Privacy policy

1. Who we are

Revexa provides Leo, an AI driven service that, on behalf of our customers, finds buy-ready B2B companies and reaches the right decision maker through personal messages and email.

Contact: hey@revexa.io

2. What data we collect

About you as a visitor (the waitlist)

• First name (optional) and the email address you provide

About you when you use a free tool

• The email address you give to see your result
• What you enter: a website, a competitor's website or a link to a social media post
• Your result, and the steps Leo took to build it
• A random device identifier and a one way hash of your IP address, never the IP address itself, so that each tool can be run once per person

The post tool reads the public headlines and comments of the people who engaged with the post you enter, only to count how many have a role that buys from you. Their names are never stored, shown or sent onwards, and the result only holds numbers. The competitor tool names companies, never the people behind a like or a comment.

About you as a customer (the company buying the service)

• Name, email address and company information
• Billing and payment information
• Communication with Revexa (email, meetings)

About leads that are contacted

• Name, title, employer, city, public professional profile, email address and company details
• Where the data comes from: partly from you as the customer (your CRM or your own lists), partly from public sources that Leo reads through data providers: public social media posts and reactions to them, job ads, the companies' own websites and public company records. Leo never reads anything that requires the contacted person's login.
• Emails, messages and reply status
• Outcomes (meeting booked, not interested, come back later, etc.)

3. Legal basis

• The waitlist: consent (Art. 6.1a)
• Customer data: contractual necessity (Art. 6.1b)
• Lead data, outgoing emails and messages: legitimate interest (Art. 6.1f)
• Billing data: legal obligation (Art. 6.1c)
• Free tools: we deliver the result you asked for (Art. 6.1b). For a work email address we also send occasional tips from Leo on the basis of legitimate interest (Art. 6.1f), but only after you open the link in the result email, so we know the address is yours. A private email address only gets tips if you tick the box (consent, Art. 6.1a), and a German address only after you confirm it by email.

Outgoing B2B emails and messages to leads rely on legitimate interest (GDPR Art. 6.1f), the same legal basis as traditional B2B sales outreach.

4. How the data is used

• To deliver the Leo service
• To send your booking link to contacts who want to book a meeting
• To provide email history and reports
• To improve Leo's quality (anonymized data only)
• For billing and customer communication
• The waitlist: to contact you when we open the next round
• Free tools: to show and email you your result, to stop the same tool from being run again and again, and to send occasional tips as described above. Every email that mentions the tips has an unsubscribe link. The result email and the confirmation email for German addresses are service emails: we send them because you asked for the result or for the tips

5. Calendar and email tools

Calendar

Leo has no access to your calendar, and Revexa stores no calendar data. If you have given a booking link, Leo sends it when a contact wants to book a meeting, and the contact picks a time through your booking service.

Email tools

Waitlist email addresses are handled in our email tool with storage inside the EU/EEA under applicable data processing agreements.

6. The customer's responsibility as data controller

Your organization is the data controller for the lead list you provide. You are responsible for ensuring your contacts may be contacted under applicable law.

Revexa acts as a data processor and processes data strictly according to your instructions. A data processing agreement (DPA) is signed with every customer.

7. How the data is protected

• Personal data is stored encrypted in the EU (database and application hosting in the EU)
• Backups are only stored encrypted, with a provider in the US, and the key that unlocks them is held only by Revexa
• Access is limited to authorized personnel
• Data processing agreements are signed with all subprocessors

8. Sub-processors and international transfers

We never sell or share data with third parties for their marketing.

To deliver the service we engage sub-processors (data processors). Our database and application hosting are in the EU. However, some sub-processors process personal data outside the EEA, primarily in the US. Such transfers only take place under a valid transfer mechanism under Chapter V of the GDPR: the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework or an adequacy decision.

The sub-processors are described below as categories of recipients, which is the level Articles 13(1)(e) and 14(1)(e) of the GDPR require. A named and dated list of all data processors, with the place of processing and the transfer mechanism for each, is provided on request and forms an annex to the data processing agreement.

• Application hosting and data storage: hosting and database. Processing within the EU. Backups are created and stored outside the EEA (US), and they are only stored encrypted.
• Language models and decision models: drafting messages and assessing signals and companies. Processing mainly outside the EEA.
• Data sources and data enrichment: information about people and companies from public sources, contact details and their verification, accessed through a combined provider gateway. Processing mainly outside the EEA.
• Communication channels: access to the accounts you have connected, email delivery and, where relevant, messaging services. Processing inside and outside the EEA.
• Payment processing: handling of subscription and payment. Processing outside the EEA.
• Integrations you enable yourself: the CRM you choose to connect. The place of processing follows the provider you have chosen.

For the free tools we also engage providers of publicly available data from the web and social media, and a service that stops automated abuse of the tools. Outside the EEA this only happens with SCCs.

All data processors are bound by data processing agreements with instructions, confidentiality and a requirement of equivalent terms for any further sub-processors. For the language model and data enrichment categories, processing takes place mainly outside the EEA. We therefore make no general claim that the data stays within the EU; the transfer mechanism is instead stated per processor in the list referred to above.

9. How long we keep the data

• The waitlist: until you unsubscribe or request deletion
• Customer data: for the contract period plus 12 months
• Lead data (email correspondence): for the campaign period plus 90 days
• Billing data: 7 years (Swedish accounting law)
• Free tool results: 90 days. Your email address: until you unsubscribe or ask us to delete it. When you unsubscribe, we delete the address and keep only a one way hash of it on a suppression list, so we never email it again

You can request deletion of your data at any time.

10. Your rights

Under the GDPR you have the right to:

• Request access to your personal data
• Request correction of inaccurate data
• Request deletion ("the right to be forgotten")
• Object to processing based on legitimate interest
• Request data portability
• Lodge a complaint with a supervisory authority. In Sweden this is the Swedish Authority for Privacy Protection (IMY)

Contact us: hey@revexa.io

11. Cookies

The site uses a minimum of first-party cookies, no advertising or third-party cookies:

• NEXT_LOCALE: stores your language choice (Swedish or English). 12 months.
• Session cookie: keeps you logged in to the customer platform. 24 hours, necessary.
• rv_src: stores which channel you first arrived from. 90 days, never shared with third parties.
• rv_ft: a random device identifier for the free tools, so that each tool can be run once and your result is still there if you reload the page. 12 months, necessary.

Visitor statistics are cookieless.

12. Contact and complaints

Revexa · Email: hey@revexa.io

Supervisory authority: the Swedish Authority for Privacy Protection (IMY): imy.se