Privacy Policy

1. About this policy

Revvly is a subscription and revenue management platform. Businesses use Revvly to manage billing, subscriptions, payments, and revenue for their own clients. This policy explains what personal information we collect, how and why we use it, who we share it with, how long we keep it, and the rights available to you under applicable data protection laws — including the EU and UK General Data Protection Regulation (“GDPR”), Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25, “Quebec Law 25”) and Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”), and the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”).

Please read Section 3 first — who this policy applies to — because our role, and therefore our obligations to you, depends on how you interact with Revvly.

2. Who we are

Revvly is operated by AcceleratorApp Limited, a company incorporated in the British Virgin Islands (BVI Company No. 1991045) (“Revvly,” “we,” “us”), which acts as the data controller for the processing described in this policy.

Contact for privacy matters: [email protected] · attn: Privacy Officer.

3. Who this policy applies to

Revvly is a business-to-business platform, and there are two distinct groups of individuals whose personal information may be processed. Our role differs for each.

3.1 Business Users (our customers)

“Business Users” are the businesses that subscribe to Revvly, and the individual staff members who create accounts and use the platform to manage their clients.

For Business User personal information, Revvly is the controller. This policy governs that relationship in full, and the rights described in Section 10 are exercised against us.

3.2 Clients (our customers’ clients)

“Clients” are the customers, members, or payers of a Business User, whose information the Business User enters into and manages within Revvly — for example, to bill them, manage their subscription, or record a payment. Clients do not have Revvly accounts and do not use the platform. A Client may, however, interact with a payment page hosted by our payment processor (see Section 6) when paying a Business User.

For Client personal information, the Business User is the controller and Revvly acts as a processor / service provider, processing that information solely on the Business User’s documented instructions and under our data processing agreement with that Business User. We do not decide the purposes for which Client data is used, we do not use it for our own purposes, and we do not sell or share it.

If you are a Client: the privacy policy of the Business User you deal with governs your relationship, and you should direct rights requests to that Business User. Section 4.2 describes, at a high level, the categories of Client data we process on Business Users’ behalf, and Section 10 explains how we support Business Users in fulfilling your requests.

4. Information we collect

4.1 Business User information (we are controller)

We collect this information directly from you when you register, configure, and use Revvly; automatically as you use the platform; and occasionally from your organization’s administrator when they provision your account.

4.1.1 How we measure use of Revvly

While you are signed in, the Revvly app records which pages you open and for how long each stays in view, so that we can see how each Business User’s organization uses Revvly. We use this to understand which features are used, to support our customers (for example, to see whether a team has got started), and to improve the product.

• What is recorded. The page you opened, shown as a pattern (for example /clients/:id, never the specific record), the seconds the page was in view, when it happened, and a session identifier that changes after 30 minutes of inactivity. Each record is linked to your work email address and to your organization.
• What is not recorded. The content of any page, anything you type or enter, search terms, the web address’s query string or fragment, page titles, or Client data.
• Who sees it. Only Revvly personnel, in our own systems. It is not shown to other users of your organization, is not sold, and is not sent to analytics or advertising providers. It is separate from the website analytics described in Section 5.
• Who is left out. People who use Revvly as members of our own team, including when they open a Business User’s workspace to help.
• Your choices. If your browser sends a Do Not Track signal, nothing is recorded. You can object to this processing, or ask us to delete the records linked to you, by writing to [email protected].
• How long. Records are deleted automatically 13 months after they are received.

4.2 Client information (we are processor on the Business User’s behalf)

On the instructions of each Business User, we process Client data that the Business User enters or generates in Revvly, such as: name and contact details; subscription and plan records; billing amounts, currency, and payment status; invoices and transaction history; and payment metadata returned by our payment processor (such as the payment card’s last four digits, brand, and expiry, and the processor’s customer/subscription identifiers). We do not receive or store full payment card numbers — see Section 6. Clients do not hold accounts and do not log in to Revvly.

The precise categories are determined by the Business User’s own configuration and privacy policy.

5. Cookies and similar technologies

We use strictly necessary cookies to operate Revvly (for example, to keep Business Users logged in and to secure the service), and, where required, we obtain consent for analytics or preference cookies. You can manage non-essential cookies through the cookie banner or your browser settings. Our Cookie Policy describes each cookie we use, its purpose, and its duration.

Under Quebec Law 25, where we use technology that allows you to be identified, located, or profiled, we will inform you and provide the means to activate the functions that de-identify you where such technology is enabled by default.

6. Payment processing

Payments in Revvly are processed through our third-party payment processor, Stripe. When a Client pays a Business User, or a Business User pays for its Revvly subscription:

• Payment card and bank details are transmitted directly to Stripe and are handled within Stripe’s PCI-DSS-compliant environment. We do not receive or store full card numbers.
• We receive and store payment metadata (status, amount, currency, last four digits, card brand, and processor identifiers) to manage subscriptions, invoicing, and reconciliation.
• Stripe processes payment data as an independent controller for its own compliance and fraud-prevention purposes, and as a processor for the transaction itself. Stripe’s handling of personal information is governed by the Stripe Privacy Policy.

7. How we use Business User information and our legal bases

We use Business User personal information to provide and secure Revvly, to process your subscription, to provide support, to improve the product, to communicate service and administrative messages, to detect and prevent fraud and abuse, and to comply with our legal obligations.

Under GDPR, we rely on the following legal bases:

Under Quebec Law 25 and PIPEDA, we rely on your consent (express or implied by the context) and on the other bases those laws permit, and we limit collection to what is necessary for the purposes above.

We do not use Business User or Client personal information to make decisions producing legal or similarly significant effects based solely on automated processing without human involvement. If this ever changes, we will inform you in advance, explain the logic involved, and provide the opportunity to submit observations and request human review, as required by GDPR Art. 22 and Quebec Law 25.

8. How we share information

We share personal information only as described below, and never sell it:

• Sub-processors and service providers — the current list is set out on our Sub-processors page. Each is bound by contract to protect personal information and to process it only for the purposes we specify. Questions can be directed to [email protected].
• Business Users — for Client data, we make information available to the relevant Business User, who is its controller.
• Legal and regulatory disclosures — where required by law, court order, or a valid request from a public authority, or to protect our rights, safety, and property or those of others.
• Corporate transactions — in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections.

9. International data transfers

Revvly and the service providers we use may process personal information in countries other than your own, including the United States, the EEA, and the United Kingdom.

Where we transfer personal information across borders, we implement safeguards required by applicable law, including:

• From the EEA/UK: the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum), together with supplementary technical and organizational measures where necessary.
• From Quebec: before transferring personal information outside Quebec, we conduct a privacy impact assessment (PIA/TIA) as required by Law 25, and we ensure the information receives adequate protection through contractual and technical means.

A copy of the relevant transfer mechanism is available on request.

10. Your rights

The rights available to you depend on where you live. To exercise any right, contact us at [email protected]. We will respond within the timeframes set by applicable law, and we may need to verify your identity before acting. If you are a Client, please contact the relevant Business User; where you contact us, we will forward the request to the Business User and assist them in responding.

10.1 GDPR (EU / UK)

You have the right to: access your personal information; have it corrected; have it erased; restrict or object to its processing; data portability; and, where processing is based on consent, to withdraw that consent at any time without affecting prior processing. You may also lodge a complaint with your supervisory authority (in the EU, your national data protection authority; in the UK, the Information Commissioner’s Office at ico.org.uk).

10.2 Quebec Law 25 and PIPEDA (Canada)

You have the right to: access and receive a copy of your personal information; request its correction; withdraw consent; data portability (to receive computerized personal information in a structured, commonly used technological format); request that we cease disseminating your information or de-index a link where dissemination causes serious injury (the right to de-indexation); and be informed of, and make representations about, any automated processing. You may file a complaint with the Commission d’accès à l’information du Québec (cai.gouv.qc.ca) or, more broadly, the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Person responsible for the protection of personal information (Privacy Officer): reachable at [email protected].

10.3 California (CCPA/CPRA)

If you are a California resident, you have the right to: know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of recipients; delete personal information we hold about you; correct inaccurate personal information; opt out of any sale or sharing of personal information; and limit the use and disclosure of sensitive personal information. You also have the right not to be discriminated against for exercising these rights.

Over the preceding 12 months we have collected the categories of personal information described in Section 4 (identifiers, commercial information, internet/network activity, and professional information) for the business purposes described in Section 7. We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We therefore do not offer a distinct “Do Not Sell or Share” mechanism beyond honoring opt-out preference signals where applicable; if this ever changes, we will update this policy and provide the required opt-out.

You may use an authorized agent to submit requests on your behalf, subject to verification.

11. Data retention

We retain personal information only for as long as necessary to fulfil the purposes set out in this policy, including to provide Revvly, to comply with legal, tax, and accounting obligations, to resolve disputes, and to enforce our agreements. When information is no longer needed, we delete or anonymize it. Product usage data (Section 4.1.1) is deleted automatically 13 months after it is received. Client data processed on a Business User’s behalf is retained according to that Business User’s instructions and our data processing agreement, and is returned or deleted on termination of the Business User’s service, subject to legal retention requirements.

12. Security

We maintain technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, and alteration — including encryption in transit and at rest, access controls, and logging and monitoring. No system is perfectly secure, and we will notify you and the relevant authorities of a personal data breach where required by law.

13. Children’s privacy

Revvly is a business tool and is not directed to children. We do not knowingly collect personal information from children under the age of 16 (or the applicable age of digital consent in your jurisdiction). If you believe a child has provided us personal information, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify Business Users through the platform or by email. Your continued use of Revvly after an update constitutes acceptance of the revised policy where permitted by law.

15. Contact us

For any question about this policy or to exercise your rights: