Privacy Policy

1. Who we are

Revoran ("we", "us", "our") provides AI-powered Google review management software for local businesses. This Privacy Policy explains what personal data we collect, why, how it's used, who we share it with, and the rights you have over it.

Data controller: [Legal entity name, organization number, and registered address — add before publishing]. Contact: kontakt@revoran.com.

2. Two roles: your account, and your customers' data

Revoran processes two categories of personal data, and our role under GDPR is different for each:

As data controller — for your own account data: your name, email address, business name, login sessions, and billing details. We decide how this is used, as described below.

As data processor — for data about your customers that flows through our product on your behalf: the text and star rating of Google reviews left on your business profile, reviewer display names, replies you or our AI draft, and any name/email/phone number a visitor submits through your embedded chat widget or "get reviews" links. You (the business) remain the data controller for this data; we process it only to provide the service to you.

3. What we collect

• Account data: email, name, business name, and (if you sign in with Google) your Google account ID and profile name.
• Google Business Profile data: if you connect your Google Business Profile, we store an encrypted OAuth access/refresh token and sync your business's reviews, review replies, and Q&A so we can display and help you respond to them.
• Billing data: your subscription plan and Stripe customer/subscription IDs. Card numbers are handled entirely by Stripe — we never see or store them.
• Your customers' data: reviewer names and review text pulled from Google, and any name, email, or phone number a visitor submits through your embedded chat widget or a review-request link you send.
• Usage data: basic request logs (timestamps, endpoint, response time) used for reliability and abuse prevention.

4. How we use it

We use this data to: operate your dashboard and sync your Google reviews; generate AI-drafted reply suggestions and, if you enable auto-reply, post them to Google on your behalf; run the embedded chat widget and capture leads for your business; process payments and manage your subscription; monitor competitors you add; send service emails (e.g. a new negative review, a weekly digest); and secure and improve the service.

Our legal basis is performance of our contract with you (running the service you signed up for), our legitimate interest in keeping the service secure and reliable, and — for marketing or optional emails, if any — your consent.

5. Who we share data with (sub-processors)

We use the following third-party services to run Revoran. Each only receives the data it needs to perform its function, under its own data processing terms:

• OpenAI (United States) — receives review text and chat-widget messages to generate AI reply suggestions. This involves a transfer of personal data outside the EU/EEA, made under OpenAI's Standard Contractual Clauses.
• Google — your Business Profile, review, and Q&A data, accessed via the Google Business Profile API and Google Places API, under your authorization.
• Stripe — payment processing and subscription billing.
• Resend — sends transactional emails (e.g. review alerts, weekly digests).
• Supabase — hosts our database.

We do not sell your data or your customers' data to third parties, and we do not share it for third-party advertising.

6. Data retention

We keep your account data for as long as your account is active, and for a reasonable period afterward to comply with legal/accounting obligations and resolve disputes. If you'd like your account and associated data deleted, contact kontakt@revoran.com and we will action the request — self-service account deletion is not yet available in the product.

7. Cookies

We use a single strictly-necessary session cookie to keep you signed in. It is not used for advertising or cross-site tracking, and we don't currently use any analytics or marketing cookies.

8. Data security

All traffic to Revoran is encrypted in transit (HTTPS). Google OAuth tokens are encrypted at rest in our database. Access to production data is limited to what's needed to operate the service.

9. Your rights

Under GDPR, you have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent where processing is based on it. To exercise any of these rights, contact kontakt@revoran.com. If you're not satisfied with our response, you have the right to lodge a complaint with your local data protection authority (in Norway, Datatilsynet).

If a reviewer or lead asks you to remove their personal data and it's stored in Revoran, contact us and we'll assist — you remain the data controller for that data, and we act on your instructions.

10. Children

Revoran is a business tool and is not directed at, or intended for use by, children.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above, and where appropriate, we'll notify you directly.

12. Contact

Questions about this Privacy Policy or how your data is handled? Reach us at kontakt@revoran.com.