Privacy Policy

1. Information We Collect

1.1 Information You Provide

• Account Information: Name, email address, phone number, company name, job title, and password when you create an account
• Company & Billing Information: Company address, tax ID, billing address, and payment information (processed and stored by Stripe — we do not store full credit card numbers)
• Business Data: Customer records, contact information, job/work order details, project information, invoices, estimates, contracts, and notes you enter into the Service
• Photos & Documents: Construction photos, project documentation, inspection records, and other files you upload
• Communications: Messages sent through the in-app team chat feature, support requests, and any other communications with us

1.2 Information Collected Automatically

• Usage Data: Pages visited, features used, actions taken, time spent, click patterns, and search queries within the Service
• Device Information: Device type, operating system, browser type, screen resolution, and unique device identifiers
• Log Data: IP address, access times, referring URLs, and error logs
• Location Data: Approximate location derived from IP address. The mobile app may collect precise location data if you grant permission, for features such as job site check-in
• Cookies & Similar Technologies: We use cookies, local storage, and similar technologies as described in Section 8

1.3 Information from Third Parties

• Authentication Providers: If you sign up or log in using Google or another third-party provider, we receive your name, email, and profile picture from that provider
• Payment Processor: Stripe provides us with limited payment information such as the last four digits of your card, card brand, and billing address for record-keeping purposes

2. How We Use Your Information

We use the information we collect for the following purposes:

• Provide the Service: To operate, maintain, and deliver the features of the Service, including storing and displaying your business data, processing photos, generating invoices, and facilitating team communication
• Billing & Payments: To process subscription payments, manage your account, and send invoices and receipts
• Customer Support: To respond to your inquiries, troubleshoot issues, and provide technical assistance
• Improve the Service: To analyze usage patterns, identify bugs, and develop new features and improvements
• AI Features: To power AI-assisted features such as photo categorization, with your data processed only for your benefit and not shared across tenants
• Communications: To send you service-related notifications, updates, security alerts, and (with your consent) marketing communications
• Security: To detect, prevent, and address fraud, abuse, security issues, and technical problems
• Legal Compliance: To comply with applicable laws, regulations, and legal processes

3. How We Store & Protect Your Data

3.1 Infrastructure. Your data is stored using Supabase (PostgreSQL database) and Amazon Web Services (AWS) for file storage. Our infrastructure is hosted in secure, SOC 2-compliant data centers in the United States.

3.2 Encryption. All data is encrypted in transit using TLS 1.2 or higher. Data at rest is encrypted using AES-256 encryption or equivalent industry-standard methods.

3.3 Access Controls. We implement role-based access controls, multi-tenant data isolation via row-level security (RLS), and the principle of least privilege for internal access to production systems.

3.4 Security Measures. We employ industry-standard security measures including firewalls, intrusion detection, regular security assessments, and secure development practices. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

4. Data Sharing & Disclosure

We do not sell, rent, or trade your personal information to third parties.

We may share your information only in the following circumstances:

• Service Providers: We share data with trusted third-party service providers who assist us in operating the Service:
  • Stripe — payment processing and subscription management
  • Supabase — database hosting, authentication, and real-time features
  • Amazon Web Services — cloud infrastructure and file storage
  • Google — authentication services
  These providers are contractually obligated to use your data only to provide services to us and in accordance with this Privacy Policy.
• Legal Requirements: We may disclose your information if required by law, subpoena, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others
• Business Transfers: In the event of a merger, acquisition, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of the transaction. We will notify you of any such change
• With Your Consent: We may share your information with your explicit consent for purposes not described in this Privacy Policy

5. Data Retention

• Active Accounts: We retain your data for as long as your account is active and as needed to provide the Service
• Cancelled Accounts: Upon cancellation, your data is retained for thirty (30) days to allow for data export. After 30 days, all data is permanently deleted from our active systems
• Backups: Deleted data may persist in encrypted backups for up to an additional 30 days before being permanently removed
• Legal Obligations: We may retain certain information as required by law, such as billing records for tax and accounting purposes

6. Your Rights & Choices

You have the following rights regarding your personal information:

• Access: You may request a copy of the personal information we hold about you
• Correction: You may update or correct your information through your account settings or by contacting us
• Export: You may export your data at any time using the tools provided in the Service or by contacting support@revolvecore.com
• Deletion: You may request deletion of your account and associated data by contacting support@revolvecore.com. Deletion will be completed within 30 days of your request
• Opt-Out: You may opt out of marketing communications at any time by clicking the "unsubscribe" link in any marketing email or by contacting us

To exercise any of these rights, contact us at support@revolvecore.com.

7. Multi-Tenant Data Isolation

RevolveCore is a multi-tenant platform. Each company's data is logically separated using unique company identifiers and row-level security (RLS) policies at the database level. Your data is never accessible to other companies on the platform. Our employees access production data only when necessary for support or troubleshooting purposes, and such access is logged and audited.

8. Cookies & Tracking Technologies

We use the following types of cookies and similar technologies:

• Essential Cookies: Required for the Service to function, including authentication and session management
• Analytics Cookies: Help us understand how you use the Service so we can improve it. We may use tools such as Google Analytics or similar services
• Preference Cookies: Remember your settings and preferences (e.g., dark mode, language)

We do not use advertising or tracking cookies. You can control cookies through your browser settings, but disabling essential cookies may prevent the Service from functioning properly.

9. Children's Privacy

The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from individuals under 18. If we learn that we have collected personal information from a person under 18, we will promptly delete that information. If you believe we have collected information from a minor, please contact us immediately at support@revolvecore.com.

10. California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request information about the categories and specific pieces of personal information we have collected about you, the purposes for collection, and the categories of third parties with whom we share it
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions
• Right to Opt-Out of Sale: We do not sell your personal information. As such, we do not offer an opt-out of sale mechanism
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights
• Right to Correct: You have the right to request correction of inaccurate personal information

To exercise your CCPA rights, contact us at support@revolvecore.com. We will respond to verifiable consumer requests within 45 days.

Do Not Sell or Share My Personal Information: We do not sell or share your personal information as defined by the CCPA/CPRA.

11. European Residents (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• Legal Basis: We process your personal data based on: (a) your consent; (b) the necessity to perform our contract with you; (c) our legitimate business interests; or (d) compliance with legal obligations
• Right of Access: You may request access to your personal data
• Right to Rectification: You may request correction of inaccurate data
• Right to Erasure: You may request deletion of your personal data
• Right to Restriction: You may request restriction of processing
• Right to Data Portability: You may request a copy of your data in a structured, machine-readable format
• Right to Object: You may object to processing based on legitimate interests
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time

International Transfers: Your data is processed and stored in the United States. By using the Service, you consent to the transfer of your data to the United States. We implement appropriate safeguards for international data transfers.

You may also lodge a complaint with your local data protection authority.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and/or by posting a notice within the Service at least thirty (30) days before the changes take effect. Your continued use of the Service after the changes become effective constitutes your acceptance of the updated Privacy Policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: