We collect information you give us, data we generate on your behalf, and data produced as you use our service. We use it to deliver marketing intelligence outputs, improve our systems over time, and run our business. We do not sell your data. Anonymised and aggregated signals,stripped of anything that could identify you or your brand,power the Collaborative Intelligence Network that makes every client's recommendations smarter over time. Network participation is a condition of the Service. Clients with documented regulatory obligations may request a Compliance Quarantine accommodation. Read Sections 5, 6, and 7 for the full picture.
RevFlowLab ("we," "us," or "our") operates the website at revflowlab.com and the RevFlowLab Marketing Operating System (collectively, the "Service"). We are the data controller for personal information collected through the Service. RevFlowLab is operated by Friaa Creativity SUARL, a company registered in Tunisia. Where we process personal data on behalf of a client (for example, their customer or subscriber data), we act as a processor under the Data Processing Agreement.
For all privacy-related matters, contact us at badis@revflowlab.com. We will respond within 30 days of any verified request.
As part of our own business development, we may process publicly available business contact information (such as a company name, website, and a publicly listed business email) to identify organisations that may benefit from the Service and to send relevant business-to-business communications, on the basis of our legitimate interest. We do not buy or sell personal-data lists. This activity is part of our own operations and is entirely separate from the Service we provide to clients. To opt out, email badis@revflowlab.com and we will remove your information promptly.
When you connect an email sending account (through Google/Gmail authorization or SMTP credentials), we collect and store, in encrypted form, the access tokens or credentials required to operate the sending features you use. For accounts connected through Gmail, the access you grant covers sending messages on your behalf and reading messages for the limited purpose of detecting and classifying replies to your campaigns, so follow-ups can be paused and responses surfaced to you. We do not move, delete, label, archive, or send mail from your mailbox other than the campaigns you create, and we do not exchange messages with other users' mailboxes. We also process sending and deliverability data such as send, open, click, bounce, reply, and complaint rates and sender and domain health.
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Delivering the Service | Brand materials, account info, all generated outputs | Contract performance |
| Connected account sending & reply tracking | Encrypted OAuth tokens or SMTP credentials, outbound message content, inbound reply metadata, deliverability metrics | Contract performance |
| Brand diagnostics & audits | Brand URL, submitted materials, market data | Contract performance |
| Competitive & market intelligence | Competitor URLs you provide; publicly accessible web data | Contract performance |
| Search & content intelligence (Tier 2) | Target keywords, niche data, publicly available search results | Contract performance |
| Improving AI output quality | Anonymised, aggregated correction & performance signals | Legitimate interest |
| Cross-client intelligence (see §5) | Anonymised niche-level engagement patterns | Legitimate interest / Consent |
| Billing & account management | Payment data, contact info | Contract performance |
| Customer support & onboarding | Communications, usage data | Legitimate interest |
| Security & fraud prevention | IP address, device data, usage logs | Legitimate interest |
| Our own business development (B2B) | Publicly available business contact information | Legitimate interest |
| Sending marketing communications | Email address, engagement history | Consent |
A core component of the Service involves collecting and analysing publicly accessible information on your behalf. This includes publicly visible web pages, publicly available search engine results, and publicly accessible competitor content. We do this only when you direct us to.
We collect only publicly accessible information - content that any member of the public could access without authentication. We do not access private systems, bypass access controls, or collect information from pages requiring login. You are responsible for ensuring that any URLs or domains you submit to us are ones you have a legitimate interest in analysing.
A core feature of RevFlowLab is a shared intelligence layer that makes the system smarter over time and across clients. To power this, we use two categories of data:
Aggregated, anonymised signals derived from campaign performance across clients in the same market niche - for example, that a particular type of message structure performs above average in a given product category. Your brand name, copy assets, and any identifying information are never included in these aggregates.
When our operators review and correct AI-generated drafts, those corrections - including the nature of the error and how it was fixed - are logged and used as training signal to improve the quality of future outputs across the system. This data is stripped of any brand-identifying context before being used in system improvement.
Your brand identity, specific copy assets, proprietary brand materials, and competitive positioning are never shared with, visible to, or attributable to any other client. Only statistical patterns,stripped of all identifying context and aggregated across a minimum of three clients before any value is written,contribute to the shared intelligence layer.
Network participation is the default and a condition of the Service. The network is how the platform functions,every client that participates contributes anonymised patterns and receives the benefit of all other clients' intelligence. Clients with documented regulatory obligations requiring data isolation may request a Compliance Quarantine accommodation,see Section 7.
When you use Native Sending, we help protect your inbox placement and track campaign responses. To do this we (a) ramp sending volume gradually on newly connected senders and domains, (b) process standard delivery signals such as bounces and spam complaints to score sender health, and (c) for accounts connected through Gmail, read messages in your connected mailbox solely to detect and classify replies to the campaigns you send. We do not operate a peer message-exchange network, and we do not move, label, archive, reply to, or otherwise act on the mail in your mailbox beyond the campaigns you create.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Gmail access solely to send the messages you compose and schedule and to detect replies to your campaigns. We do not use Google user data for advertising, and we do not sell it.
Connected social accounts (Meta / Instagram, TikTok, X). If — and only if — you choose to connect a social account, we access that platform strictly to act on your behalf: to publish the content you approve and to read back the resulting reach and engagement metrics so you can measure performance. We request the narrowest permissions needed for that, we do not post without your direction, and we do not use your social data to train models or for advertising. You can disconnect an account at any time in your settings, which revokes our access going forward; to request deletion of platform data we hold, see Data Deletion. These integrations are being brought online in stages — where a platform is not yet enabled, no data flows to or from it.
Clients with documented regulatory obligations (for example, GLBA, HIPAA, or legal privilege constraints) may request a Compliance Quarantine accommodation. This replaces what was previously referred to as "Private Vault Mode." It is a regulatory accommodation, not a paid feature or a general privacy option.
Under quarantine, your account data does not contribute to the cross-client intelligence network, and your account does not receive cross-client recommendations. Drafts are generated from your own edit history only. Recommendation quality is reduced,this is disclosed at onboarding. Quarantine must be requested in writing with documentation of the regulatory obligation. Email badis@revflowlab.com with subject "Compliance Quarantine Request".
Note: quarantine affects aggregation pipeline participation only. Your data is stored in the same infrastructure as all other clients. If your compliance requirement specifies physical data isolation beyond aggregation exclusion, contact us to discuss whether the Service can accommodate your specific requirement before subscribing.
We work with the third-party service providers below to operate — and, in some cases, to bring online — the RevFlowLab service. All are bound by confidentiality obligations and data processing terms. Because we are launching in stages, some providers below are still being integrated: where that is the case, data only ever flows to that provider once the relevant feature is activated for your account, and a provider processes data solely for the purpose stated. This is our current subprocessor list; before we add or replace a subprocessor that processes client personal data, we update this list, and clients with an active Data Processing Agreement may ask to be notified of changes.
| Provider / Service | What They Process | Purpose |
|---|---|---|
| Anthropic | Brand context, project briefs, and draft content (no payment data) | AI-assisted text generation, analysis, and quality scoring |
| AI image & video generation provider | Prompts and brand creative inputs you submit for image or video generation | Generating visual marketing assets (current provider named on request) |
| Supabase | Account data, brand materials, generated outputs, system logs | Database, authentication, and application data storage |
| Vercel | Application requests and technical logs | Web application hosting and delivery |
| Google (Gmail API) | Connected account send credentials, outbound message content, inbound reply metadata | Sending email on your behalf and detecting replies to your campaigns |
| Amazon Web Services (SES) | Recipient address, message content | Managed email delivery |
| Resend | Recipient address, message content | Transactional and native email delivery |
| Payment provider (Merchant of Record) | Billing and payment information, buyer contact details | Subscription billing, sales tax/VAT, and payment processing |
| Meta Platforms (Facebook / Instagram) | Only if you connect a Meta account: account identifiers, the content you choose to publish, and the resulting reach/engagement metrics | Publishing to and measuring your connected Facebook/Instagram accounts, at your direction |
| TikTok | Only if you connect a TikTok account: account identifiers, the content you choose to publish, and the resulting engagement metrics | Publishing to and measuring your connected TikTok account, at your direction |
| X (formerly Twitter) | Only if you connect an X account: account identifiers, the content you choose to publish, and the resulting engagement metrics | Publishing to and measuring your connected X account, at your direction |
Our AI providers are contractually prohibited from using your data to train their own models. Separately, our own business-development outreach (Section 2.4) processes only publicly available business contact data under legitimate interest, never client account data.
You can ask us to delete your personal data and close your account at any time by emailing badis@revflowlab.com with subject line "Delete My Data". On a verified request we delete your account, personal data, brand materials, generated assets, and any connected-account credentials within 30 days, except for the limited records we must retain to meet a legal, tax, or accounting obligation.
Anonymised, aggregated statistical patterns derived from corrections and performance signals that have already been incorporated into the system's learning models cannot be individually identified, isolated, or extracted, and so cannot be deleted on a per-account basis. This data contains nothing that identifies you or your brand and is retained as part of the system's learning infrastructure. Closing your account stops any further contribution to it.
If you connected a social account (for example, Instagram or Facebook), you can also trigger deletion of that connection's data through the provider's app settings; our data-deletion endpoint handles those provider-initiated requests automatically.
We do not sell, rent, or trade your personal data. We share information only in the following circumstances:
Depending on your location, you may have the following rights. To exercise any of these, email badis@revflowlab.com with subject line "Privacy Request".
Our infrastructure and third-party processors may be located outside your country of residence. Where required by law (for example, for transfers from the UK or EU), we implement appropriate safeguards such as Standard Contractual Clauses.
We implement industry-standard security measures including encryption in transit (TLS), access controls, and regular security reviews. No system is completely immune to risk. If you suspect any unauthorised access, notify us immediately at badis@revflowlab.com.
The Service is not directed to individuals under the age of 16. We do not knowingly collect data from children.
We may update this Privacy Policy from time to time. Material changes will be communicated by email or via a prominent notice on our website, with at least 14 days' notice before taking effect.
Data Request - "Privacy Request"
Account Deletion - "Delete My Data"
Opt-Out - "Intelligence Opt-Out"
Outreach Removal - "Remove Me"