Privacy Policy

Effective Version 5

1. Who we are

revn is operated by Fibrewise Ltd, registered in England and Wales (company number 11376004), 86-90 Paul Street, London EC2A 4NE, United Kingdom (“revn”, “we”, “us”). We are the controller of the personal data described here, except where section 5.2 says we act as a processor for a page owner.

Privacy questions: privacy@revn.app.

2. In short

  • We collect what we need to run revn, and we do not sell personal data or use it for advertising.

  • Published pages and cards set no cookies of their own and carry no analytics or advertising trackers.

  • Wallet passes contain only what the card owner chooses to show, and saving one does not tell us who you are.

  • You can delete your account at any time from the dashboard.

3. Account holders

3.1 Account

Our sign-in provider, Clerk, collects your name, email address, profile picture and sign-in method (for example an email code or a Google account), plus security data such as sign-in times, IP address and browser. We keep your name, email, picture and account status. Why: to create and secure your account and contact you about it. Legal basis: contract; legitimate interest in security.

3.2 Content

Cards, pages, text, images, logos, links and settings you create. Anything you publish is public. Why: to provide the Service. Legal basis: contract.

3.3 Payments

Paid plans are sold through Onelink, Stripe's reseller service, which collects your payment details directly and handles them under its own privacy policy; we never see full card numbers. We receive your billing name, email, address and country, card brand and last four digits, and your subscription, invoice and payment history. Why: billing, tax records and fraud prevention. Legal basis: contract; legal obligation.

3.4 Email

We send service email (account, trial, billing, usage and security notices) through Loops. If you use “send by email” to share your card, we process the recipient's address to deliver it for you and keep a delivery log. We only send marketing email if you opt in, and every marketing email has an unsubscribe link. Legal basis: contract and legitimate interest; consent for marketing.

3.5 AI assistants and API keys

You can connect an AI assistant, such as ChatGPT (OpenAI), Claude (Anthropic) or Cursor (Anysphere), to your account through our MCP server. You sign in to revn and approve the connection; the assistant can then read and change your pages, cards, uploads and domains and see your name and email address, within your plan's limits.

  • What the assistant receives. Only what its requests return: page and card content, links to your uploaded images and files, publishing status, and your name and email address. To show a page preview in the chat we create a private, short-lived link. Files you attach in the assistant are fetched from the link it gives us and stored like any other upload.

  • The assistant's provider receives this data because you chose to connect it, and handles it, together with your conversation, under its own privacy policy (OpenAI, Anthropic, Cursor). It is not our sub-processor. We do not see your conversations, only the requests the assistant sends us.

  • What we record. For each request: the time, the action, the result, how long it took and which assistant or API key made it. We keep these records for 7 days, and daily totals without personal data for up to 13 months. Technical logs may also hold details such as the IP address and client name (section 3.7).

  • API keys. If you have keys for our API, we store only a hash of each key, its name, its permissions and when it was last used.

  • Your controls. Disconnect revn in the assistant's settings at any time. To end every assistant's access at once or revoke an API key, email support@revn.app. Deleting your account ends all access.

Why: to let you use revn from tools you choose, and to secure and debug that access. Legal basis: contract; legitimate interest in security.

3.6 Support

If you contact us, we keep your name, email address, message and a hashed form of your IP address (used to prevent abuse). Legal basis: legitimate interest in answering you.

If support chat is available in your dashboard, it is provided by Crisp. When you open it, we share your name, email address, plan and account ID with Crisp so we know who we are talking to. Crisp stores the conversation and records technical data such as your IP address, approximate location, browser and the dashboard page you were on. Legal basis: legitimate interest in answering you.

3.7 Logs and security

Our hosting, infrastructure and logging providers keep technical logs (IP address, request time, browser, errors), and we keep an audit log of administrative actions. Why: security, abuse prevention and debugging. Legal basis: legitimate interest; legal obligation.

4. Business cards and Wallet passes

  • What a pass contains. Only what the card owner adds: typically name, job title, company, contact details, logo or photo, colours and a QR code (which may hold a contact card or a page link). Owners are not allowed to put sensitive data such as ID numbers, financial details or health information on a card.

  • Apple Wallet. When someone adds a pass, their device sends us a random device identifier and a push token. Apple generates these; we do not use them to identify anyone, only to deliver updates when the owner edits the card. They are deleted when the pass is removed or the card is deleted.

  • Google Wallet. We send the card's content to Google's Wallet API to create the pass. When someone saves it, Google stores it in their Google account; we do not receive their name, email or account details.

  • No tracking. Passes do not use location, contain no advertising, and are updated only to reflect changes the owner makes.

  • Apple and Google store and display saved passes under their own privacy policies (Apple Wallet & Privacy, Google Privacy Policy).

  • Removing a pass. Anyone can remove a pass from their Wallet app at any time. If the owner deletes the card or their account, saved passes stop updating and Google passes are deactivated.

Legal basis: contract with the card owner; legitimate interest in keeping saved passes accurate.

5. Visitors of published pages

5.1 Visit statistics (we are the controller)

  • To give page owners visit statistics and apply plan allowances, our servers compute a one-way hash of your IP address, browser user agent and the date to estimate unique visitors for the day. The hash is kept, with your country and the referring website, in short-lived counters that expire within 3 days. Only daily totals are kept after that, for up to 13 months.

  • We do not store your IP address for statistics. Published pages set no cookies of their own and contain no third-party analytics or advertising trackers. Embedded content is covered in section 5.3.

Legal basis: legitimate interest in providing statistics and preventing abuse.

5.2 What you send to a page owner (we are the processor)

Contact forms, review forms and newsletter sign-ups are run by the page owner, who decides how your information is used and should give you their own privacy notice. We store and deliver what you submit on their behalf, screen it for spam (section 6), and delete it when they or their account deletion tell us to. Newsletter sign-ups are passed to the email provider the owner connected (for example Mailchimp). To exercise your rights over this data, contact the page owner; we will help them respond.

5.3 Embedded content

Pages may embed third-party content. When it loads, that provider receives your IP address and may set its own cookies under its own policy: YouTube (served in privacy-enhanced mode), map tiles from OpenStreetMap, and weather from Open-Meteo.

6. Automated moderation and spam screening

To keep revn safe we check published content (text and images) and form submissions automatically, using rules and AI models from third-party providers accessed through OpenRouter. Only the content being checked is sent, including any name or email address typed into a form; account identifiers and IP addresses are not. A check can stop a page from being published or hide a submission. Account suspensions are always decided by a person. You can ask for any automated decision to be reviewed by a person at privacy@revn.app. Legal basis: legitimate interest in preventing abuse.

7. Who we share data with

We do not sell or rent personal data or share it for advertising. We share it with the service providers (sub-processors) below, who act under contracts restricting them to our instructions; with professional advisers; and with authorities, courts or other parties where the law requires it, or where needed to establish, exercise or defend legal claims or to protect the rights and safety of our users, the public or us.

  • Vercel: hosting and content delivery (USA, global edge)

  • Convex: database and backend (USA)

  • Clerk: sign-in and account management (USA)

  • Stripe: payments and invoicing (USA, EU). As the seller of paid plans (Onelink), Stripe also uses payment data for its own purposes, such as tax and fraud checks, under its own privacy policy.

  • Cloudflare: image and file storage, DNS and bot protection (global)

  • Upstash: rate limiting and short-lived visit counters (USA, EU)

  • Loops: email delivery (USA)

  • Crisp: in-dashboard support chat (EU)

  • Axiom: logging and monitoring (USA)

  • OpenRouter and the AI model providers it routes to: content moderation (USA)

  • Apple and Google: Wallet pass delivery and updates

When you connect an AI assistant, we also send your data to its provider at your request (section 3.5).

If revn is sold or merged, personal data may transfer to the new owner, who must continue to protect it in line with this policy.

8. International transfers

Some providers process data outside the UK and EEA, mainly in the USA. We protect these transfers with the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, the UK-US Data Bridge and the EU-US Data Privacy Framework where the provider is certified, or other safeguards the law recognises.

9. How long we keep data

  • Account and content: while your account exists. When you delete your account you have 7 days to change your mind. After that, your account, cards, pages, uploads, statistics, form submissions, reviews, Wallet registrations and API keys are permanently deleted.

  • Visit counters: up to 3 days. Daily totals: up to 13 months.

  • API and assistant request records: 7 days. Daily totals: up to 13 months.

  • Support messages and chats: as long as needed to deal with your request and any follow-up.

  • Technical logs: typically up to 30 days.

  • Billing records: as long as tax and company law requires (in the UK, generally 6 years).

  • Backups: overwritten on a rolling basis.

10. Your rights

Depending on where you live, you can ask to access, correct, delete or export your personal data, restrict or object to its processing, and withdraw consent at any time. You can update your details and delete your account in the dashboard; for anything else email privacy@revn.app. We respond within the time limits the law sets.

You can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data-protection authority, though we would appreciate the chance to help first.

US residents: we do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information except to provide the Service. You can exercise your rights to know, delete and correct as above, and we will not discriminate against you for doing so.

11. Cookies

revn.app and the dashboard use only strictly necessary cookies and browser storage, such as your sign-in session (set by Clerk), interface preferences and, if support chat is available to you, your chat session (set by Crisp). We use no advertising or analytics cookies, so we do not show a cookie banner. Published pages set no cookies of their own; embedded third-party content may (section 5.3).

12. Security

We use appropriate technical and organisational measures to protect personal data, such as encryption and access controls. No system is completely secure, so we cannot guarantee the security of your data. If a breach affects your data, we will notify you and the regulator where the law requires.

13. Children

revn is for adults (18+) and is not directed at children. If you believe a child has given us personal data, contact us and we will delete it.

14. Changes

When we update this policy, we change the effective date above. For material changes we will let account holders know by email or in the dashboard.

15. Contact

Fibrewise Ltd, 86-90 Paul Street, London EC2A 4NE, United Kingdom
Privacy: privacy@revn.app · General: support@revn.app · Contact form