1. Introduction
This Privacy Policy explains how Revora (“we”, “us”, or “our”) collects, uses, and shares information when you interact with or deploy the Revora platform and related services (the “Service”).
Revora operates as a business-to-business (B2B) retention engine providing embedded cancellation and concession workflows for subscription businesses (“Merchants”). When a Merchant integrates Revora:
Revora acts as Data Controller
For merchant account credentials, billing of the Revora plan, and administrative telemetry.
Revora acts as Data Processor
The Merchant remains the Controller. Revora processes cancellation data strictly on the Merchant’s instructions.
2. Information We Collect
A. Information about Merchants (Controller Role)
- Account registration profile: name, business email, organization name, web domain, and merchant role.
- Billing preferences and platform subscription details for Revora commercial tiers.
- Widget custom styles, cancellation reason hierarchies, concession parameters, and Shadow DOM variables.
- Direct correspondence, bug tickets, and customer support communications.
B. Information Processed on Behalf of Merchants (Processor Role)
- Cancellation telemetry: ephemeral session IDs, selected primary reason codes, and short free-text explanations.
- Stripe subscription status pointers and anonymized reference identifiers supplied via data attributes.
- Technical request metadata required to enforce edge rate limiting and audit trails (such as timestamp and IP addresses).
Revora never stores, handles, or receives primary payment card account numbers (PAN), CVVs, or bank credentials belonging to end-subscribers. All concession discount applications and subscription mutations are executed strictly via cryptographically authorized Stripe Billing API endpoints.
3. How We Use Information
We process collected data exclusively for explicit operational and security purposes:
- Delivering, orchestrating, and hosting the cancellation interception interface.
- Generating real-time aggregate deflection metrics, churn velocity graphs, and CSV data extracts in the dashboard.
- Executing merchant subscription billing, seat management, and invoice verification.
- Hardening edge endpoints against distributed denial-of-service (DDoS) threats, replay exploits, and unauthorized session tampering.
- Fulfilling statutory recordkeeping and compliance obligations.
When a Merchant activates the Revora Intelligence module, cancellation reasons and free-form sentiment feedback are transmitted to isolated AI inference endpoints to generate retention diagnostics and elasticity suggestions.
We strictly enforce that merchant or end-user customer data is never used to train foundation or general-purpose artificial intelligence models.
4. Legal Bases for Processing
Under GDPR and equivalent global privacy regimes, our legal bases depend on the contextual data flow:
- Contractual Necessity: Processing Merchant administrator details and billing records to provision the Revora application.
- Legitimate Interests: Protecting the uptime, infrastructure integrity, and defensive telemetry of the service against malicious activity.
- Merchant Documented Instructions (Processor): All end-user cancellation sessions are evaluated purely under the contractual direction of the Merchant controller.
6. International Transfers
Where data is transferred internationally outside the European Economic Area (EEA), United Kingdom, or Switzerland, Revora guarantees adequate transfer mechanisms pursuant to GDPR Chapter V, including executing EU Standard Contractual Clauses (SCCs) and UK International Data Transfer Addendums with our infrastructure vendors.
7. Data Retention
Merchant account records and invoice histories are preserved for the active lifecycle of the Merchant workspace plus standard statutory limitation and tax accounting windows.
End-user cancellation logs and survey feedback are stored to allow merchants to audit longitudinal deflection rates. Upon account cancellation or explicit written purging requests, end-user logs are systematically queued for deletion or irreversible anonymization across our active clusters within thirty (30) business days.
8. Your Rights & Choices
Depending on your physical location and jurisdiction (including under GDPR, UK-GDPR, and the California Consumer Privacy Act / CPRA), you hold specific statutory rights:
- Right to know, access, correct, or obtain a portable copy of personal records.
- Right to request deletion of personal information subject to legal exemptions.
- Right to freedom from discriminatory treatment when asserting privacy protections.
9. Security Infrastructure
Revora applies layered physical, technical, and administrative controls. API keys and Stripe OAuth credentials are encrypted at rest using AES-256-GCM encryption algorithms. All customer communications and widget telemetry are strictly enforced over TLS 1.3 in transit. For further architectural specifications, visit our dedicated Security Overview.
10. Children’s Privacy
Revora is built exclusively for enterprise and business software owners. We do not knowingly solicit or ingest personal information from individuals under sixteen (16) years of age.
11. Changes to This Policy
We periodically update this policy to reflect new capabilities or evolving regulatory frameworks. Any material changes will be reflected with a revised “Last updated” timestamp alongside notification through the merchant administrative console.
12. Contact Information
For privacy inquiries, standard contractual clause validation, or security questions, our compliance team is directly reachable at: