Data processing addendum

REVU.ai acts as a processor of customer data and follows the documented instructions defined in your agreement, order form, and this DPA.

• Customer obligations

  You confirm you have authority to share customer data, secure lawful bases for processing, and configure access according to your policies.

• Processor obligations

  REVU.ai processes data only to deliver contracted services, and never sells or uses customer data for unrelated purposes.

• Instruction changes

  Material changes to processing instructions must be agreed in writing to ensure auditability for both parties.

REVU.ai maintains administrative, technical, and physical safeguards.

• Encryption

  Data is encrypted in transit. Credentials for connected integrations, such as OAuth tokens, are also encrypted at rest with AES-256.

• Access controls

  Least-privilege access protects production systems, and activity is logged.

Only vetted vendors with relevant safeguards can handle customer data.

• Approval process

  Each subprocessor undergoes security, privacy, and contractual reviews before they gain access to scoped data.

• Responsibility

  REVU.ai remains responsible for subprocessors' actions and ensures they meet or exceed our contractual obligations.

• Detection

  We log activity on our systems to help identify potential incidents.

• Notification

  If customer data is impacted, we notify administrators without undue delay, sharing relevant facts and remediation steps.

• Cooperation

  We provide logs, forensic context, and support to help you meet regulatory notification obligations.

REVU.ai assists customers in fulfilling data subject requests, including access, correction, deletion, and portability.

• Request handling

  Upon request, we provide tooling or support so you can respond to data subject rights within statutory timelines.

• Deletion

  When you delete data, we remove it from our active systems. Copies in our backups are removed when those backups expire.

• Transfers

  REVU's servers are run by our hosting provider in Germany. Requests to REVU first pass through a network provider that protects and speeds up traffic, which may handle them in other countries. Some features, such as AI analysis and answers, use service providers that may process data in other countries.

• Retention and refresh cadence

  Data retention and refresh schedules follow your selected plan (e.g., Starter 90 days, Growth 1 year, Professional 2 years, Enterprise unlimited). Deleted data is removed from our active systems. Copies in our backups are removed when those backups expire.