Privacy Policy
We believe in transparent data stewardship. Your documents, conversations, and customer records belong entirely to you.
Zero Model Training
Your uploaded documents, customer chats, and custom prompts are never used to train public foundation models.
End-to-End Encryption
TLS 1.3 transit encryption and AES-256 encrypted database storage for all stored conversations and API secrets.
GDPR & CCPA Compliant
Full rights to access, export, correct, and permanently delete your organization and visitor conversation data.
Isolated Vector Stores
Tenant-isolated vector collections prevent cross-organization document leakage or unauthorized access.
Jump to Section (Table of Contents)▼
1. Introduction & Overview
At RevoChat AI ("RevoChat", "we", "us", or "our"), we respect your privacy and are committed to protecting the personal information you share with us. This Privacy Policy explains how we collect, use, disclose, and safeguard your data when you visit our website at revochat.io, use our SaaS dashboard, deploy our embeddable chatbot widgets, or communicate through our multi-channel AI integrations.
By accessing or using our Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our data practices, please discontinue use of the platform.
2. Information We Collect
We collect information in three primary categories:
A. Account & Billing Information
When you register or upgrade, we collect your name, email address, password hash (bcrypt), organization name, billing address, and transaction identifiers. Complete payment card numbers are processed directly by PCI-DSS certified payment processors (Razorpay / Stripe) and never stored on our application servers.
B. Knowledge Base & Training Content
Documents, website URLs, PDFs, FAQs, system prompts, and custom tool parameters uploaded to customize your chatbot agents. These are transformed into numerical vector embeddings for retrieval during customer conversations.
C. Visitor Telemetry & Chat Logs
When end-users interact with your deployed widgets, we record the message queries, bot responses, timestamps, browser user-agent, anonymous session identifiers, and IP addresses (used strictly for rate limiting, DDoS prevention, and geolocation analytics).
3. How We Use Your Information
We process personal data for legitimate business operations and service execution:
- To provide, maintain, and execute real-time AI conversation and widget services.
- To retrieve contextually relevant knowledge base documents via our RAG semantic pipeline.
- To manage user authentication, MFA security, session renewal, and organization permissions.
- To process billing renewals, invoice generation, and prevent subscription fraud.
- To monitor system uptime, detect anomalies, block brute-force attacks, and uphold platform safety.
- To send transactional emails (OTP codes, password resets, critical service updates).
4. AI Privacy & Model Training Isolation
RevoChat AI does NOT sell your data, nor do we allow third-party foundation model vendors to use your proprietary knowledge documents, customer chat history, or personal data to train or fine-tune public AI models. All inference requests are executed via enterprise zero-retention API agreements.
Vector embeddings created from your documents are segregated by unique organization identifiers and stored securely with strict database access controls.
6. Sub-Processors & Infrastructure Partners
To provide high-availability SaaS infrastructure, RevoChat partners with certified cloud providers:
MongoDB Atlas
Encrypted multi-region database storage and automated backups.
Razorpay & Stripe
PCI-DSS Level 1 certified payment billing gateways.
AI Inference Providers (OpenAI, Groq, Google)
Enterprise API partners executing real-time LLM inference without data training.
Cloud & CDN Hosting
DDoS mitigation, static asset edge caching, and server compute nodes.
7. Your Privacy Rights (GDPR, CCPA & DPDP)
Depending on your location, you hold legal rights regarding your personal information:
- Right of Access: Request a copy of all personal records and chat transcripts stored under your account.
- Right to Rectification: Update or correct inaccurate profile, billing, or knowledge base details.
- Right to Erasure ("Right to be Forgotten"): Request immediate and permanent deletion of your organization, documents, and chat records.
- Right to Data Portability: Export conversation transcripts and lead captures in standard JSON/CSV formats.
To exercise any of these rights, contact our Data Protection Officer at privacy@revochat.io. Requests are addressed within 30 days.
8. Data Retention & Deletion
We retain account information for as long as your account remains active. If you delete your account or an agent workspace:
- Your chatbot settings, documents, vectors, and chat history are purged from active primary databases immediately.
- Automated encrypted backups are overwritten on a rolling 30-day retention schedule.
- Financial transaction records are preserved as mandated by applicable tax and accounting laws in India.
9. Information Security Safeguards
RevoChat employs industry-standard administrative, physical, and technical defenses:
- Strict Content Security Policy (CSP) blocking unauthorized external script injections.
- Token bucket rate limiting defending against brute-force password and credential guessing.
- Mandatory cryptographic double-submit verification for sensitive state-changing requests.
- Automated dependency vulnerability audits and zero-trust internal network rules.
10. Contact Our Privacy Officer
If you have questions about this Privacy Policy or wish to lodge a privacy request, reach out directly:
Privacy & Compliance
Data Protection Officer
Email: privacy@revochat.io / info@revochat.io
Questions about data protection?
We are happy to provide Data Processing Addendums (DPA) for enterprise teams.