Privacy Policy

Account data: the email, name, and organization you provide when you sign up, and authentication metadata from our identity provider (Clerk) when you use hosted sign-in. We store a salted hash of passwords for email/password accounts, never the password itself.

Operational records: submitted decision traces, source and claim metadata, belief and memory records, action-policy inputs, deterministic findings, input hashes, engine versions, and an audit log of control-plane events. Customers should not send raw credentials, secrets, or unnecessary personal data in traces. Revive validates the trace schema and limits hosted trace payloads to 2 MB.

Billing data: plan and subscription state, and a customer identifier from our payment processor (Stripe). Card details are handled by Stripe; Revive does not receive or store full card numbers.

Technical data: logs, IP addresses, and diagnostic information generated when you use the Service, used for security, rate limiting, and debugging.

We use information to provide and operate the Service (normalize decision traces, compute provenance, identify evidence risks, evaluate configured action policies, run source-removal counterfactuals, and emit reproducible reports), to secure the Service, to communicate with you about your account, and to comply with legal obligations. We do not sell your personal information.

We share data with service providers that help us run the Service, under contractual confidentiality and data-protection obligations. Current categories include: hosting and compute (Vercel), managed database (Neon/Postgres), authentication (Clerk), payments (Stripe), and AI-assisted explanation when explicitly configured. Deterministic findings and policy verdicts are not delegated to a language model. We may disclose information if required by law or to protect the rights, safety, and security of Revive and its users.

We retain account and operational data for as long as your account is active and as needed to provide the Service, then delete or anonymize it within a reasonable period unless a longer period is required by law. Audit logs may be retained longer for security and compliance. You can request deletion as described below.

We use tenant isolation with row-level security, encrypted secrets at rest, constant-time credential checks, API-key hashing, and rate limiting. No system is perfectly secure; we work to protect your data and to notify affected users of incidents as required by law.

Depending on your location, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact us at founders@revivelabs.app. We will respond within the timeframe required by applicable law. If you are in the EEA or UK, our legal bases for processing are performance of our contract with you, our legitimate interests in operating and securing the Service, and compliance with legal obligations.

We may process and store data in the United States and other countries. Where required, we rely on appropriate safeguards for cross-border transfers.

The Service is not directed to children under 16, and we do not knowingly collect their personal data.

We may update this Policy; material changes will be posted here with a new date and, where appropriate, additional notice. Questions or requests: founders@revivelabs.app.