Reverse Engineer MarketingPrivacy policy
Last updated: 10 November 2026
This policy explains how Civilytix Pvt. Ltd. ("we", "us") collects, uses, shares and protects personal data when you use the Reverse Engineer Marketing website at reverseengineermarketing.com, its web dashboard and its Chrome extension (together, the "Service"). We act as the data fiduciary (data controller) for the personal data described here. This policy is written to meet India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and, for users in the European Economic Area and the UK, the GDPR.
1. Summary
- We collect only what we need to run your account, your plan and the features you use.
- We do not sell personal data, and we do not use advertising or tracking cookies on our own site.
- The Service analyzes publicly available information about online stores. We do not collect personal data about those stores' shoppers or visitors.
- You can access, correct or delete your data at any time by emailing privacy@reverseengineermarketing.com.
2. What we collect
| Data | Why we need it | Legal basis |
|---|---|---|
| Account data: email address, optional name, and your password (stored only as a salted, peppered hash; we cannot read it) | To create and secure your account, verify your email with a one-time code, and let you reset your password | Contract; your consent at sign-up |
| Billing data: plan, subscription status, renewal dates, and the customer, subscription and payment IDs from our payment partner | To give you the plan you paid for and handle renewals and cancellations | Contract; legal obligations (tax, accounting) |
| Usage data: store and product URLs you analyze, your trackers and their change history, daily usage counts, AI playbooks generated | To provide the features, enforce plan limits and prevent abuse | Contract; legitimate interest in preventing abuse |
| Alert settings: your Telegram chat ID, if you add one | To send tracker alerts you asked for | Consent (you can remove it anytime) |
| Technical data: IP address and request logs, kept briefly by our hosting provider | Security, rate limiting and fixing errors | Legitimate interest in keeping the Service secure |
| Support emails you send to our addresses | To answer you | Your request |
We never see or store your card, UPI or bank details. Payments are handled entirely by Dodo Payments (see section 5).
3. The Chrome extension
When you open the extension's side panel, it reads the address and page content of the tab you are viewing, and fetches that store's public product data (for example its public /products.json feed), to analyze it on your device. It reads a site only after you allow access to that site (or to all sites) in the panel, and you can withdraw that access anytime in Chrome's extension settings. On Facebook and Instagram it adds an "X-ray" button next to ads' outbound links; it looks only at those links, and nothing leaves your browser unless you click the button. It does not read other tabs, your browsing history, form inputs, messages or passwords. If you are logged in and choose to generate an AI playbook, track a store or email a report, the extension sends the store address, a summary of the analysis and, for trackers, that store's public product list to our servers. Your login token is stored in the extension's local storage on your device.
4. Cookies and local storage
We use one essential cookie, rem_token, to keep you logged in. It is HttpOnly, secure and expires after 30 days or when you log out. We do not use analytics, advertising or third-party tracking cookies. Our payment partner's checkout pages may set their own cookies; see their privacy policy.
5. Who we share data with
We share personal data only with service providers that help us run the Service, under contracts that limit their use of it:
| Provider | What they do | Data involved |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, security and content delivery | All data stored by the Service; IP addresses |
| Dodo Payments | Merchant of record: checkout, payments, tax, invoices, subscription management | Name, email, billing address, payment details you enter at checkout |
| Resend | Sending verification codes, password reset codes, report emails and alerts; receiving email sent to our addresses | Your email address and the email content |
| Anthropic | Generating AI playbooks | A summary of a store's public data only; no personal data about you |
| Telegram | Delivering alerts, only if you add a chat ID | Your chat ID and the alert text |
We may also disclose data if required by law, a court order or a lawful request by government authorities, or to protect our rights, users or the public. If our business is sold or merged, data may transfer to the new owner under this policy.
6. International transfers
Our providers may process data outside India, including in the United States, the EU and Japan. Where the DPDP Act or GDPR requires it, we rely on appropriate safeguards such as standard contractual clauses.
7. How long we keep data
- Account and usage data: while your account is active, and deleted within 30 days after you ask us to close it.
- Tracker change history: 90 days.
- Email verification and reset codes: until used, or at most 15 minutes.
- Daily usage counters: about 1 day.
- Billing records: as long as tax and accounting law requires (in India, generally 8 years); these are mainly held by Dodo Payments as merchant of record.
8. Security
Data is encrypted in transit (HTTPS). Passwords are hashed with a per-user salt and a secret pepper. Verification codes are stored only as hashes, expire quickly and are locked after repeated wrong attempts. Access to production systems is limited to us. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as the law requires.
9. Your rights
Depending on where you live, you can ask us to:
- tell you what personal data we hold about you and get a copy of it;
- correct or update it;
- delete it and close your account;
- withdraw consent (for example, remove your Telegram chat ID), without affecting earlier processing;
- object to or restrict certain processing, or receive your data in a portable format (GDPR);
- nominate another person to exercise your rights if you die or become incapacitated (DPDP Act).
Email privacy@reverseengineermarketing.com from your account email. We reply within 30 days. You can also complain to the Data Protection Board of India or, in the EEA/UK, your local data protection authority.
10. Children
The Service is for businesses and is not meant for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
11. Changes
We may update this policy. If a change is significant, we will email account holders or show a notice in the dashboard before it takes effect. The date at the top shows the latest version.
12. Contact and grievance officer
Civilytix Pvt. Ltd.
Grievance officer: Harshit Sharma
Email: privacy@reverseengineermarketing.com
General support: support@reverseengineermarketing.com
We acknowledge grievances within 48 hours and aim to resolve them within 30 days.