Privacy Policy

1. Information We Collect

a. Information You Provide

• Account Information: Name, email address, phone number, company name, and password when you register.
• Customer Data: Contact information (names, email addresses, phone numbers) of your customers that you upload or import into the Service.
• Messages: Content of review requests, SMS messages, emails, and other communications sent through the Service.
• Payment Information: Billing details processed through our third-party payment processor. We do not store full credit card numbers on our servers.
• Support Communications: Information you provide when contacting our support team.

b. Information Collected Automatically

• Usage Data: Pages viewed, features used, actions taken, timestamps, and session duration.
• Device Information: Browser type, operating system, device type, screen resolution, and unique device identifiers.
• Log Data: IP addresses, access times, referring URLs, and error logs.
• Cookies and Similar Technologies: See Section 10 below.

c. Information from Third Parties

• Review Platforms: Reviews and ratings from Google Business Profile, Facebook, Yelp, and other connected platforms.
• OAuth Providers: Profile information from Google or Facebook when you connect your accounts.

d. Social Media Data

When businesses connect their social media accounts to Reveo (including Facebook Pages, Instagram accounts, LinkedIn company pages, or Google Business Profiles), we may access the following information from those connected accounts:

• Page and Profile Information: Business name, profile details, and page metadata for connected accounts.
• Content Data: Post content, comments, and direct messages sent or received through connected pages and profiles.
• Analytics Data: Reach, impressions, engagement metrics, and other performance data provided by the connected platforms.
• Review Data: Reviews, ratings, and reviewer information from connected platforms.

We only access accounts that the user explicitly authorizes through the platform's OAuth flow. We do not access personal social media accounts. Access can be revoked at any time by disconnecting the account within Reveo or through the respective social media platform's settings.

e. SMS and Phone Number Data

We collect phone numbers and SMS opt-in consent from your customers when they are provided through the Service for the purpose of sending review requests, notifications, and other business communications on your behalf.

• SMS opt-in data and phone numbers collected for SMS purposes are not shared with third parties for marketing or promotional purposes.
• We only share phone number data with third parties when strictly necessary to deliver our service (specifically, Twilio for SMS delivery).
• Under no circumstances will mobile numbers or personal data collected through SMS features be shared with or sold to third parties for promotional use.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service.
• Send review requests and other communications on your behalf.
• Aggregate and display reviews from connected platforms.
• Manage and publish social media content on your behalf through connected accounts.
• Generate reports and analytics about your reputation, review performance, and social media engagement.
• Process transactions and manage your subscription.
• Communicate with you about your account, updates, and support requests.
• Detect, prevent, and address security issues, fraud, and abuse.
• Improve and develop new features for the Service.
• Comply with legal obligations.

3. AI and Automated Processing

Reveo uses artificial intelligence and automated processing to enhance the Service. Specifically, we use AI services (including Anthropic and OpenAI) to:

• Generate Suggested Review Responses: AI analyzes review content and drafts response suggestions for your approval.
• Draft Social Media Content: AI assists in creating social media post suggestions based on your business context.
• Classify Message Sentiment: Automated analysis categorizes incoming messages and reviews by sentiment to help prioritize your responses.
• Detect Spam: AI filters help identify and flag spam messages across communication channels.

Important safeguards regarding AI processing:

• We do not use client data or customer data to train AI models.
• AI-generated content is always presented as a suggestion for human review before being sent. No AI-generated response is sent automatically without user approval unless the user has explicitly enabled auto-response features.
• Third-party AI providers are contractually prohibited from using Reveo data for model training purposes.
• Clients may opt out of AI-powered features at any time by contacting [email protected].

What we send to AI providers. Only the text a feature needs to produce its suggestion: for example, the review you are replying to, or the recent messages in a conversation you ask Reveo to draft a reply for. That text can include names and other details written in it. The provider returns a suggestion to Reveo; it is not permitted to use that text to train its models.

Questions or concerns about AI. If you believe an AI feature in Reveo has produced something inaccurate, unfair, or that raises a privacy concern, email [email protected].

4. Third-Party Service Providers

We share information with the following categories of third-party service providers, solely to operate and deliver the Service:

• Twilio: SMS messaging and phone number management for sending review requests and notifications.
• Mailgun: Email delivery for review requests, notifications, and transactional emails.
• Google: Google Business Profile API for review aggregation, social media management, and OAuth authentication.
• Facebook / Meta: Facebook Pages API and Instagram API for review aggregation, social media management, and OAuth authentication.
• LinkedIn: LinkedIn API for social media management of connected company pages.
• Anthropic: AI-powered message and review response drafting, inbox reply suggestions, and content generation.
• OpenAI: AI-powered content suggestions, review response drafting, and sentiment analysis.
• Payment Processors: Secure processing of subscription payments.
• Cloud Infrastructure: Hosting and data storage on Amazon Web Services (AWS).
• Sentry: Error monitoring and application stability tracking.
• Cloudflare: DNS management, content delivery network (CDN), and security services.

These providers are contractually obligated to use your information only for the purposes of providing their services to us and in accordance with applicable data protection laws.

Google API Limited Use Disclosure

Reveo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Data Sharing and Disclosure

We do not sell your personal information. We may disclose your information only in the following circumstances:

• Service Providers: As described in Section 4, to third parties that help us operate the Service.
• Legal Requirements: When required by law, regulation, legal process, or governmental request.
• Protection of Rights: To protect the rights, property, or safety of Reveo, our users, or the public.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.
• With Your Consent: When you have given us explicit permission to share your information.

Our Role for Your Customers' Information

When a business uses Reveo, the information about that business's own customers (their contact details, the review requests and messages sent to them, and their replies) belongs to the business. The business decides why it is collected and how it is used, and Reveo processes it on the business's behalf as its service provider.

If you are a customer of a business that uses Reveo and want to access, correct, or delete your information, please contact that business. If you contact us instead, we will pass your request to the business and help it respond. You can always stop text messages by replying STOP.

6. Data Retention

We keep information only as long as we need it for the purposes described in this policy. How long depends on whose information it is:

• While your subscription is active: We keep your account data and the information you add to the Service for as long as your subscription is active.
• Your business and account contact details: After a subscription ends, we keep a record of the business and its account users' contact details (such as business name, address, phone, email, and website) along with its billing and cancellation history. We use this record to keep accurate business and tax records and to contact you about returning to Reveo. You can ask us to delete it, or to stop contacting you, at any time.
• Your customers' information: Your customers' contact details and the content of the messages, review requests, and conversations sent through the Service are kept for a grace period of up to 90 days after your subscription ends, so you can return without losing your data. After the grace period, we delete this information or de-identify it so it can no longer be linked to a person. You can ask us to do this sooner.
• Social Media Data: Retained for the duration of the account connection. Deleted within 30 days of disconnecting the social media account.
• Aggregated and de-identified information: We may keep statistics that do not identify you or your customers, such as review counts, ratings, and response rates, to report performance and benchmarks and to improve the Service.
• Usage and Log Data: Retained for 12 months.

Copies of deleted information may remain in our backups for a limited time until they are overwritten, and we may keep information longer when the law requires it (for example, tax records, or as set out in a Business Associate Agreement).

You may request earlier deletion of your data by contacting us (see Section 15, or our Data Deletion Instructions).

7. Data Security

We implement industry-standard technical and organizational measures to protect your information, including:

• Encryption of data in transit (TLS/SSL) and at rest.
• Access controls and authentication requirements.
• Regular security assessments and monitoring.
• Secure hosting on AWS infrastructure.
• DDoS protection and web application firewall through Cloudflare.

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

8. Your Rights Under GDPR

If you are located in the European Economic Area (EEA) or United Kingdom, you have the following rights under the General Data Protection Regulation:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Restriction: Request that we limit processing of your data.
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw Consent: Where processing is based on consent, withdraw it at any time.

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

9. Your Rights Under CCPA

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with the following rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected.
• Right to Delete: Request deletion of your personal information.
• Right to Opt-Out: Opt out of the sale of your personal information. We do not sell personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise these rights, contact us at [email protected]. We will verify your identity before processing your request.

10. Cookies and Tracking Technologies

We use the following types of cookies:

• Essential Cookies: Required for the Service to function (authentication, session management, security).
• Analytics Cookies: Help us understand how the Service is used so we can improve it.
• Preference Cookies: Remember your settings and preferences.

You can control cookies through your browser settings. Disabling essential cookies may prevent the Service from functioning properly.

11. Data Privacy Frameworks

Reveo processes data in accordance with applicable data privacy frameworks. We are committed to handling personal data responsibly and in compliance with relevant data protection regulations in the jurisdictions where we operate, including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable privacy laws.

12. HIPAA Compliance

Reveo can provide a Business Associate Agreement (BAA) for healthcare customers who require HIPAA compliance. If your organization is subject to HIPAA and you need a BAA in place before using the Service, please contact us at [email protected] to request a BAA.

13. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 16, we will take steps to delete it promptly.

14. Related Policies

Please review our other policies that govern your use of the Service:

• Terms of Service
• Security Policy
• AI Policy
• Acceptable Use Policy
• Data Deletion Instructions

15. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or have a complaint, please contact us:

Reveo, LLC
Coeur d'Alene, ID 83815
Privacy: [email protected]
Support: [email protected]
Phone: (844) 410-3050
Website: reveo.com

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Effective Date" above. Your continued use of the Service after any changes constitutes acceptance of the updated policy.