Privacy Policy

• For Merchants and site visitors, we decide how data is used — we act as the data controller.
• For Shoppers, we process data on the Merchant’s behalf (conversations, and contact details a Shopper chooses to share). The Merchant is responsible to its Shoppers; if you are a Shopper with questions about a specific store’s practices, contact that store first. We’ll help route requests we receive.

From Merchants: account details (name, email, business name — via our sign-in provider Clerk), billing details (handled by Stripe — we never store full card numbers), product catalog and inventory data you upload or sync (including via our Shopify app), configuration (persona, branding), and support communications.

From Shoppers (on the Merchant’s behalf): conversation messages exchanged with the concierge or search, voice input converted to text in the browser (we do not receive raw audio), and contact details a Shopper voluntarily provides (for example, to be contacted about a watch). Our lead capture is consent-first: the concierge asks before storing contact details and confirms the Shopper is sharing them voluntarily.

From everyone: usage analytics (via PostHog), error and performance logs (via Sentry), and basic technical data (IP address, browser type) needed to run and secure the Service.

To provide the Service (including sending conversation context and relevant catalog data to our AI model provider to generate responses); to capture and deliver Leads to the Merchant; to bill and account for usage; to secure, support, troubleshoot, and improve the Service; and to communicate with Merchants about the Service. We do not sell personal information, and we do not use Shopper contact details to market our own products.

Conversations are processed by large language models via our AI provider (Anthropic). We do not use Merchant catalogs, conversations, or Leads to train foundation AI models, and our AI provider is configured not to train on data submitted through the Service. We may use aggregated, de-identified statistics (for example, feature usage or query volumes that identify no person, store, or catalog) to operate and improve the Service.

We share personal data only with service providers that help us run Revantex, under contracts limiting their use of it: Anthropic (AI responses), Vercel (hosting), Supabase (database/storage), Clerk (authentication), Stripe (payments), Resend (transactional email), Upstash (rate limiting), Voyage AI (search embeddings), PostHog (analytics), Sentry (error monitoring), and Shopify (for Merchants using our Shopify app). A current list is maintained at /trust. We may also disclose information if required by law, or in connection with a merger, acquisition, or reorganization of our business (including a successor entity of the Revantex business), subject to this policy.

Merchant account data is kept for the life of the account. Conversation transcripts and Leads are retained so the Merchant can use them, until the Merchant deletes them or the account closes. When an account closes, we delete or de-identify Customer Content, transcripts, and Leads within 60 days, except minimal records we must keep (for example, billing records) or data in routine encrypted backups that ages out on schedule. Unclaimed pre-provisioned demo accounts and their data are deleted after a short period.

Encryption in transit and at rest, tenant isolation with row-level security, hashed API credentials, origin-locked embeds, and least-privilege access — described in detail at /trust. No system is perfectly secure; we will notify affected Merchants of a personal-data breach as required by law.

Depending on where you live, you may have rights to access, correct, delete, or export personal information, or to object to certain processing. Merchants: contact us at privacy@revantex.com — we will respond within the time required by law. Shoppers: contact the store you interacted with (the controller of your data); we will assist Merchants in fulfilling verified requests, and if you contact us directly we will route your request to the Merchant where required. We honor rights under applicable privacy laws; we do not sell personal information or share it for cross-context behavioral advertising.

The Service is for business use and general audiences; it is not directed to children under 16, and we do not knowingly collect their data. If you believe a child has provided us personal information, contact us and we will delete it.

We are a U.S. company and data is processed in the United States. If you access the Service from outside the U.S., you understand your information is processed in the U.S.

We will post updates here and, for material changes affecting Merchants, give notice by email or in-product at least 14 days in advance.