Privacy policy
What RepayKit collects, why, who we share it with, and how to delete your data.
The short version
- We collect as little as we can. We never ask for your FSA ID, Social Security number, loan account numbers, date of birth or exact income.
- We never sell your data for money. If you accept advertising cookies, ad networks (Google, Meta and TikTok) learn that someone completed the quiz or bought the kit after clicking an ad. Some state laws call that "selling" or "sharing". You can say no in the cookie banner, and we honour Global Privacy Control.
- Your quiz answers are never sent to analytics or ad tools.
- You can delete your data yourself from your account page, or ask us to.
RepayKit is run by Quixta Ventures LLP, a limited liability partnership registered in India. Contact details are at the bottom of this page.
What we collect
| Where | What we collect |
|---|---|
| Quiz | Your multiple-choice answers (ranges only: loan type, plan, type of job, payment status, household size range, income range, whether you got a letter, your main goal), the situation type it points to, and a random session id. |
| "Email me these steps" form | Your email, your first name if you give it, and whether you ticked the box for tips and rule-update emails (with the exact wording you agreed to and when). |
| Checkout | Your email, the product, the amount, the order status and payment ids. Stripe collects your card and billing details. Card numbers never reach us. Stripe sends us a copy of the payment event, which includes your name, email and billing country. |
| Signing in | Your email and sign-in records, handled by Supabase. |
| DIY Kit | Which steps you ticked, and reminders you set (a short title and a date). Please don't put account numbers in reminder titles. |
| Where you came from | Campaign tags in the link you first arrived on (such as utm_source) and ad click ids (gclid, fbclid, ttclid), kept in a first-party cookie for 30 days and stored with your quiz, lead or order. |
| Spam and abuse checks | Your IP address, used to limit how often a form can be sent (Upstash) and to check you're a person (Cloudflare Turnstile). We don't store IP addresses in our database. |
| Analytics, only after you accept cookies | Event names such as "quiz completed", your situation type, purchase value and pages viewed (PostHog). Session recording and click autocapture are turned off. |
| Emails to us | Whatever you choose to tell us when you write to support. |
How we use it
To show your steps, send the emails you asked for, deliver the kit and the update pass, send reminders you set, tell you about rule changes if you asked, take payments and give refunds, prevent spam and abuse, keep records for tax and accounting, and understand which pages and ads help people.
How often we email you
- Your steps: one email, only if you ask for it.
- If you tick the box: two short tips emails in your first week, then an email only when a rule we track changes. Unsubscribe at any time with the link in any email.
- If you buy: your sign-in link and receipt, reminders you set yourself, and, with the update pass, an email when a rule your kit uses changes.
We never call or text you.
Who we share it with
We don't sell your data for money, and we don't share your quiz answers with anyone except the service providers below, who store it for us.
Service providers (they process data for us under their own terms and data protection agreements):
| Provider | What for | Where |
|---|---|---|
| Vercel | Hosting the website | United States |
| Supabase | Database and sign-in | United States |
| Stripe | Payments and refunds | United States |
| Resend | Sending email | United States |
| Cloudflare (Turnstile) | Checking you're a person on forms | United States and worldwide |
| Upstash | Rate limiting on forms | United States |
| PostHog | Analytics, only after you accept cookies | United States |
Advertising partners, only after you accept cookies: Google (Google Ads), Meta (Meta Pixel) and TikTok (TikTok Pixel). They get the event name (such as "quiz completed") and, for purchases, the order value and order id, plus what their own cookies collect about your visit. They never get your quiz answers, name or email from us. They use this under their own privacy policies.
We may also share information if the law requires it, to protect people from fraud or harm, or with a business that takes over RepayKit (we'll tell you first).
Your privacy choices
These rights apply to everyone, wherever you live in the US:
- Know and access: ask what we hold about you and get a copy.
- Correct: ask us to fix something that is wrong.
- Delete: delete your data yourself from your account page, or ask us.
- Opt out of targeted advertising and "sharing": choose "Reject" in the cookie banner, or use "Cookie settings" in the footer at any time. We also treat a Global Privacy Control signal from your browser as "Reject", with no extra step.
- Portability: get your information in a common, machine-readable format.
- Opt out of profiling: we don't make decisions about you that have legal or similarly significant effects. The quiz only picks which content to show you.
- Unsubscribe from tips and rule-update emails with the link in any email.
To make a request, email support@repaykit.com from the address you used with us. We may ask you to confirm it is you. We answer within 45 days. If we need more time, we tell you why, and we can take up to 45 more days where the law allows.
Appeals. If we say no, we tell you why. You can appeal by replying to our answer, and we respond to an appeal within 60 days. If we still say no, you can contact the attorney general of your state.
Someone acting for you. An authorised agent can make a request for you. We may ask them for your signed permission and ask you to confirm your identity directly with us.
We won't treat you differently, charge you more or give you a worse service for using these rights.
Sensitive information. We don't collect sensitive personal information as state laws define it (such as Social Security numbers, account logins, precise location, or health or biometric data), so we don't use any for other purposes. We don't knowingly sell or share the personal information of anyone under 16.
California categories. In the terms of the California Consumer Privacy Act, in the last 12 months we collected identifiers (email, first name if given, IP address for spam checks), commercial information (purchases), internet activity (pages and events, after consent) and the ranged quiz answers you chose. We disclosed them to the service providers listed above for business purposes and, only if you accepted ad cookies, visit and purchase events to the advertising partners listed above.
Outside the US. RepayKit is meant for people in the United States, and we don't target anyone elsewhere. If you use it from another country, you can still ask us to access, correct or delete your data at the email above, and we will.
What "delete my data" does
Deleting from your account page removes your lead record and email history, your quiz sessions, kit progress and reminders, and closes your account, which ends kit and update pass access. We keep order records for tax and accounting with your email and campaign tags removed. The payment events Stripe sent us (with your name, email and billing country) are kept with our payment records, as below.
How long we keep it
| Data | How long |
|---|---|
| Quiz answers | Until you delete them, or ask us to. They don't include your name or email. |
| Email, first name and consent record | Until you delete them. If you unsubscribe, we keep your email on a "do not email" list so we can honour it. |
| Kit progress and reminders | Until you delete your data or close your account. |
| Orders and payment records | Up to 7 years, for tax and accounting. |
| IP addresses for rate limiting | Up to 2 days, in Upstash. |
| Analytics events | Up to 12 months in PostHog. |
| Backups | Database backups roll off within about 30 days. |
Where your data is
We are based in India. Our service providers store your data in the United States. Our team may access it from India to run RepayKit and answer you. We protect it the same way wherever it is accessed.
Security
Data is stored with access controls, so each person can only see their own records, and our team accesses it only to run the service. No method is perfect, which is one reason we collect so little. If a breach affects your information, we'll tell you as the law requires.
Cookies
See the cookie policy. Analytics and ad cookies load only after you accept them, and never when your browser sends Global Privacy Control.
Children
RepayKit is for adults managing their own or their child's student loans. It is not meant for anyone under 18, and we don't knowingly collect data from children.
Changes to this policy
The date at the top shows the last change. If we change how we use data you already gave us in an important way, we'll email you first if we have your email.
Contact
Quixta Ventures LLP, which runs RepayKit. Email: support@repaykit.com. Address: Bengaluru, Karnataka, India.
Questions about this page?
Email support@repaykit.com. A person reads every message. RepayKit is run by Quixta Ventures LLP, Bengaluru, Karnataka, India.
General information only, not financial, tax, or legal advice. Rules change; always confirm with official sources.