Privacy notice

1. Who is responsible

RepUpdate’s operator is responsible for personal information used to run this service, including account administration, enquiries and support. Contact support@skucard.com for privacy questions and rights requests.

Your employer or business controls personal information it chooses to put in its workspace. Where we process that information solely on its instructions, we act as its processor. Business customers should agree appropriate data-processing terms with us before uploading personal data. Do not upload customer records, sensitive personal information or confidential information that is unnecessary for product cards.

2. Information we handle

• Manager account identifiers, email address and authentication information; business details, brand preferences, plan choice and workspace settings.
• Daily missions, unit targets, manager announcements, published push items, photos, prices and manager-written selling cues. Supplier sheets, specifications, drafts, battlecard content and Field Intel retained from earlier versions may also remain in your workspace.
• Rep-supplied names or initials, claimed products and units, optional what-worked tips, claim dates, manager approval or correction records and recognition derived from approved wins. Approved names, sales and tips are shared with the PIN-accessible team; pending claims are reviewed by the manager before team broadcast. Names are self-reported, not verified rep identities.
• Questions, answers and saved conversation history in the manager copilot, plus workspace and product information used for an audit.
• Enquiry and support contact details and messages you send us.
• Product feedback: report category, message, page name and date, associated with the manager account or the PIN-verified floor workspace. Feedback is read by the RepUpdate operator to diagnose issues and consider improvements; it does not include automatic screenshots, team PINs or camera footage.
• Technical and security information, which may include IP addresses, browser details and error logs handled by our hosting services.
• Company-scoped floor events such as product openings, historical search results, scans and comparisons retained from earlier versions, and pseudonymous device-presence records. Reps do not need individual accounts. These technical events are separate from named win claims and recognition; RepUpdate does not provide location tracking or punitive bottom rankings. Device identifiers are pseudonymous, not necessarily anonymous.

If a manager supplies information about another person, it is obtained from that manager. The business must give that person appropriate privacy information.

3. Why we use it and our lawful bases

We use account and support information to provide the service and respond to requests. Our basis is contract where you are personally party to the agreement, or legitimate interests in administering our business relationship where you act for an employer.

Our legitimate interests also include securing accounts, diagnosing faults, preventing abuse and giving businesses relevant product-use information. We consider the impact on individuals and you can object to processing based on legitimate interests. We use information where necessary to comply with legal obligations, and seek consent where required for optional storage or communications.

Workspace information processed on a business’s instructions is governed by that business’s purposes and lawful basis. RepUpdate does not make automated decisions producing legal or similarly significant effects about individuals. AI suggestions require manager review.

4. AI, service providers and international transfers

RepUpdate uses Lovable Cloud for hosting, authentication and data storage, and Lovable AI Gateway for AI-assisted card writing and the copilot. AI requests can include product inputs, relevant workspace details and conversation history, and are processed by the configured model providers. Do not enter personal or sensitive information into AI prompts.

We also rely on service providers for technical delivery and security. We may disclose information where legally required or necessary to protect the service. We do not sell personal information.

Providers may process information outside the UK. The applicable provider locations, retention and transfer arrangements need to be confirmed for a business’s data-processing agreement. Where a restricted transfer applies, UK GDPR requires an appropriate mechanism, such as adequacy regulations or approved contractual safeguards with the necessary assessment. This notice does not assert UK-only processing or that AI providers never retain or train on inputs.

5. Device storage and offline cards

We use browser storage for sign-in, team access and the installed rep experience. Encrypted offline product snapshots are valid for up to 24 hours and cleared when expired snapshots are read, on rep logout or when access is rejected. A disconnected device may retain access within that window after a PIN change; managers should protect shared devices and rotate compromised PINs.

The rep app may cache its page shell and static files. A browser identifier used for device-presence estimates expires after 90 inactive days; server-side daily presence records are pruned after 60 days. Some legacy favourites/recent-product browser storage may remain until cleared.

Storage/access technologies are subject to UK PECR as well as data-protection law. Any optional, non-exempt use must have appropriate consent before it starts. You can clear site storage in your browser, although this removes offline cards and may require signing in or entering the team PIN again.

6. Retention and security

Workspace content and copilot history are saved so managers can return to them; they do not currently have an automatic deletion schedule. There is no self-service account-deletion control. Contact us to request access, export or deletion, and we will assess the request and applicable legal obligations.

Other retention periods, including hosting logs and backups, depend on the provider and purpose. We do not promise immediate deletion from backups. Offline and device-presence limits above do not describe all server-side retention.

Product feedback is saved for support and improvement tracking and currently has no automatic deletion schedule. Contact us for a deletion request. Dismissing the feedback button affects only the current page visit; refreshing shows it again.

Access controls restrict manager workspaces and PIN-protected published rep products; offline product snapshots are encrypted. No system is risk-free. Keep manager credentials and team PINs private and avoid putting personal information in product notes.

7. Your rights and complaints

Subject to the applicable conditions, you can request access, correction, erasure, restriction and portability of your personal information, and object to processing. Where consent is the basis, you may withdraw it without affecting earlier lawful processing.

Email support@skucard.com. We normally respond within one month; we may need to verify your identity or explain a lawful extension. For information controlled by your employer, contact that business first; we can help it respond.

You can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint. You do not have to contact us first.

8. Updates

We update this notice as the service or processing changes. The date above identifies this version. Material changes affecting account holders will be communicated as appropriate.