Privacy notice

Who controls your data

When you use Revalio to monitor your own customer enquiries, you are the data controller for that data and Revalio is the processor, acting on your instructions. When Revalio scans a publicly published business website to produce a Revenue Health Report, Revalio is the controller for that analysis.

What we process, and why

• Your account — name, email, password hash, organisation. Lawful basis: contract.
• Your enquiry and opportunity data — contact details and message timelines you connect or import. Processed only on your documented instructions, as processor.
• Publicly published business information — pages, contact routes and response signals from business websites, plus public reputation data. Lawful basis: legitimate interests in analysing information the business has chosen to publish.
• Marketing contact — where we contact a business about its report at a role address (for example info@ or enquiries@), we rely on the PECR regulation 22 corporate-subscriber exemption for B2B email. Where we contact a named individual at their own business domain, we rely on legitimate interests under UK GDPR Article 6(1)(f). We record which of the two applied to each message sent.

Subprocessors

We share the minimum necessary with each of the following:

• Hetzner (Helsinki, Finland) — hosting. Holds the application, the database and the backups, so everything we store is stored there.
• Anthropic — drafting message text. Receives opportunity timeline facts and the business facts you supply. Never payment data.
• OpenAI — fallback provider for the same drafting, used when Anthropic is unavailable. Receives the same fields and nothing more.
• Google — Places for public reputation data (receives business name and locality only) and Gemini for classifying and summarising text from public business websites (receives page text and business facts, never customer mailbox content).
• Attio — our own CRM, holding businesses we have identified as prospects and any reply from them.
• Microsoft — only if you connect a Microsoft 365 or Outlook mailbox: the mailbox is read through Microsoft's own interface, on your instruction.
• Resend — email delivery. Receives recipient address and message content.
• Stripe — payments. Receives billing contact and payment details. Card details never reach our servers.
• Cloudflare — network delivery of this site.
• Telegram — operational alerts to us about our own service, such as a signup or a failed connection. Receives a business name and plan; never your customers' messages or contact details.

Hetzner hosts everything in Finland. Several of the other providers above (Anthropic, OpenAI, Google, Stripe, Cloudflare, Resend and Attio, depending on where they process) may handle data in the United States. Where they do, we rely on the UK–US data bridge or on the provider's standard contractual clauses with the UK addendum. For the mechanism behind a specific provider, ask [email protected].

Retention

Retention is configurable per organisation, and where none is chosen we apply a default window of 24 months. Closed opportunities past the retention window are anonymised rather than deleted, so aggregate history stays intact without holding personal data longer than needed. Open opportunities are live business records and are not aged out while they remain open. If your mailbox access ends because a subscription lapses, we stop reading that mailbox immediately and remove the stored credentials after 30 days.

Your rights

You have the right of access, rectification, erasure, restriction, portability and objection. Account holders can export everything held for their organisation, and permanently erase it, from Settings — both are self-service and immediate. For anything else, or if you are not an account holder, contact [email protected]. You may also complain to the Information Commissioner's Office at ico.org.uk.

If we scanned your business or contacted you

You may be reading this because we emailed you, or because someone sent you a link to a report about your business. We are the controller for that. Here is what we hold and why.

• Where we got your details. From Companies House (name, company number, registered office, SIC codes) and from your business's own public website and its public Google Business listing (pages, the contact email and phone number you publish, opening hours, ratings). We did not get anything from you directly.
• What we do with it. We read your public pages to estimate where your business may be losing enquiries, produce a report at a private link, score how relevant our service might be, and, for a business that looks like a fit, send one or a small number of emails offering the report. This analysis is automated and is a form of profiling. It is not used to make any decision that has a legal or similarly significant effect on you, and nobody's access to anything depends on it. The figures in a report are estimates from public information, not verified facts about your business.
• Our lawful basis. Legitimate interests (UK GDPR Article 6(1)(f)): we think a business that may be losing enquiries would want to know. We email only role or corporate addresses, or a named person at their own business domain, and never sole traders or partnerships at a personal address. Email marketing otherwise rests on PECR regulation 22.
• Who sees it. The providers listed above, in the roles described there, and nobody else.
• How long we keep it. We do not yet delete prospect records on a fixed timer. If you ask, we delete them (see below). We keep only your email address and domain on a do-not-contact list after you object, so that we do not contact you again.

Your right to object is absolute for marketing. Use the suppression page (no account needed): it unpublishes the report and stops all further contact. You can also reply STOP to any email. To see what we hold about you, or to have it corrected or deleted, write to [email protected]. We answer within one calendar month. You can complain to the Information Commissioner's Office at ico.org.uk (0303 123 1113).

Cookies

Revalio sets one essential cookie: a signed session cookie that keeps you logged in. There are no advertising or third-party tracking cookies, so there is no consent banner to click through.