Privacy Policy

Who we are (data controller)

RevvWeb is operated by Revv Web LLC, which is the “data controller” responsible for your personal information under the GDPR — meaning we decide why and how it is processed. You can contact us at:

Revv Web LLC
228 Park Ave S #64669
New York, NY 10003
web@revvweb.com

We act as the controller for account and marketing data; for the website content and customer data inside sites we build or host on your behalf, we act as a “processor” following your instructions.

Information we collect

• Account info — name, email, phone, and optional company name.
• Project info — your current website URL, notes, and images you upload.
• Payment info — processed by Stripe; we never see or store your full card number.
• Usage info — pages viewed, device, browser and IP address, collected via analytics.
• Communications — emails and messages you send to support.

Legal bases for processing (GDPR)

Where the GDPR applies, we rely on the following legal grounds under Article 6 to process your personal data:

• Contract — to create your account, deliver the redesign you requested, and provide hosting and support.
• Legitimate interests — to secure our service, prevent fraud and abuse, and improve our product (balanced against your rights).
• Consent — for optional analytics and any marketing communications; you can withdraw consent at any time.
• Legal obligation — to meet tax, accounting and other legal requirements.

How we use your information

• To deliver and support the redesign and hosting you’ve requested.
• To process payments and prevent fraud.
• To send transactional emails about your project and account.
• To analyse and improve our website and service.

Who we share it with

We share information only with the categories of recipients required to operate our service, and we do not sell your personal data:

• Payment processor — Stripe (billing and fraud prevention).
• Database & authentication — Supabase.
• Hosting & infrastructure providers — to run our app and your site.
• Analytics providers — Google Analytics and PostHog (usage measurement).
• Professional advisors and authorities — where required by law.

These providers act as our processors and may only use the data to provide services to us.

International data transfers

We are based in the United States and some of our providers process data in the U.S. and other countries. Where personal data is transferred out of the EEA or UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

How long we keep it (retention)

We keep account and project data for as long as your account is active and for up to 2 years after cancellation for legal and accounting reasons, after which it is deleted or anonymised. Payment records are retained as required by law.

Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal data; to object to or restrict certain processing; and to withdraw consent. California residents have the right to know what we collect, request deletion, and not be discriminated against for exercising these rights. We do not sell or “share” personal information as defined by the CCPA.

How to exercise your rights

Email web@revvweb.com and we’ll respond within 30 days. We may need to verify your identity before acting on a request. This dedicated address is also our contact point for any privacy-related enquiries.

Right to lodge a complaint

If you’re in the EEA or UK and believe we’ve mishandled your data, you have the right to lodge a complaint with your local data protection supervisory authority. We’d appreciate the chance to address your concerns first, so please contact us before you do.

Cookies, analytics & embedded content

We use minimal first-party cookies for session login, plus analytics (Google Analytics and PostHog) to understand usage. Some pages may embed third-party content (such as Stripe’s secure payment form or social-media links); those providers may set their own cookies governed by their privacy policies. You can disable cookies in your browser at any time, though some features may stop working.

How we protect your data (security)

We apply technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS/TLS), a Content Security Policy and other hardened security headers, access controls and least-privilege permissions, optional two-factor authentication on accounts, and payment handling delegated to PCI-compliant Stripe so we never store card numbers. No method of transmission or storage is 100% secure, but we work to protect your information and review our practices regularly.

Children’s privacy

Our service is intended for businesses and is not directed to children under 16. We do not knowingly collect personal data from children.

Changes to this policy

We may update this policy from time to time. When we do, we’ll revise the “Last updated” date above and, for material changes, provide a more prominent notice.

Contact

Privacy questions: web@revvweb.com