Privacy Policy

AI Revo Ltd (“AI Revo”, “we”, “us”), a company registered in England and Wales, company number 16567831.

Registered office: 128 City Road, London, EC1V 2NX, United Kingdom

Website: https://ai-revo.com · Email: info@ai-revo.com

This policy covers two things:

• This website, and how we deal with people who contact us or buy from us. Here we are the controller of your personal data.
• The AI messaging service we set up and run for businesses (the “Messaging Service”). Here each business is the controller of its customers’ data, and we are its processor: we handle that data only on the business’s instructions, under a signed data processing agreement.

Businesses hire us to answer routine customer messages on their own WhatsApp number, Facebook Page and Instagram professional account. The service replies only with information the business has approved, hands everything else to the business’s own staff, and records every customer’s request to stop.

We connect to these accounts only through Meta’s official APIs: the WhatsApp Business Platform (Cloud API), the Messenger Platform and the Instagram API. A business connects its accounts itself, through Meta’s own screens (WhatsApp Embedded Signup, Facebook Login for Business and Instagram Login). We never ask for, receive or store an account password.

We do not send broadcasts or campaigns, and we never message anyone who has not first written to the business.

• About the business’s accounts: account and asset IDs (WhatsApp Business Account ID, phone number ID, Facebook Page ID, Instagram account ID and username), the permissions the business granted, and access tokens. Tokens are encrypted before they are stored.
• About people who message the business: their WhatsApp phone number, or the ID that Messenger or Instagram assigns them for that business; their profile name where Meta provides it; the messages and attachments they send; message times; and the delivery and read status of the replies.
• Comments on the business’s own posts and ads, where the business uses private replies to comments.
• The business’s staff: the names and contact details the business gives us, so that its staff can be alerted when a conversation needs a person.

We receive only what Meta sends us for the accounts a business has connected. We do not read anyone’s contact list, and we do not collect data from accounts that are not connected to the service.

• to receive and store customers’ messages, and send the business’s replies;
• to understand what a message asks and choose an approved answer, with help from an AI provider (next section);
• to alert the business’s staff and hand the conversation to them;
• to honour opt-outs and each platform’s messaging rules;
• to give the business usage and results reports;
• to keep the service secure, measure usage for billing, and investigate faults.

We use this data only to provide the service to the business it belongs to. We never:

• sell or rent it, or share it with data brokers;
• use it for advertising, for profiling, or for our own marketing, or combine it with the website tracking described below;
• use it to train or fine-tune AI models;
• use one business’s data for another business.

An AI model helps the Messaging Service understand messages and word its replies. It receives only what one reply needs: the current message, a short recent history and the business’s approved information. Phone numbers and similar identifiers are masked where the task does not need them.

Our AI providers are Anthropic and OpenAI, used through their business APIs. Under their terms, data sent through these APIs is not used to train their models.

Fixed rules, not the AI, decide what may be sent. A reply cannot state a price, policy or promise the business has not approved. A business can pause its assistant at any time, and while it is paused no message is sent to an AI provider.

The assistant says it is the business’s automated assistant in its first reply to each customer, and answers truthfully whenever it is asked. It never pretends to be a person, and a customer can ask for a person at any time.

• Enquiries and calls: your name, email, phone number, company and message, when you use our contact form, email us or book a call. Calls are booked through Calendly.
• Clients: business and billing details, signed agreements and payment records. Card payments are made on Stripe’s own pages: we never see or store full card numbers.
• Business portal users: when a business invites its people to its portal (platform.ai-revo.com), each person’s name and email address, their password (stored only as a one-way hash), their sign-in records, and the secret of their authenticator app, encrypted. A person who signs in with Google gives us their Google account ID and email address.
• Usage data: IP address, browser and device type, pages visited and time spent. Our hosting provider records some of this in its logs. The analytics and advertising tools below collect it only if you agree.

Essential cookies make the site work and remember your cookie choice. They are always on.

Analytics and advertising tools load only if you click “Accept All” in our cookie banner:

• Meta Pixel (Meta Platforms) measures visits and the results of our ads on Facebook and Instagram. Meta and other third parties may use cookies, web beacons and similar technologies to collect or receive information from this website and elsewhere on the internet, and use it to provide measurement services and target ads. See Meta’s Privacy Policy, and control the ads you see in your Facebook ad preferences.
• LinkedIn Insight Tag measures visits that come from our LinkedIn ads. See LinkedIn’s Privacy Policy.
• Google Analytics, where enabled, counts visits and pages viewed.
• Retention.com may match your visit with contact details that it or its partners already hold, including your email address, so that we can send you information about our services. You can opt out at any time at app.retention.com/optout.

If you click “Essential Only”, none of these load. You can change your choice at any time with the Cookie settings link at the foot of every page, or by clearing this site’s data in your browser. You can also opt out of interest-based ads at youronlinechoices.com.

These tools run only on this website. None of them ever receives data from the Messaging Service.

• To answer your enquiry and provide our services: to take steps you ask for before a contract, and to perform the contract.
• To bill you, keep accounts and meet our legal duties: legal obligation.
• To keep the website secure, prevent misuse and improve the site: our legitimate interests.
• Analytics and advertising cookies: your consent, which you can withdraw at any time.
• Telling business contacts about our services: your consent or, for business contacts, our legitimate interests. You can object at any time by emailing us.

We share personal data only with service providers that process it for us under contract, and only as much as they need:

• For the Messaging Service: cloud hosting for our servers and database, an email delivery provider for staff alerts and portal emails, encrypted backup storage, our AI providers, Anthropic and OpenAI, Stripe for the card payments businesses make on their portal, and Google for people who choose to sign in to the portal with Google. Meta Platforms delivers the messages on WhatsApp, Messenger and Instagram, under its own terms with each business.
• For this website: Netlify (hosting), Supabase (the website’s database), our email provider, Calendly (booking calls), Stripe (payments, when offered), and the analytics and advertising tools above if you agree to them.

We may also disclose data where the law requires it, to protect our rights or someone’s safety, or to a buyer of our business, who would be bound by this policy. We do not sell personal data.

Some of these providers process data outside the UK, including in the United States. Where they do, we rely on UK adequacy regulations (including the UK–US data bridge, for companies certified under it) or on the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

For a business outside the UK, the transfer terms its own country requires are set out in our client agreement with it.

• Message text: 90 days. After that the words are deleted and only an empty record of the message remains.
• Technical logs of each processing step: 30 to 90 days.
• Alerts to our operators: 180 days after they are handled. Audit trail of operator actions: 365 days.
• Opt-outs: for as long as the business uses the service, so that the person is never messaged automatically again.
• Billing and usage records: as long as tax and accounting law requires, with no message content.
• Encrypted backups: up to 6 months, then they expire.
• Business portal: sign-in records 180 days; ended sessions 90 days; invitations 90 days after they end; screenshots attached to support requests 90 days; closed support requests 365 days after their last message.

When a business stops using the service, we delete its customers’ data within 30 days, or return it to the business first if it asks.

This website

• Enquiries from people who do not become clients: up to 24 months after our last contact.
• Client and billing records: 6 years after the end of the contract, as UK tax law requires.
• Cookies: for the period each provider sets, unless you clear them sooner.

You can ask us to delete your data at any time. Our Data Deletion Instructions explain how, for each case: if you messaged a business that uses our service, if you connected a business account through Facebook, Instagram or WhatsApp, or if you contacted us through this website.

Under UK and EU data protection law, and similar laws in other countries, you can ask us to:

• give you a copy of your personal data;
• correct it, or delete it;
• restrict how we use it, or object to our using it;
• send it to you or to another organisation in a common format;
• stop using it where we rely on your consent.

Email info@ai-revo.com. We answer within one month.

If you messaged a business that uses our Messaging Service, that business controls your data. You can ask it directly, or write to us: we will pass your request to the business and help it answer. You can also stop automated messages at any time by telling the business to stop, for example by replying “stop”.

You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk), or to the data protection authority where you live.

• Access tokens and other credentials are encrypted with AES-256-GCM, with a separate key for each connected account.
• Each business’s data is kept apart twice: by the application, and again by row-level security in the database.
• Our operators sign in with a strong password and a second factor, and our operator console can be reached only from approved networks.
• We accept messages from Meta only with a valid signature, and every connection uses TLS.
• Payment card and national ID numbers are masked as soon as they arrive. Our technical logs never contain message text, passwords or access tokens.
• Backups are encrypted before they are written anywhere, and every month we restore the newest one and check it against what it should hold.

Our website and services are for businesses. We do not knowingly collect personal data from children under 13 on this website, and we delete it if we find we have. If a child messages a business that uses our Messaging Service, that business controls the data, and we help it act on any request.

When we change this policy, we post the new version here with a new date. We tell our clients by email before any material change takes effect.

• Email: info@ai-revo.com
• Post: AI Revo Ltd, 128 City Road, London, EC1V 2NX, United Kingdom