Privacy
What we collect, why, where it is kept and for how long, and the choices you have.
Contents
This policy explains how the person who operates Revarden while its company is being formed (“Revarden”, “we”, “us”) handles personal information when you visit revarden.com, ask us about access, create an account, subscribe, use the Revarden workspace as a member of an agency, join our waitlist or ask to partner with us.
For anything about your personal information, email hello@revarden.com. We have not appointed a data protection officer.
We decide how it is used (we are the controller) for information about website visitors, people who ask us about access, create an account, join our waitlist or ask to partner with us, the members of each agency as our users, billing, emails sent to us and security logs.
We act for the agency (we are its processor) for the records an agency keeps in its workspace: agreements, talent and brand details, amounts, dates, documents and notes. The agency decides what goes in and why; we handle it only to run Revarden for the agency, on its instructions. If an agency keeps your details (for example, as talent it represents or as a brand contact), please ask that agency first. If you write to us, we pass your request on to it.
When you visit the website
Our hosting provider, Vercel, processes standard request data such as your IP address, browser type and the pages you ask for, to deliver the site and protect it. We count page views with cookieless analytics that don’t identify you: Vercel Web Analytics counts visits, and Vercel Speed Insights measures how fast pages load. Neither sets a cookie or follows you to other sites. Web Analytics tells one visit from another with a code made from the request, which Vercel discards after 24 hours, and records the page’s address, the site that linked to it, your browser, device type and country. Speed Insights records the page, your browser, device type, network speed and country with each measurement. Neither runs on workspace pages.
How you found us
When you first open a page of revarden.com in a browser tab from outside the European Union, the European Economic Area, the United Kingdom and Switzerland, the tab keeps a note of how you arrived in its session storage, which is not a cookie and ends when the tab closes: the campaign details in the page’s address (utm_source, utm_medium, utm_campaign, utm_term and utm_content), the click identifier an ad platform adds when you click one of our ads (gclid, fbclid, ttclid, msclkid or li_fat_id), the path of that first page and the name of the site that linked to it. Nothing else from the address is kept. In those four places, and whenever your browser’s time zone is in Europe, nothing is kept on your device: a form you send carries only the details of the page it is on.
The note leaves your browser only if you create an account or ask us for access. Sent with the sign-up form, it is kept with your account until you create your first agency. It is then kept with that agency, where only the agency’s owner and Revarden can read it, and removed from your account. Sent with the access request form, it is kept with your request, where only Revarden can read it. Our events in Vercel Web Analytics carry at most the utm_source and utm_medium values and whether a click identifier was present, never the identifier itself.
When you ask us about access
- From the form: your full name, work email, agency name, role, how many talent you manage and your message.
- With each request: the date and time, a hash of your network (IP) address and, if your browser tab kept one, its note of how you found us. The address itself isn’t stored.
- If you send more than one request from the same email within 24 hours, only the first one and its message are kept.
- If the bot check is on, Cloudflare Turnstile looks at technical signals from your browser to confirm a person sent the request.
When you create an account
Your name, work email and password. The password is stored only in hashed form by our sign-in provider. Revarden never stores it. If the bot check is on, Cloudflare Turnstile looks at technical signals from your browser to confirm a person is signing up, signing in, asking for a password reset or another confirmation email, or confirming a change to their account with their password.
When you use the workspace
- The records you and your team enter, which can include names, roles, email addresses and other details of talent, brand contacts and teammates, amounts, dates, contracts and saved excerpts.
- Your agency memberships and roles, and a history of changes that records who changed a record and when.
- A daily record of your use: for each agency you belong to (never an example agency), one entry for each day, counted in UTC, saying only whether you used Revarden that day and whether you made a change in that agency’s workspace. We work it out from the sign-ins, signed-in sessions, security events and history of changes we already keep. It holds no pages, amounts, text, names or email addresses, and no one in your agency can see it.
- A few preferences kept in your browser’s local storage, such as recent search commands and the records you opened recently. They never leave your browser.
When your agency subscribes
The billing contact, billing address, tax details and subscription history. Card details go straight to our payment provider; Revarden never sees or stores full card numbers.
When you email us
Your address and what you write, kept in our Google Workspace mailbox.
When you join our waitlist or ask to partner with us
Your email address and what you tick or choose on the form and in the optional questions, kept and used as the waitlist’s own section sets out. If the bot check is on, Cloudflare Turnstile looks at technical signals from your browser to confirm a person sent the form.
To keep the service secure
Sign-in events and service logs, which include IP addresses, and error reports that record an error type and status code, never document text or questions.
For people in the European Economic Area and the United Kingdom, each use has a legal basis under the GDPR and the UK GDPR:
- To provide Revarden: creating and securing accounts, keeping each agency’s records and sending the emails the service needs (such as sign-up confirmations, password resets, invitations and billing notices). Basis: our contract with you or your agency. For workspace records, we follow the agency’s instructions.
- To answer access requests and questions: Basis: steps you ask for before a contract, and our legitimate interest in answering business inquiries.
- To bill and keep accounts: Basis: our contract and our legal duties under tax and accounting law.
- To keep Revarden secure: limiting repeated requests with hashed network addresses, checking sign-ins, sign-ups, password reset and confirmation email requests, access requests, password confirmations, waitlist sign-ups and partner requests for bots and finding errors. Basis: our legitimate interest in a secure, working service.
- To improve Revarden: with page counts, aggregated use that doesn’t identify you and the daily record of your use, which we read as counts: for each agency and across agencies, how many members on a paid seat used Revarden in a week and how many made a change, and the weeks in which any member of an agency made one. Basis: our legitimate interest in improving the service.
- To learn how agencies find Revarden: counting visits and sign-ups by campaign, and keeping how an account arrived with its first agency and how an access request arrived with the request, so we know which of our campaigns work. We don’t send it to advertising platforms; if that changes, we will update this policy first. Basis: our legitimate interest in knowing which of our marketing works.
- To meet legal duties and defend claims. Basis: legal obligation and legitimate interests.
We don’t use personal information to target advertising, don’t sell it, and don’t make decisions with legal or similar effects about anyone by automated means alone.
AI features are off for every agency. Where we have made them available to an agency, its owner can turn them on for the agency in its settings, agreeing on the agency’s behalf to what is sent, and can turn them off at any time. While AI is on, the text of each contract a member uploads is sent so that Revarden can propose the agreement, and each question a member asks about a contract is sent with that contract’s text. Tax IDs, bank account and card numbers, email addresses and phone numbers are removed before anything is sent. Turning AI off stops new requests at once; proposals and answers already saved stay in the workspace.
Requests go through Vercel AI Gateway to DeepInfra, which runs Xiaomi’s MiMo model. Each request asks for zero data retention and no training. We haven’t verified whether DeepInfra honors that request, how long it keeps what it receives or where it processes it, and no transfer mechanism of ours covers it. We won’t make AI available to any agency until we have checked these points and a transfer mechanism is in place. We never use agency records to train AI models.
Where we have turned it on for an agency, a member can import a PDF or text file from Google Drive into an agreement. Revarden asks for Google’s “drive.file” permission, which covers only the files you choose in Google’s file picker.
- What we access: the name, type and size of the file you choose, and its contents, to save it as a document on the agreement you picked. Nothing else in your Google account.
- How we keep it: the imported file is stored in your agency’s private storage like any uploaded document. Google’s access token is kept only in an encrypted cookie for up to 10 minutes, with no long-term access; we don’t store your Google account ID or the file’s Google ID.
- Who sees it: the members of your agency. We share Google user data with no one else except our hosting provider, Vercel, whose servers fetch the file from Google for us; our storage provider, to keep the file; and GitHub, whose servers it can pass through when we copy or move our database and stored documents; or when the law requires it. We don’t use it for advertising, and don’t use it to develop, improve or train generalized AI or machine learning models. People at Revarden read it only with your permission for support, or where security or the law requires it.
- Stopping access: disconnect in Revarden, which asks Google to revoke our access, or remove Revarden from your Google Account’s third-party access page.
Revarden’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- The creator waitlist. If you join the waitlist for Revarden for creators, we keep your email address, the boxes you ticked (that you are 18 or older; your consent, when you gave it and the version of its words; and the optional answers about a manager, an agency and being paid by a brand), how you reached the page (campaign tags and the referring site, not for visitors from the European Union, the European Economic Area, the United Kingdom or Switzerland), the country of the request that confirmed your address (never its network address) and a hash of your network address for 30 days. We use it to confirm your address, to send the emails you agreed to (one when it opens and at most 2 short emails about this test), to limit repeated sign-ups (the hash) and to count sign-ups across everyone by country, campaign and answer. Basis: your consent for the emails, which you withdraw by unsubscribing; our legitimate interest in a secure service for the hash and the bot check, and in knowing which of our marketing works and what to build for the counts. Unconfirmed sign-ups are deleted after 14 days, and the whole waitlist by December 31, 2026. Every email has a one-click unsubscribe.
- A few questions. The questions after you confirm are optional. We keep your answers with your waitlist sign-up and delete them with it by December 31, 2026. We read them as totals across everyone, not one by one. A box you tick there (done-for-you bookkeeping and tax filing, and a paid research form when we offer one) is its own consent, for that one thing, and ends when you unsubscribe. We use your answers, as totals, to decide what to build. Basis: our legitimate interest in knowing what to build, as for the waitlist’s counts; the emails a box names rest on that box’s consent.
- Partner requests. If you ask to partner with Revarden, we keep your email address, that you are 18 or older, your consent, when you gave it and the version of its words, the one choice you made and, as for the waitlist, how you reached the page (not for visitors from the European Union, the European Economic Area, the United Kingdom or Switzerland), the country of the request that confirmed it (never its network address) and a hash of your network address for 30 days. We use them to confirm your request, to reply about the partner program, to limit repeated requests (the hash) and to count requests across everyone by country, campaign and choice. Basis: your consent for confirming and replying, which you withdraw by unsubscribing; for the hash, the bot check and the counts, our legitimate interests, as for the waitlist. We email you a link to confirm your request, and one new link if you ask for it; any reply comes from a person. Unconfirmed requests are deleted after 14 days, and every request by December 31, 2026.
- Counts. We also count, by the hour, visits to the waitlist and partner pages, sign-ups and partner requests, confirmations, saved pages of the questions and unsubscribes. A visit is counted with the campaign tags of its address and the site that linked to it, wherever you are; the rest with how you reached the page, as your sign-up or request keeps it. No count carries your email address, network address or answers. Basis: our legitimate interest in knowing which of our marketing works.
- Who reads it. Only counts are read by anyone but the founder; no AI system reads a waitlist sign-up, an answer or a partner request.
- Your rights. To see or delete what we keep about you, or to use any other right in Your rights, including to object to the counts, write to hello@revarden.com from the address you signed up with. Unsubscribing stops the emails but doesn’t delete your sign-up: ask us and we delete it.
- Access requests: up to 12 months after our last reply, then deleted. Hashes of network addresses more than 30 days old are cleared whenever a new request arrives.
- Waitlist sign-ups and partner requests: unconfirmed ones 14 days after sign-up, the hash of the network address after 30 days, and every one, with its answers, by December 31, 2026.
- Accounts: while the account exists, and deleted within 30 days after it is closed, except what we must keep by law.
- Daily record of use: while your account exists, also after you leave an agency, and deleted with the account.
- Workspace records: while the agency uses Revarden. When an agency stops using it, members can still export its records for at least 30 days, and we delete them within 30 days of the owner asking.
- Backups: deleted records leave our backups within 30 days.
- Billing records: as long as tax and accounting law requires, usually six years.
- Emails to us: up to 24 months after the last message, unless we need them for a legal claim.
- Service logs and error reports: kept by our providers for short periods, up to 90 days.
- Security events: at least 24 months. The database refuses to delete them sooner, and after that they aren’t deleted automatically. Each records the person, what happened (such as a sign-in, a change of role or an export) and the network the request came from, never the full IP address, an email address or document text.
- AI request log: at least 24 months. The database refuses to delete entries sooner, and after that they aren’t deleted automatically. Each entry records who made the request, when, the feature and the credits used, never contract text.
- How you found us: in your browser tab until it closes. If you create an account, with the account until you create your first agency, then with that agency for as long as its records, and deleted with them. If you ask us for access, with your request, and deleted with it. If you join our waitlist or ask to partner with us, with your sign-up, and deleted with it.
- Page views and page speed: kept by Vercel as counts that don’t identify you.
If you are in the European Economic Area or the United Kingdom, you can ask us for access to your personal information, to correct or delete it, to restrict or object to how we use it, or to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time.
Email hello@revarden.com from the address you use with Revarden. We may need to confirm it is you, and we reply within one month. For records an agency keeps about you, we help that agency answer. Agency owners can export their records as CSV files at any time and ask us to delete them.
You can also complain to a data protection authority: in Spain, the Agencia Española de Protección de Datos; in the United Kingdom, the Information Commissioner’s Office; or the authority where you live or work.
In the last 12 months we have collected these categories of personal information: identifiers (such as name, email and IP address), professional details (agency name and role), commercial information (subscription and billing history, once billing is open), internet activity (pages visited, how you arrived at our website and service logs) and the contents of the records agencies keep in Revarden, which we hold for those agencies. We get it from you, from your agency and from your browser, and use it for the purposes in How we use it and why. If you join our waitlist, we also collect the answers you choose to give about how you heard of us, a manager or agency, how brands pay you and how you handle your books and taxes, with amounts only in bands, and the country your confirmation came from; if you ask to partner with us, the kind of partner you are and that country.
We don’t sell personal information, don’t share it for cross-context behavioral advertising and don’t use sensitive personal information to infer anything about you. We don’t knowingly collect personal information directly from anyone under 16. An agency’s records may include talent under 18; we hold those records only for that agency, on its instructions, and never sell or share them.
Depending on your state (for example California, Colorado, Connecticut, Virginia or Texas), you may have the right to know what we hold about you and get a copy, to correct or delete it, and to opt out of its sale, sharing or use for targeted advertising (we do none of these). We won’t treat you differently for using these rights. Email hello@revarden.com to use them, yourself or through an authorized agent; we will confirm your identity first. If we turn down your request, you can appeal by replying to our answer, and then contact your state attorney general if you disagree with the outcome.
Workspace records, documents and account details are stored in London, United Kingdom. The website and workspace run on Vercel’s global network, and some of our providers handle data in the United States and other countries.
When personal information leaves the European Economic Area or the United Kingdom, each provider’s own published terms name the transfer mechanism for its part: Standard Contractual Clauses with the UK Addendum for Supabase, whose contracting company is in Singapore; those Clauses, and the EU-US Data Privacy Framework with its UK Extension, for Vercel; and that Framework with its UK Extension for the others. We have not yet confirmed that each applies to our account.
Each agency’s records are kept apart in the database itself, documents sit in private storage, and every read and change is checked against the person’s role. The security page describes these measures and lists the ones not in place.
Revarden is a service for businesses and isn’t meant for anyone under 18. If an agency’s records include talent under 18, the agency is responsible for having the right to keep them, and we process those records only on its instructions.
When we change this policy, we update the date at the top. If a change affects how we use information we already hold, we tell agency owners, and the people on our waitlist or who asked to partner with us, by email before it takes effect.
Questions and requests about privacy go to hello@revarden.com. To have an access request deleted, email us from the address you used.