Compliance
Revisit runs on the laws of Bangladesh and the standards global software is held to. Here is every rule we follow, how we meet it, and where each one stands today.
Last reviewed 27 October 2026
Bangladesh
The Bangladeshi laws and rules that apply to a loyalty platform, and how we meet each one.
Personal data protection
Customers join only by their own choice, from a QR code or a link. Our Privacy Policy sets out what we collect and why, and shops can export or erase a customer's data on request.
In placeCyber security law
The merchant dashboard is behind sign-in, and every team seat has a role that limits what it can see and do. Customer data is encrypted at rest.
In placeVAT and Supplementary Duty Act 2012
Plan prices include VAT, and every payment comes with a VAT invoice.
In placeConsumer Rights Protection Act 2009
Published terms, cancel anytime from the dashboard, and a full refund of the first payment when asked within 7 days of paying, once per business.
In placeBTRC telecom and SMS rules
Revisit reaches customers through wallet notifications from Apple and Google, never by SMS, so promotional SMS rules do not apply.
Not applicableBangladesh Bank payment rules
Payments are taken by SSLCOMMERZ, a licensed payment gateway. Revisit never handles the money or the card itself.
DelegatedConsent for offers
Only the customer can add a card to their wallet. Our terms require shops to have consent before sending offers, and customers can remove the card or mute it at any time.
In placeApple Wallet and Google Wallet policies
Cards are issued from Revisit's verified Apple Developer account and approved Google Wallet issuer account, under both platforms' pass policies. Shops need no developer account of their own.
In placeInternational standards
Certification is a formal audit. Where we hold one, it says so. Where we follow the standard ahead of the audit, it says that too.
Keeping payment card data safe.
Card data stays with SSLCOMMERZ, a licensed gateway.
A managed system for information security.
Formal certification is on our roadmap.
Whether security controls are designed well, at one point in time.
Formal certification is on our roadmap.
Whether those controls keep working, observed over months of operation.
Formal certification is on our roadmap.
How personal data of people in Europe is collected and used.
Formal certification is on our roadmap.
Under the hood
The practices behind every row on this page.
Customer names, phone numbers and join IP addresses are encrypted one field at a time before they reach the database.
Every request is refused unless the person's role allows it. Owners, managers, marketing, branch managers and staff each see only their part.
Each shop sees only its own customers and visits. No merchant can ever see another merchant's list.
Sign-ins, invites, role changes and password changes are written to an append-only log.
All traffic is encrypted with TLS. Passwords are never stored, only a strong one-way hash.
Payment results are accepted only with the gateway's signature, so nobody can fake a paid invoice.
Shops export their customer list at any time and erase a customer on request. A deleted business is purged after 14 days.
Enterprise customers can run on a dedicated deployment, with their customer data stored apart from everyone else's.
Revisit's internal console needs an approved company email and a second sign-in factor. Read-only support access to a shop is written to the audit trail.
Your data
How long each kind of data stays, and what happens when it goes. The Privacy Policy has the full detail.
We use first-party cookies to keep merchants signed in and to reopen a customer's card from the shop's QR code. This website uses the Meta Pixel to measure our own ads; it never receives anything about the customers on a shop's cards.
Read the Privacy PolicySubprocessors
The outside services Revisit relies on to run. Each one gets only the data its job needs.
| Provider | What it does for us | Region |
|---|---|---|
| Railway | Hosting for the app, the API and the database | Singapore |
| Apple | Apple Wallet card issuing and updates | Global |
| Google Wallet card issuing and updates | Global | |
| Nyntax Pay and SSLCOMMERZ | Payment processing for plans (bKash, Nagad and cards) | Bangladesh |
| Resend | Account and billing email | United States |
| Sentry | Error monitoring | United States |
| Meta | Measuring our own ads on this website | Global |
| Cal.com | Demo booking on this website | United States / EU |
Regions show where each provider mainly processes data; some deliver through global networks.
Intellectual property
Revisit's wallet loyalty platform is the subject of a pending United States patent application. Its software, card system, designs, interface and brand are also protected by copyright and trademark law.
Copying, reverse engineering, scraping or reproducing any part of the platform, in whole or in part, is forbidden by our Terms of Service. Infringement may lead to civil claims and, where the law provides, criminal penalties in Bangladesh, the United States and other countries. Read the Terms of Service
Seen something that looks like a copy? Tell us at hello@revisit.cards.
Found a weakness in Revisit? Tell us before anyone else, and give us a fair chance to fix it before you share it. Please do not access, change or delete data that is not yours, and do not disrupt the service while you look.
hello@revisit.cardsFilling in a security questionnaire, or need something for your auditor? Write to hello@revisit.cards and a person on our team will answer.
hello@revisit.cards