Repuso API - GDPR & Data Processing

Last updated 2026-08-11. Explains how the Repuso API handles personal data under the EU/UK GDPR. Read alongside the API Privacy Policy and API Terms. For the consumer product see the main Repuso GDPR notice.

Who we are

The Repuso API is operated by OnClick Solutions Ltd ("Repuso", "we"). For any data-protection request, email hello@repuso.com or use our support page. If you require a signed Data Processing Addendum (DPA), request one at the same address.

Controller and processor roles

Which role we play depends on the data:

Data	Your role	Our role
Review profiles you choose to monitor, and the reviews/ratings returned for them	Controller - you decide which public profiles to collect	Processor - we collect and normalize on your documented instructions (your API calls)
Your account: sign-in email, API keys, plan, billing, usage metering	Data subject / customer	Controller
Security, abuse-prevention and service telemetry	-	Controller (legitimate interest)

In short: for the review data you pull through the API, you are the controller and Repuso is your processor. Make sure you have a lawful basis for monitoring the profiles you select and for any onward use in your own product.

What we process

Account data - the email you sign in with (one-time code, no stored password), API keys (stored hashed and encrypted at rest), plan and billing state.
Configuration - the profiles, groups, tags and webhook endpoints you create.
Public review data - reviews, ratings, author display name and profile metadata that are publicly available on the source platforms for the profiles you monitor. This can include personal data authored by reviewers.
Usage metadata - per-request records (timestamp, endpoint, method, status, count) for rate limiting, quotas and billing. We do not retain request payloads or response bodies beyond a short-lived recent-requests buffer shown in your own console.

Legal bases

Contract (Art. 6(1)(b)) - to provide the API, console, webhooks and billing you signed up for.
Legitimate interests (Art. 6(1)(f)) - to secure the service, prevent abuse and meter usage. As controller for the review profiles, your own processing relies on the basis you determine.
Consent (Art. 6(1)(a)) - only for optional communications; withdraw at any time.

Data-subject rights and how we assist

For your account data (where we are controller) you can access, export, correct, restrict or delete it - email us and we respond within one month.

For review data (where you are controller), a reviewer's request usually reaches you. As your processor we assist: you can delete any monitored profile through the API, which removes its collected reviews; or ask us to remove specific records. Deleting a profile via DELETE /v1/channels/{id} purges its stored reviews on our side.

International transfers

We may process data on infrastructure outside your country. Where personal data is transferred out of the EEA/UK, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) with the relevant sub-processors. Our DPA incorporates the SCCs by reference.

Sub-processors

We use a limited set of third parties strictly to run the service. Review data is retrieved from the public source platforms you select.

Sub-processor	Purpose
Cloud hosting & crawling infrastructure	Run the API, database and crawlers
Stripe	Payments and billing
Transactional email provider	Login codes, quota and billing notices

We will give notice of material changes to this list so you can object before a new sub-processor begins processing.

Retention

Collected reviews and configuration persist while a profile is monitored; removing the profile deletes its collected reviews unless you ask us to keep them.
Usage aggregates are retained for billing and abuse-prevention; the recent-requests buffer expires within days.
Closing your account removes your configuration and collected data on our standard schedule, subject to legal retention obligations (e.g. tax records).

Security

API traffic is TLS-encrypted. API keys are stored hashed and encrypted at rest and are never shown again after creation - keep them confidential, never embed them in client-side code or public repositories, and rotate immediately if exposed. Access to production data is restricted and logged. We may suspend or rotate keys showing signs of compromise. To report a security or data-protection concern, email hello@repuso.com.

Data Processing Addendum

If you process personal data of individuals in the EU/UK through the API, you can request our Data Processing Addendum, which sets out our processor obligations under Art. 28 GDPR and includes the SCCs for international transfers. Email hello@repuso.com to receive and countersign it.

Changes

We will update this page and the "last updated" date when this notice changes materially.

← Repuso for developers · Privacy · API Terms · Support