Privacy Policy

Last updated: December 1, 2026

At RecCenterOS, your privacy matters. This Privacy Policy explains what data we collect, how we use it, and your rights. By using our Service, you agree to this Policy.

1. Who We Are

RecCenterOS("we," "our," "us") operates the RecCenterOS platform from Kathmandu, Nepal. We are the data controller for the personal information you provide.

2. Information We Collect

2.1 Information You Provide

When you use RecCenterOS, you may provide us:

  • Account information — name, email, phone, password, company name
  • Profile information — photo, address, date of birth
  • Payment information — bank account details, transaction IDs (we do NOT store full card numbers)
  • Business data — facility info, member records, bookings, schedules
  • Communications — emails, support messages, demo requests

2.2 Information Collected Automatically

  • Usage data — pages visited, features used, time spent
  • Device info — browser, IP address, device type, OS
  • Cookies — see our Cookie Policy for details
  • Log data — error reports, security events

2.3 Information from Third Parties

We may receive data from:

  • Payment processors (Khalti, eSewa) — transaction confirmations
  • OAuth providers (Google) — if you sign in with Google
  • Email service (Resend) — delivery status of our emails

3. How We Use Your Information

We use your data to:

  • Provide, maintain, and improve the Service
  • Process payments and send invoices
  • Send service-related emails (account, billing, security)
  • Respond to support requests
  • Send marketing communications (you can opt out anytime)
  • Detect fraud, abuse, and security threats
  • Comply with legal obligations under Nepali law
  • Analyze usage to improve features and performance

4. Legal Basis for Processing

We process your data based on:

  • Contract — to deliver the Service you signed up for
  • Legitimate interest — to improve our products and prevent fraud
  • Consent — for marketing emails and non-essential cookies
  • Legal obligation — to comply with tax and regulatory requirements

5. Sharing Your Information

We do NOT sell your personal data. We share data only with:

  • Service providers we depend on:
    • MongoDB Atlas — database hosting
    • Cloudinary — image and file storage
    • Resend — transactional email delivery
    • Render / Vercel — application hosting
    • Khalti, eSewa — payment processing
  • Legal authorities — when required by law (court order, subpoena, government request)
  • Business transfers — in case of merger, acquisition, or sale (you will be notified)
  • With your consent — for any other sharing not listed

6. Data Retention

  • Active accounts — data kept as long as your account is active
  • Cancelled accounts — exportable for 30 days, then deleted
  • Backups — retained for 90 days for disaster recovery
  • Financial records — retained 5 years per Nepal tax law
  • Logs — retained 90 days for security analysis

7. Your Rights

You have the right to:

  • Access — request a copy of your data
  • Correct — update inaccurate information
  • Delete — request deletion of your data
  • Export — receive your data in CSV/JSON format
  • Object — to certain types of processing
  • Withdraw consent — for marketing emails or cookies
  • Complain — to relevant data protection authorities

To exercise these rights, email hello@reccenteros.com. We will respond within 30 days.

8. Data Security

We protect your data through:

  • HTTPS encryption for all data in transit
  • Encrypted storage of passwords (bcrypt) and sensitive fields
  • Regular security audits and updates
  • Access controls and role-based permissions
  • Automated backups and disaster recovery
  • Rate limiting and intrusion detection

Despite our best efforts, no system is 100% secure. We will notify you within 72 hours of any data breach affecting your information.

9. International Data Transfers

Your data may be processed in countries outside Nepal where our service providers operate (e.g., USA, EU). We ensure these transfers comply with applicable data protection laws and use providers with industry-standard security.

10. Children's Privacy

RecCenterOS is not intended for users under 18. We do not knowingly collect data from children. If you believe a child has provided us data, contact us for immediate removal.

11. Cookies & Tracking

We use cookies and similar technologies. See our Cookie Policy for details on what we use and how to control them.

12. Third-Party Links

Our platform may contain links to third-party websites. We are not responsible for their privacy practices. Review their policies before providing any data.

13. Changes to This Policy

We may update this Privacy Policy. Material changes will be notified via email or in-app at least 30 days before taking effect. The "Last updated" date at the top reflects the most recent version.

14. Contact Us

For privacy-related questions or to exercise your rights:

Questions? Email us at hello@reccenteros.com