Privacy Policy

1. Scope

This policy explains how Repito Edutech Ltd. handles personal information when you use repito.in, create an account, use paid tools or contact support.

2. Information handled

Repito handles the information needed to operate the service, including:

• Your email address, email-verification status, account status and account role.
• Hashed verification-code records, their purpose, creation and expiry times, attempt counts, use status, and the client IP address associated with an OTP request.
• Hashed session tokens, the associated user, and session creation and expiry times.
• Payment-report information including your email, expected amount, UPI transaction or reference number, report and verification status, relevant timestamps, administrator review information, and counselling entitlement status.
• Saved shortlist identities and snapshots, historical year, AIR when saved, saved assessment, timestamps, source availability and optional personal notes.
• Support correspondence you send to the published contact address.
• Technical request, timing, error and security information recorded by the application, proxy, containers or hosting services. Application email-event logs mask email addresses.

Repito does not collect payment screenshots through the current application. Ordinary predictor and search criteria that you do not save are not written by the application to its database or browser storage, although requests may be processed transiently and may be represented in technical logs.

3. Purposes

Information is used to authenticate users, provide requested tools, preserve shortlists, verify payments, manage access, respond to support, protect the service and meet applicable legal obligations.

Agreement to the Terms of Use and Privacy Policy during registration does not authorize unrelated promotional messages.

4. Authentication cookies and browser storage

Repito uses an essential mcc_session cookie after successful verification. The cookie is HTTP-only and uses the SameSite=Lax setting. Production configuration marks it Secure so it is sent over HTTPS. The server stores a hash of the session token rather than the raw token.

The current application code does not use localStorage or sessionStorage. It does not configure analytics or advertising cookies. Blocking the necessary session cookie can prevent sign-in and paid features from working.

5. Payments

UPI payments are processed through your chosen payment app and payment providers under their own policies. Repito handles the transaction or reference number, expected amount, verification status and entitlement information needed to review a reported payment and manage access.

Repito does not request or store UPI PINs or banking passwords through the current application.

6. Service providers and disclosures

Hosting, infrastructure and email providers may process information needed to deliver the service. OTP and service email delivery currently uses Google Gmail SMTP, so recipient email addresses and message contents pass through that service.

Information may also be disclosed where required by law or reasonably necessary to address fraud or security incidents. External providers follow their own terms and privacy practices.

7. Retention

Information is retained for the purposes described above and applicable legal, accounting, security and dispute-handling needs. Account and payment records, shortlists, logs and backups can have different retention requirements.

Removing a shortlist item does not necessarily remove existing backup copies immediately. Repito does not currently publish a fixed retention or deletion schedule.

8. Requests and choices

Contact repito.admin@gmail.com to request access, correction or deletion of personal information, withdraw relevant consent or raise a privacy concern. Identity verification may be needed before acting on a request.

Withdrawal may prevent provision of features requiring that information. Some records may need to be retained where legally required. The current application does not provide a self-service account-deletion feature.

9. Security

Verified measures include HTTPS in production, HTTP-only and Secure production session cookies, hashed OTP and session-token records, authenticated paid access, administrator authorization for payment review, and ownership checks that restrict shortlist operations to the signed-in user.

No online service can guarantee absolute security.

10. Children and third-party information

Repito is intended for adult NEET-PG applicants. If information about a child was submitted, contact support. Users should avoid entering another person’s sensitive information in notes or support messages.

11. External links and policy changes

Official portals and other external websites follow their own policies. Updates to this policy will carry a revised last-updated date. Material changes will be communicated where appropriate.

12. Contact

Privacy requests and concerns: repito.admin@gmail.com.