Privacy Policy

Last updated: 3 October 2026

At RevoplyAI, protecting your privacy and safeguarding your data are among our highest priorities. This Privacy Policy explains how we collect, use, store, and protect information when you use our website, the RevoplyAI web dashboard, and the RevoplyAI apps for iOS and Android.

By accessing or using RevoplyAI, you agree to the practices described in this Privacy Policy.

1. About RevoplyAI

RevoplyAI is a Software-as-a-Service (SaaS) platform powered by artificial intelligence, designed to help businesses manage and automate customer conversations across multiple communication channels using their own knowledge base.

RevoplyAI is run as a sole proprietorship (Einzelunternehmen) under German law. Full legal details are in our Imprint.

For the personal data of our own users (for example your account, your team's accounts and billing), RevoplyAI is the data controller. For the conversations and customer data that your business processes through RevoplyAI, your business is the controller, and RevoplyAI processes that data on your business's behalf as a processor.

2. Information We Collect

We may collect and process different types of information, including but not limited to:

• Account information (such as name, email address, phone number)
• Company information (company name, industry, connected channels)
• Conversation content processed through the platform
• Technical data (IP address, browser type, device information)
• Usage data and logs (performance metrics, message counts, token usage)
• Billing and payment records (processed by Stripe; we do not store card numbers)
• Mobile app data, such as your push notification token and crash reports (see section 10)

We collect only the data necessary to operate, maintain, and improve our services.

3. How We Use Your Information

The information we collect may be used for the following purposes:

• Providing and operating the RevoplyAI platform
• Training and improving AI responses based solely on the data you authorize
• Account management and customer support
• Monitoring performance and enhancing user experience
• Ensuring security and preventing misuse
• Sending the notifications you turn on (escalations, qualified leads, assignments, bookings)
• Diagnosing crashes and errors in the apps and the platform
• Sending account owners information about our plans, where they have agreed to receive marketing emails
• Complying with legal and regulatory obligations

4. Legal Basis for Processing (GDPR and PDPL)

RevoplyAI processes personal data under one or more of the following legal bases:

• Performance of a contract with you
• Your explicit consent
• Our legitimate business interests in operating and improving the platform
• Compliance with applicable legal obligations

Where the Saudi Personal Data Protection Law (PDPL) applies, we rely on the corresponding grounds it provides. Section 10 gives the legal basis for each kind of mobile app data.

We retain personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy. Section 11 explains what happens to your data when you delete your account.

5. Your Data Protection Rights

Depending on the law that applies to you, for example the GDPR in the EU/EEA or the PDPL in Saudi Arabia, you have the right to:

• Access your personal data
• Request correction or updates to your data
• Request deletion of your data
• Object to data processing
• Request restriction of processing
• Request data portability
• Withdraw consent at any time
• Lodge a complaint with a data protection supervisory authority

To exercise any of these rights, please contact us using the details provided below. To delete your account, see section 11.

6. Log Files

RevoplyAI uses log files as part of standard operational and analytical processes. These logs may include:

• Internet Protocol (IP) addresses
• Browser type and version
• Internet Service Provider (ISP)
• Date and time stamps
• Referring and exit pages

This information is used for system administration, analytics, and security purposes and is not directly linked to personally identifiable information.

7. Cookies and Tracking Technologies

We may use cookies and similar technologies to:

• Remember user preferences
• Improve platform performance
• Analyze usage patterns

In the web dashboard we use PostHog, hosted in the EU, for product analytics and session recordings. Form inputs are masked in recordings, IP addresses are anonymised, and recordings are deleted after 30 days. PostHog does not run in the iOS and Android apps.

You may choose to disable cookies through your browser settings. However, doing so may affect certain functionalities of the platform.

8. Service Providers and Recipients

We share personal data only with providers that help us run RevoplyAI and with the services you choose to connect. The main ones are:

• Servers: our servers are hosted in Germany (Strato).
• Google Firebase: sign-in (Firebase Authentication, including Google sign-in), conversation storage (Cloud Firestore), file storage (Cloud Storage for Firebase), push notifications (Firebase Cloud Messaging) and crash reports (Firebase Crashlytics).
• Apple: push notifications on iPhone (Apple Push Notification service) and Sign in with Apple.
• PostHog (EU hosting): product analytics and session recordings.
• Stripe: payments and invoices.
• Brevo: sending emails.
• Cloudflare: bot protection (Turnstile).
• Grafana Labs: server monitoring and logs.
• AI model providers that generate replies and search your knowledge base: OpenRouter and the model providers it routes requests to, OpenAI, Voyage AI, and for voice calls Deepgram and ElevenLabs.
• Channels and integrations you connect yourself: Meta (WhatsApp, Instagram, Messenger), Telegram, Salla and Google Calendar. When you connect a Meta channel, Facebook's login tool is loaded.
• YouTube: embedded tutorial videos.

Some of these providers process data outside the EU/EEA, including in the United States. For those transfers we rely on adequacy decisions of the European Commission (such as the EU-U.S. Data Privacy Framework) or on the Standard Contractual Clauses in the provider's data processing terms.

We do not sell personal data and do not share it for advertising. We do not control the privacy practices of these third parties and recommend reviewing their respective privacy policies.

9. Data Security

We implement industry-standard technical and organizational security measures, including:

• Data encryption at rest and in transit
• Access control and role-based permissions
• Enterprise-grade infrastructure security

These measures are designed to protect your data against unauthorized access, alteration, or disclosure.

10. Mobile Apps (iOS and Android)

The RevoplyAI apps for iOS and Android give you the same dashboard as the web, and everything in this policy applies to them. In addition, the apps process the following:

• Sign-in: you can sign in with email and password, with Google, or with Sign in with Apple, all through Firebase Authentication. We receive your name and email address from Google or Apple. With Apple you can choose to hide your email address; we then receive an Apple relay address that forwards to you. Basis: contract. Kept: until you delete your account.
• Push notifications: if you allow notifications, the app registers a push token (Firebase Cloud Messaging, and on iPhone also Apple Push Notification service) and sends it to our server with your device's browser identification string (user agent, which can include the device model). We store it with your user and company and use it only to alert you about conversations: escalations, qualified leads, assignments, new customer replies in conversations assigned to you, and bookings. A notification can show the customer's name and the first 120 characters of their message on your lock screen. The number on the app icon is your count of unread notifications. Basis: contract; you can turn notifications off in the app or in your phone's settings. Kept: until you sign out, the token expires, or you delete your account.
• Your analytics choice: when you first open the app, it asks whether you allow analytics, which covers crash reports and usage statistics. Both stay off until you agree. You can change your choice at any time under Account settings, Privacy.
• Crash reports: Firebase Crashlytics collects crash and error reports: device model, operating system and app version, the error and its stack trace, the screen where it happened, and your Firebase user ID so we can match a crash to a support request. It does not receive your name or email address. Crash reports are sent only if you allow analytics. Basis: your consent. Kept: 90 days by Google.
• Analytics: the iOS and Android apps do not run PostHog or any other usage analytics, and no sessions are recorded in them.
• Data on your device: the app stores some data on your phone so it opens quickly and works on a weak connection: recent conversations (Firestore offline cache), the last loaded dashboard, bookings and notifications (up to 7 days), unsent reply drafts (up to 7 days), and your language and display settings. Signing out deletes the conversation cache, the cached pages and your drafts, and removes the push token and the icon badge. Your language setting and your analytics choice stay on the device until you remove the app.
• App updates: the app downloads updates of its interface from our server (app.revoplyai.com). The request carries no account data; like any web request it reaches our server with your IP address.
• Plan limits: when you reach a plan limit, we record which limit. If the account owner has agreed to marketing emails, we may send them one email about the plans on our website; every such email has an unsubscribe link. Basis: our legitimate interest for the record, consent for the email. Kept: until you delete your account.
• Device permissions: the app asks for permission to send notifications. If you attach a photo, video or file, or record a voice sample on the testing page, it uses your phone's file picker, camera or microphone for that action only, and the file or recording is uploaded to carry out your request. The app does not access your location, your phone's contacts or your advertising identifier, and does not track you across other companies' apps or websites.
• Links and videos: links to other websites open in a browser window inside the app; WhatsApp, Telegram and Instagram links open those apps. Tutorial videos are embedded from YouTube, and YouTube's privacy policy applies when you play one. Our pages use Cloudflare Turnstile to block bots.

11. Deleting Your Account

You can delete your account at any time:

• In the app or the web dashboard: open the account menu (your avatar) → Account settings → "Delete account" at the bottom. You confirm by typing your email address and signing in again.
• Without the app: app.revoplyai.com/delete-account explains the steps, or email [email protected] from the address registered to your account.

When you request deletion, your login is deleted immediately and you are signed out on all devices. Your email address is released so it can be used for a new account. Your data is hidden at once: nobody can access it and it is no longer processed. It is then permanently deleted.

What is deleted:

• If you are a team member (not the owner): your login, your profile (name, email, phone, preferences and schedule), your push tokens and your notification settings. Conversations and notes you wrote stay with the business; after the 180 days they are shown as written by a "Deleted user".
• If you are the last owner of the account: the whole workspace and its projects, and every member's login and profile. Channels are disconnected at once (WhatsApp, Meta, Telegram), Google Calendar access is revoked and Salla tokens are deleted. After 180 days everything is permanently deleted, including all conversations, uploaded files, contacts, knowledge base, catalog, bookings, broadcasts, automations, statistics and voice calls. Ownership cannot be transferred, so your team loses access too.
• If you signed in with Apple, we revoke the Apple tokens linked to your account.
• An active Stripe subscription is cancelled as soon as you request deletion, without a refund or pro-rata credit, and nothing renews. If you are billed through Salla, cancel or uninstall the app in Salla yourself.

What we keep, and why:

• Invoices and payment records at Stripe (and at Salla for marketplace billing) for the period German law requires: 8 years for invoices and accounting vouchers (§147 AO, §257 HGB, §14b UStG) and 10 years for books and annual accounts.
• A minimal deletion record (company ID, request and completion dates, Stripe customer ID, no content or contact data) as proof of deletion and to link those invoices, for the same period.
• Encrypted backups: deleted data leaves them within 7 days of the permanent deletion, so about 187 days after your request.
• Server logs: deleted within about 14 days.
• Crash reports: stay in Firebase Crashlytics until they expire after 90 days, and contain neither your name nor your email address.
• Analytics: the PostHog profile on your device is reset.

12. Children's Privacy

RevoplyAI, including its mobile apps, is a business tool for businesses and their staff and is not directed at children. You must be at least 18 years old, or the legal age to enter binding agreements where you live, to create an account. We do not knowingly collect children's data. If we learn that a child's data has been provided to us, we will delete it promptly.

13. Scope of This Policy

This Privacy Policy covers revoplyai.com, the web dashboard at app.revoplyai.com and the RevoplyAI apps for iOS and Android. It does not cover third-party websites or services we do not control.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page, and the date at the top shows the last update.

15. Consent

By using RevoplyAI, you acknowledge that you have read, understood, and agreed to this Privacy Policy and its terms.

16. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Email: [email protected]

Operator: RevoplyAI, sole proprietorship (Einzelunternehmen). Legal details: Imprint.