnosed. We keep it while your account is open unless you ask us to delete a customer’s conversation sooner. We do not share message content with other businesses on Refloat.

Every marketing message Refloat sends for you ends with “Reply STOP to unsubscribe”. When a customer replies STOP, or a supported equivalent in English or Hindi, Refloat records the opt-out, confirms it to the customer and permanently excludes that number from your future campaigns. That takes effect immediately and needs no action from you. If a customer asks you to stop in any other way, you must not message them again, and we can record the opt-out for you on request.

If you apply to the creator directory, we collect what you give us: your name, email address, city, social media handles, follower and interaction counts, links to your work, the brands you have worked with, your rates, a profile photo, and a screenshot of your Instagram insights. The screenshot is kept in private storage and seen only by the Refloat team that reviews applications, who check the figures in it by hand.

Once your listing is approved, businesses on Refloat can see your profile photo, description, niches, rates and the follower figures our team verified. Your contact details are shared with a business only after a collaboration with that business is accepted.

If you connect your Instagram account as a creator, we read your profile and account figures to show them on your dashboard. When you submit a post as a deliverable, we download it to check it against the brief, including whether it carries a paid-partnership disclosure.

We use these providers to run Refloat. Each processes data only to provide its service to us, and each has its own privacy policy.

Our database is stored in India. Several providers, including Anthropic, OpenAI, Google and Meta, may process data outside India; where they do, it is only for the purposes described in this policy.

Data is encrypted in transit (TLS) and at rest. Access tokens for connected accounts are additionally encrypted by Refloat before they are stored. Refloat staff reach business data through admin tools that are restricted by role and record the actions taken.

What happens when you delete your account is set out in section 11.

You can delete data in four ways. Step-by-step details are at refloat.in/data-deletion.

Disconnect one account. Disconnect Instagram, Facebook or Google Business Profile from Profile → Connections in Refloat, and WhatsApp from the WhatsApp card on your dashboard. The stored access token is deleted immediately and we stop acting on that account. For Google Business Profile we also ask Google to revoke Refloat’s access and delete the data we read through it, as section 5 describes. For other accounts nothing else is deleted.

Delete your account. Open Settings → Delete account in the Refloat web or mobile app and confirm, or email support@refloat.in from the address on your account. Deleting in the app removes your business’s records from our database immediately; photos, generated images, website files and reports held in file storage are removed within 30 days. Email requests are completed within 30 days and confirmed by reply.

Delete one customer. Email support@refloat.in from the address on your account with the customer’s phone number or name, and we will delete their records within 30 days.

Through Instagram. Remove Refloat from Instagram under Settings → Apps and websites. Instagram notifies us and we delete the stored credentials for that account automatically. If you send a data deletion request through Instagram, we return a confirmation code and a link where you can check the status of that request.

Deletion does not remove reviews we collected from your public Google listing, which we cache against the listing’s public Place ID rather than your account, or records we must keep by law. Reviews read through your Google Business Profile connection are deleted. Copies in encrypted backups are overwritten within 90 days.

We do not use advertising, analytics or tracking cookies. When you sign in, your session is kept in your browser’s storage so that you stay signed in. The in-app assistant keeps the current conversation in your browser’s session storage, which is cleared when you close the tab.

You can ask us to tell you what personal data we hold about you and how it is used, and to correct, update or erase it. You can withdraw a permission at any time by disconnecting the account it applies to, and you can nominate another person to exercise these rights on your behalf. If you are a customer of a business that uses Refloat, you can contact that business or us. Email support@refloat.in; we respond within 30 days.

For any privacy question, complaint or request, contact our Grievance Officer at support@refloat.in. We resolve complaints within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

We may update this policy as Refloat changes. The date at the top shows the latest version, and we will tell registered users about material changes by email or in the app.