Privacy Policy

• Account data: name, email address, password (encrypted), organisation name, account preferences and settings.
• Imported reviews: public reviews retrieved from the platforms you connect (Google at launch; Facebook, Trustpilot and others to come), including the review content, rating, the author’s public name and the date.
• Usage and technical data: connection logs, IP address, browser type, pages viewed and usage statistics of the service.
• Origin of your sign-up: the site you came from (referrer), landing page, campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content), Google Ads click identifier (gclid) and country (inferred by our network provider, without storing the IP address). This information is stored in a first-party cookie on your first visit, then linked to your account if you sign up.
• Cookieless visit statistics: page viewed, referring site, campaign parameters, country and device type, counted by our own server and kept only as daily totals. No cookie, IP address or identifier is stored; to count the same visitor only once per day, an encrypted fingerprint is kept in memory until midnight (UTC) and then erased. Even without your consent, Google Analytics receives signals without cookies or identifiers (page, time, browser), which Google uses to estimate traffic.
• Audience measurement (with your consent): pages viewed, journeys, clicks and scrolling, device type, pseudonymous identifiers from Google Analytics and Microsoft Clarity. Form fields and dashboard content are masked in Clarity.
• Error reports: message and technical trace of an error, page concerned, browser and application version, without IP address or cookie.
• Billing data: processed by our payment provider (see section 4); we never store your payment card data.

• Provision of the service (aggregation, display and synchronisation of reviews, AI Auto-Reply) — legal basis: performance of the contract.
• Account and billing management — legal basis: performance of the contract and legal obligation.
• Security and reliability of the service (fraud prevention, detection and correction of errors) — legal basis: legitimate interest.
• Knowing where our sign-ups come from (first-party origin cookie, no third-party tracker) — legal basis: legitimate interest in knowing which channels make us known.
• Cookieless visit statistics (internal counter and Google Analytics signals without identifiers) — legal basis: legitimate interest in knowing how much our site is visited.
• Detailed audience measurement (Google Analytics 4 and Microsoft Clarity cookies) and measurement of our advertising campaigns — legal basis: consent, collected through our cookie banner and revocable at any time.
• Marketing communications (newsletter, product news) — legal basis: consent, revocable at any time.

We use carefully selected processors, bound by GDPR-compliant data processing agreements (DPAs). Some may process data outside the European Union, subject to appropriate safeguards (standard contractual clauses).

• Stripe: payment processing and subscription management (invoices and application of VAT).
• Requesty: orchestration of the AI models used for the AI Auto-Reply feature (text and rating of the review, its author’s public name, reply instructions). We do not use this data to train AI models.
• netcup GmbH (Karlsruhe, Germany): hosting of the application and database (EU).
• sendy.cloud: sending of transactional emails and notifications (email address, message content, delivery status).
• o2switch (Clermont-Ferrand, France): hosting of the @revys.io mailboxes and email sending server (EU).
• Google Ireland Ltd (Google Analytics 4): audience measurement with cookies, only with your consent; without consent, signals without cookies or identifiers (Google Consent Mode). Possible transfers to the United States, governed by the EU–US Data Privacy Framework and standard contractual clauses.
• Microsoft Ireland Operations Ltd (Microsoft Clarity): click maps and anonymised session recordings (typed text masked), only with your consent. Possible transfers to the United States, with the same safeguards.
• GlitchTip (instance operated by OZAPP, glip.ozapp.io, server in the EU): collection of technical error reports, without IP address or cookie.

Recipient (other than a processor): VIES, European Commission: when you enter an intra-EU VAT number, it is sent to the European Commission’s VIES system to check its validity (tax obligation related to the VAT reverse charge).

• Account data: for the entire duration of the contractual relationship, then deleted or anonymised within 12 months after the account is closed. Account closure and the export of your reviews and replies can be requested at privacy@revys.io.
• Imported reviews: as long as the connection to the source platform is active; deleted when the source is disconnected or the account is closed. A review deleted by its author on the platform is deleted from Revys at the next synchronisation (connected Google profiles). Reviews of a frozen profile stop being displayed thirty days after its last synchronisation. For this data, we act as a processor on behalf of our customers, under our data processing agreement (DPA).
• Billing data: kept for 10 years to meet accounting and tax obligations.
• Technical logs: kept for a maximum of 12 months.
• Sign-up origin: 30-day first-party cookie; once linked to your account, it is kept for as long as the account.
• Cookieless visit statistics: anonymous daily totals; the fingerprint used to count unique visitors is never stored and disappears every day.
• Audience measurement: 14 months in Google Analytics; 30 days for session recordings and 13 months for click maps in Microsoft Clarity.
• Error reports: 90 days.

Under the GDPR, you have the following rights over your data:

• right of access and to information;
• right to rectification;
• right to erasure (“right to be forgotten”);
• right to data portability;
• right to object and to restriction of processing;
• right to withdraw your consent at any time, without affecting the lawfulness of prior processing.

To exercise these rights, write to our GDPR contact at privacy@revys.io (or hello@revys.io). We reply within one month. If you believe your rights are not being respected, you can lodge a complaint with the competent supervisory authority: in Belgium, the Data Protection Authority (Autorité de protection des données, APD), lead supervisory authority for OZAPP SRL; you can also contact the authority of your country of residence or work (for example the CNIL in France).

On your first visit, a window asks for your choice: “Reject all”, “Accept all” or “Customize” by category. No audience measurement cookie is set before your consent. Without consent, Google Analytics runs in cookieless mode (Google Consent Mode): it neither sets nor reads any cookie and only sends signals without identifiers. Microsoft Clarity is only loaded with your consent. Your choice is remembered for 6 months, then asked again. You can change or withdraw it at any time: Manage cookies (link also available at the bottom of every page).

Necessary (always on, exempt from consent):

• better-auth.session_token, better-auth.session_data and related cookies — signing in to your account and security (7 days, extended with use).
• revys_consent — remembers your cookie choice (6 months).
• revys_src — origin of your first visit (referrer, landing page, utm, gclid), read only by Revys at sign-up; never shared with a third party (30 days).
• revys_ev — carries an event (sign-up, verified address, first profile connected) from one page to the next, sent to Google Analytics once you have made your choice, without cookie or identifier if you refused audience measurement (10 minutes).
• revys_plan_intent — plan chosen on the site before sign-up; revys_gbp_oauth — security of the connection to Google Business Profile (for the duration of the process).

Audience measurement (with your consent):

• _ga, _ga_* — Google Analytics 4, visit statistics (13 months).
• _clck (12 months), _clsk (1 day) — Microsoft Clarity, click maps and anonymised sessions.

Marketing (with your consent): allows advertising signals to be sent to Google (Google Consent Mode) to measure our campaigns. No ads are shown on Revys and no additional advertising cookie is set at present.

We implement appropriate technical and organisational measures (password encryption, encryption of communications, access control) to protect your data against unauthorised access, alteration or disclosure.

For any question about this policy or the protection of your data, contact our data protection contact / officer: privacy@revys.io — Oz Ilhan, managing director (gérant) of OZAPP SRL, Thier de Jace 108, 4460 Grâce-Hollogne, Belgium. OZAPP SRL is not required to appoint a data protection officer (DPO); the managing director acts as the contact person.

When you connect your Google account, Revys accesses, with your authorisation, the business profiles you manage and their reviews (Google Business Profile API), as well as your Google email address. This data is used only to display your reviews, to publish the replies you approve or for which you have enabled automatic publication, and to identify you.

Revys’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This data is not sold, not used for advertising purposes, and not used to train general-purpose AI models. You can revoke access at any time from Revys or from your Google account settings.