Privacy Policy

{{legal company name}} (registered under Belgian company number {{no.}}), {{address}}, Belgium is the provider of Revenaro. For questions about this policy or your data: privacy@revenaro.com.

For data we process on behalf of a business (see above), that business is the data controller. To find out what data a specific business holds about you, or to have it deleted, that business is usually the fastest route, though we also help directly, see section 9.

If you're a customer of a business using Revenaro: your name, phone number and/or email address, your appointment history with that business (which service, when, its value), your consent status for messages, and the content of your conversations with the Revenaro assistant to the extent needed to handle them (for example: 'yes, that works for me' or 'can it be Thursday instead').

We deliberately do NOT process any medical or health data, even for customers of dental or medical practices. What we see is the logistics of an appointment, which service, when, whether it goes ahead, never its medical content.

If you're yourself a business using Revenaro: account data (name, email, business name), billing data (via Stripe, we never see full card details), and usage data about how you use the dashboard.

If you visit our website without being a customer: see our cookie policy for what's collected there. That's limited to what's technically necessary, unless you enter information yourself (for example in the calculator or the waitlist).

To recognise when a slot has opened up and reach the right customer. To carry that conversation, via WhatsApp, SMS or phone, through to a confirmation or a clear no. To show the business what happened and what it was worth. To meet accounting and tax obligations. And, with your consent, to let you know when Revenaro becomes available in your area (the waitlist).

• Performance of the contract between the business and its customer (booking the appointment), legal basis: contract, carried out on the business's behalf.
• The business's legitimate interest in contacting a customer about a freed-up appointment relevant to them.
• Consent, for anything beyond a service message (for example a review request or an offer).
• Legal obligation, for invoicing and bookkeeping.

The conversations you have with Revenaro are carried out by an automated assistant that uses language models to understand what you mean and reply appropriately. You're always told this whenever it's relevant, Revenaro never pretends to be a human. This is not automated decision-making with a legal or similarly significant effect on you under Article 22 GDPR: it's about proposing and locking in an appointment, not, for example, a credit decision.

To hold these conversations, the text of your messages (never more than needed) is processed by our language-model provider. See section 6 for who that is.

End-customer data is kept for as long as the business remains active with Revenaro and the customer has not opted out. If a customer opts out by replying 'STOP', we retain only the fact of that opt-out (so we never accidentally contact them again) and delete the rest within 30 days. Six months after the contract between Revenaro and the business ends, all remaining customer data for that business is deleted or irreversibly anonymised, unless a legal retention obligation requires longer (such as invoices: 7 years, a tax requirement).

Conversation content (the messages themselves) is kept for a maximum of 24 months and then deleted; appointment history (what was booked, not the wording) may be kept for longer while the account is active, because the business needs it to recognise and serve its customers well.

We never sell data. We only share it with providers necessary to run the service, each bound by a data processing agreement. The full, current list is in our data processing agreement (see /legal/dpa); the main ones today:

• Twilio, sending SMS messages.
• Meta Platforms Ireland Ltd., sending WhatsApp messages (WhatsApp Business Cloud API).
• Supabase, database hosting, in the EU.
• Vercel, hosting the website and application.
• Stripe, processing payments between Revenaro and its business customers.

We host our database within the EU/EEA where possible. Some providers above (notably Twilio and Meta) may also process data outside the EU/EEA. Where that happens, it's on the basis of the European Commission's Standard Contractual Clauses or an equivalent recognised mechanism, supplemented by appropriate technical measures. For details of a specific transfer, email privacy@revenaro.com.

Data is encrypted in transit and at rest. Access to production data is limited to staff who need it, and every action on sensitive data is logged. Webhook and API traffic is cryptographically verified to prevent anyone impersonating one of our providers. Should a data breach ever occur that poses a risk to you, you will be informed as required by law.

Under the GDPR you have the right to access, rectify, erase, restrict the processing of, and port your data, and to object to processing based on legitimate interest. You can opt out of messages at any time, free of charge, by replying 'STOP', this always works, regardless of which channel reached you.

To exercise any of these rights, email privacy@revenaro.com and mention which business you're a customer of, so we can help you quickly. If you're unhappy with how we handled your request, you can lodge a complaint with the Belgian Data Protection Authority, the Dutch Autoriteit Persoonsgegevens, or the French CNIL, depending on where you live.

Revenaro is not directed at children and does not knowingly collect data from anyone under 16. If you believe this has happened anyway, let us know at privacy@revenaro.com and we will delete it immediately.

As Revenaro expands to new countries or channels, we'll update this policy. For a meaningful change, we'll update the date at the top and inform active business customers. Earlier versions are available on request.