Privacy Policy

1. Who we are

RevealyAI ("we", "our", "us") is a SaaS platform that helps businesses and founders validate their work by reaching ideal prospects, running surveys and interviews, using AI-powered tools. Our service is accessible at revealyai.com. RevealyAI is established in Switzerland.

We process personal data under the Swiss Federal Act on Data Protection (revFADP) and, where we target or monitor people in the European Economic Area, under the GDPR. Where this policy cites GDPR articles, the equivalent revFADP provisions apply in parallel.

For all privacy matters, including data subject requests: info@revealyai.com. We respond within 30 days.

2. Two kinds of people are covered by this policy

This is important, so we state it upfront. RevealyAI processes personal data about:

• Users: people who create a RevealyAI account and use the platform.
• Prospects and participants: people who never signed up for RevealyAI, but whose professional contact data is discovered through the platform, or who take part in a survey or interview. Section 5 is written specifically for you.

3. Data we collect from users

• Account data: name, email address, password (hashed via Supabase Auth).
• Your work & sectors: content you enter into RevealyAI to generate prospect lists.
• Email integration: if you connect Gmail or Outlook, we access your inbox only to send outreach emails on your behalf and to match replies. We do not store email content beyond what is necessary for the sending and reply-tracking workflow.
• LinkedIn integration: via Unipile, we access LinkedIn messaging to send connection requests and messages. We do not store private LinkedIn conversations unrelated to your outreach.
• Billing data: payment is handled by Stripe. We never store your full card number. Stripe processes it directly.
• Usage data: pages visited, features used, and errors, collected in aggregate for product improvement and debugging.

4. Data we collect about prospects

When you describe your work, RevealyAI discovers people who may be relevant to talk to. To do that we collect and process the following categories of personal data about them:

• Identity and role: name, job title, employer, professional location.
• Professional contact details: business email address (discovered via Hunter.io), LinkedIn profile URL.
• Public community activity: publicly visible Reddit posts, comments and subreddit membership, used to identify relevant communities and tailor outreach.
• Outreach history: messages sent to them through the platform and their replies.

These data are obtained from public or professional sources and from third-party providers, not from the individuals themselves. We process them on the basis of legitimate interest (Art. 6(1)(f) GDPR) in enabling business-to-business professional outreach, having balanced that interest against the rights and freedoms of the people concerned. We do not collect special categories of data, and we do not use this data for automated decisions producing legal effects.

5. If you were contacted through RevealyAI

This section is your notice under Article 14 GDPR and art. 19 revFADP, which apply when personal data is collected from a source other than you.

• Who is processing your data: RevealyAI, together with the customer who contacted you. That customer decides who to contact and what to say.
• What we hold: the categories listed in section 4.
• Where it came from: publicly accessible professional sources, LinkedIn, Reddit, and the email-discovery provider Hunter.io.
• Why: to allow a professional to contact you about work relevant to your role.
• How long: see section 9.

You can object at any time, and we will stop processing your data unless we have compelling legitimate grounds that override your interests. You can also request access, rectification, or erasure. Email info@revealyai.com (no account is required and we will not ask you to create one). We aim to action opt-out requests within 72 hours and confirm within 30 days.

6. Interviews: recording and transcription

RevealyAI runs live video interviews through Daily.co. If you take part in an interview:

• The session may be recorded. Recording only starts after you have been informed and have given your explicit consent at the start of the session.
• The audio is transcribed automatically using OpenAI Whisper, and the transcript is analysed by AI to summarise findings for the customer running the interview.
• You may decline recording, or withdraw consent at any point, including after the interview. Withdrawing consent means the recording and its transcript are deleted.
• Recordings and transcripts are accessible to the customer who ran the interview and to RevealyAI staff strictly where needed for support or debugging.

To have a recording deleted, email info@revealyai.com with the approximate date and time of the interview.

7. How we use data, and AI training

• Provide and improve the RevealyAI service.
• Identify relevant sectors, contacts and communities for your work.
• Draft and send outreach emails and LinkedIn messages on your behalf.
• Run surveys and interviews, and summarise the results.
• Process payments and manage your subscription.
• Send transactional emails (receipts, account notifications).
• Comply with legal obligations.

We do not sell your data. We do not use your content, your prospect data, or interview recordings and transcripts to train our own AI models. Content sent to OpenAI is processed through their API, which, under OpenAI's API data usage policy, is not used to train their models either.

AI output is probabilistic: generated contact matches, drafted messages and interview summaries may contain inaccuracies. Review AI-generated content before you rely on it or send it.

8. Legal bases for processing

9. Data retention

If you cancel your subscription, a 7-day grace period applies during which your data stays readable and exportable. After that, account data is permanently deleted.

10. Our role, and data processing agreements

For the personal data you enter and the outreach you choose to send, you are the data controller and RevealyAI acts as your processor: we process that data on your documented instructions. For our own discovery and enrichment of prospect data, and for operating and securing the platform, RevealyAI acts as controller.

A Data Processing Agreement incorporating the Standard Contractual Clauses, with the Swiss adaptations recognised by the FDPIC, is available on request at info@revealyai.com. As a customer, you are responsible for having a lawful basis for the outreach you send and for complying with applicable marketing and data protection law in your jurisdiction.

11. Sub-processors

RevealyAI uses the following sub-processors:

12. International transfers

RevealyAI is established in Switzerland, which the European Commission recognises as providing an adequate level of data protection. Data therefore moves freely between the EEA and Switzerland.

Several of our sub-processors are established outside Switzerland and the EEA, principally in the United States. For those transfers we rely on the Standard Contractual Clauses (recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC) with the Swiss adaptations, and by the European Commission for EEA data), or on the Swiss–US and EU–US Data Privacy Frameworks where the provider is certified, together with supplementary technical measures such as encryption in transit and at rest. A copy of the relevant transfer safeguards is available on request.

13. Your rights

Under the revFADP and, where it applies, the GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Request erasure ("right to be forgotten")
• Restrict or object to processing, including objecting to outreach at any time
• Data portability
• Withdraw consent where processing is based on consent, without affecting prior processing

To exercise any of these rights, email info@revealyai.com. We will respond within 30 days. You also have the right to lodge a complaint with a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), or, if you are in the EEA, your national data protection authority.

If you are a California resident, you have the right to know, delete and correct your personal information, and to opt out of its sale or sharing. RevealyAI does not sell or share personal information as those terms are defined by the CCPA/CPRA.

14. Cookies

We use only essential cookies required for authentication and session management. We do not use advertising cookies, and we do not track you across other websites. Product usage analytics are collected in aggregate and are not used to build individual profiles.

15. Children

RevealyAI is a professional tool and is not directed to children. You must be at least 18 years old to create an account, and we do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact info@revealyai.com and we will delete it.

16. Security

All data is transmitted over HTTPS and encrypted at rest by our infrastructure providers. Database access is protected by row-level security (Supabase RLS). API endpoints are authenticated via JWT tokens. Access to production data is limited to what is necessary for operating the service. We regularly review our security practices.

In the event of a personal data breach likely to result in a high risk to the personality or fundamental rights of the people concerned, we will notify the FDPIC as soon as possible (art. 24 revFADP) and, where the GDPR applies, the competent EEA supervisory authority within 72 hours of becoming aware of it. Affected individuals are notified without undue delay where the risk to them is high.

17. Changes to this policy

We may update this policy. If changes are material, we will notify you by email or via an in-app notice at least 14 days before the change takes effect.