Reputiq — Privacy Policy

Last updated: 16 September 2026

This Privacy Policy explains how Reputiq Solution (Pty) Ltd (“Reputiq”, “we”, “us”, “our”) collects, uses, stores, and protects personal information in connection with the Reputiq platform (reputiq.co.za). It should be read alongside our Terms and Conditions.

This policy applies to Customers (property owners, General Managers, Division Managers, and other platform users), Outlet Managers who receive action plan forms without holding an account, and, indirectly, guests whose reviews feed into the platform.

1. Who We Are

Reputiq Solution (Pty) Ltd operates Reputiq, a hospitality operations accountability platform used by hotels, wine farms, and restaurants to turn guest feedback and operational issues into tracked action plans.

Information Officer: Tashleen Prince is Reputiq's Information Officer, responsible for ensuring compliance with the Protection of Personal Information Act (POPIA) and for handling data protection queries, access requests, and complaints.

Contact for privacy matters: info@reputiq.co.za
General support: info@reputiq.co.za

2. Information We Collect

Account and Customer information: Name, email address, phone number, role (e.g. General Manager, Division Manager), and property/outlet/division setup information provided when you register and use Reputiq.

Billing information: Billing is handled by Paystack. Reputiq does not directly store full payment card details — these are processed and stored by Paystack under its own security and privacy terms. We retain records of subscription status, billing history, and transaction references necessary to manage your account.

Guest review data: Reviews are retrieved from connected platforms (Google, Facebook, DinePlan, Lekkeslaap) under your authorisation. Reputiq does not permanently store the original full text of guest reviews. Instead, AI processes each review to generate a summary, sentiment classification, division/outlet classification, and, where relevant, extracted staff name mentions. It is this derived information — not the original review text — that is retained.

Action plan data: Content of action plans you create (manually or AI-assisted), assigned recipients, delivery method (email or WhatsApp), activity logs, and responses submitted by Outlet Managers.

Staff-related information: Names and contact details of staff (e.g. Outlet Managers) you provide for the purpose of delivering action plans; response and completion records; where applicable, staff recognition content and response-time data.

Usage data: Information about how you use Reputiq — pages visited, features used, login activity, and device/browser information collected automatically for security and product improvement purposes.

Communications: Records of support requests or correspondence with us.

3. How We Use Personal Information

We use personal information to:

  • Provide and operate the Reputiq platform, including generating AI summaries, classifications, and action plans
  • Deliver action plan forms to Outlet Managers via email or WhatsApp on your instruction
  • Process subscription billing via Paystack, including trial-to-paid conversion and renewal
  • Send account-related communications (billing notices, price change notices, service updates)
  • Maintain security, detect misuse, and enforce our Terms and Conditions
  • Improve the platform, including monitoring AI output quality and system performance
  • Comply with legal obligations

We do not sell personal information to third parties, and we do not use guest or staff personal information for advertising purposes.

4. Legal Basis for Processing

Where POPIA applies, we process personal information on the following bases: performance of our contract with you (providing the platform you've subscribed to), your consent (e.g. where you authorise connection of a review platform), our legitimate interests (e.g. platform security, service improvement), and compliance with legal obligations (e.g. financial record-keeping).

Where you provide personal information about your own staff or guests to Reputiq, you are responsible for ensuring you have a lawful basis to share that information with us for the purposes described in this policy.

5. Third-Party Processors

Reputiq relies on the following third-party services to operate the platform. Each processes personal information on our instruction, for the specific purposes below:

  • Supabase — database, authentication, and file storage
  • Vercel — application hosting
  • Groq, Google Gemini, and Cloudflare AI — AI processing of review content, generation of summaries, classifications, and action plan drafts
  • Paystack — payment processing and billing
  • Resend — transactional email delivery (e.g. action plan forms, notifications, reports)
  • Meta (WhatsApp Business API) — delivery of action plan alerts and links via WhatsApp, where enabled
  • Google Places API and Facebook Graph API — retrieval of publicly available or authorised review data from these platforms

We only share the personal information necessary for each provider to perform its function and require these providers to handle information securely.

6. International Data Transfers

Reputiq's database and file storage (via Supabase) are currently hosted in the EU-West region. This is the hosting region available on Supabase's free tier at Reputiq's current stage of operation. We intend to migrate hosting to a South African region (Supabase's af-south-1) once Reputiq moves to a paid Supabase plan, which we expect to coincide with onboarding paying customers at scale.

Until that migration takes place, personal information processed through Reputiq — including guest review summaries, staff names and contact details, and account information — is stored and processed outside South Africa, in the European Union. Some of our third-party providers (including our AI providers) may also process information outside South Africa in the course of providing their services. We take reasonable steps to ensure these providers maintain an appropriate standard of data protection. We will update this policy and notify customers when the migration to South African hosting is complete.

7. Data Retention

Personal information is retained for as long as your account remains active. Following account closure, we retain information for a reasonable period to comply with legal, accounting, tax, or dispute-resolution obligations, after which it is deleted or anonymised. Original guest review text is never retained regardless of account status, as described in Section 2.

8. Security

We take reasonable technical and organisational measures to protect personal information against loss, unauthorised access, alteration, or disclosure, including role-based access controls within the platform, encrypted data transmission, and reliance on providers (Supabase, Vercel, Paystack) that maintain their own security standards. No system is completely secure, and we cannot guarantee absolute security of information transmitted to or stored by Reputiq.

9. Your Rights

Subject to applicable law, you have the right to:

  • Request access to the personal information we hold about you
  • Request correction of inaccurate or incomplete personal information
  • Request deletion of personal information, subject to our legal and legitimate retention needs
  • Object to certain processing, or withdraw consent where processing is based on consent
  • Lodge a complaint with South Africa's Information Regulator if you believe your personal information has been processed unlawfully

To exercise any of these rights, contact info@reputiq.co.za. Where you are a guest or staff member whose information was provided to Reputiq by a Customer (e.g. a hotel or wine farm using the platform), you may also direct your request to that Customer directly, as they are the Responsible Party for that information.

The Information Regulator of South Africa can be contacted at enquiries@inforegulator.org.za if you wish to lodge a complaint independently of Reputiq.

10. Cookies and Similar Technologies

Reputiq uses essential cookies and similar technologies required for authentication and core platform functionality (e.g. keeping you logged in, maintaining session security). We do not currently use third-party advertising or tracking cookies.

11. Children's Information

Reputiq is a business-to-business operational platform and is not directed at or intended for use by children. We do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to Reputiq, our data practices, our service providers, or legal requirements — including when our hosting region changes as described in Section 6. Material changes will be communicated by email or in-platform notice at least 30 days before taking effect. Continued use of Reputiq after that date constitutes acceptance of the updated policy.

13. Contact

Privacy and data protection queries, including requests to access, correct, or delete personal information, should be directed to our Information Officer:

Tashleen Prince
Email: info@reputiq.co.za

General support queries: info@reputiq.co.za