Privacy Policy

1. Scope of This Privacy Policy

This Privacy Policy applies to information we collect when you:

• use the Revala website or application;
• create or manage a Revala account;
• use Revala’s CRM, prospecting, outreach, reporting, AI, automation, or analytics features;
• upload, enter, import, sync, generate, or store information in the Service;
• connect third-party services, including email, calendar, CRM, data, authentication, payment, or productivity tools;
• communicate with us by email, phone, form submission, support request, demo request, text message, or other electronic means;
• interact with our marketing, website, emails, cookies, analytics, or advertising technologies; or
• otherwise engage with Revala.

This Privacy Policy does not apply to privacy practices of third-party websites, applications, platforms, data providers, email providers, payment processors, or integrations that Revala does not control.

If your personal information is entered into Revala by one of our customers, such as your employer, brokerage, team, client, or another Revala user, that customer may be responsible for determining how your information is collected and used. In that case, you should contact that customer directly regarding privacy rights or questions about their use of your information.

2. Roles: Controller, Processor, Business, and Service Provider

Because Revala is a B2B SaaS platform, our privacy role depends on the context.

For account, billing, website, marketing, security, product analytics, usage, support, legal, and business operations data, Revala generally acts as an independent controller or business.

For Customer Data submitted to the Service by or on behalf of a Revala customer, Revala may act as a processor or service provider on behalf of that customer, depending on the applicable privacy law and the agreement in place.

For de-identified, aggregated, analytical, operational, security, usage, benchmarking, model evaluation, product improvement, and AI-training data, Revala may act as an independent controller or business to the extent permitted by law and by Revala’s agreements.

Nothing in this Privacy Policy limits Revala’s rights under the Terms of Service or any separate written agreement.

3. Information We Collect

We collect information in several ways: directly from you, automatically through your use of the Service, from your organization or other users, from connected third-party services, and from public or third-party sources.

3.1 Information You Provide to Us

We may collect information you provide directly, including:

• name;
• business email address;
• phone number;
• company, brokerage, owner, fund, landlord, tenant, or organization name;
• job title or role;
• account login information;
• workspace, team, and user settings;
• billing contact information;
• subscription, plan, and payment-related information;
• support requests;
• demo requests;
• feedback;
• communications with Revala;
• survey responses;
• preferences;
• marketing communication preferences; and
• any other information you choose to provide.

We do not intentionally collect full payment card numbers directly through the Service. Payment information may be processed by third-party payment processors, such as Stripe or a similar provider, subject to their own privacy and security practices.

3.2 Customer Data Entered Into the Service

When you or your organization use Revala, you may submit, upload, import, sync, generate, or store Customer Data. Customer Data may include:

• property records;
• shopping center information;
• site plans or property materials;
• tenant names;
• prospect lists;
• contact names;
• contact email addresses;
• contact phone numbers;
• company names;
• owner information;
• broker information;
• deal information;
• lead information;
• pipeline status;
• outreach history;
• email drafts;
• email replies;
• notes;
• comments;
• tasks;
• activity logs;
• call notes;
• rejection reasons;
• lease-related summaries;
• LOI-related summaries;
• attachments;
• documents;
• reports;
• AI prompts;
• AI outputs;
• automation activity; and
• related commercial real estate workflow information.

Customer Data may include personal information, business contact information, public information, proprietary business information, or confidential commercial information.

You and your organization are responsible for ensuring you have all rights, permissions, notices, and lawful bases necessary to provide Customer Data to Revala and to allow Revala to process it as described in this Privacy Policy and the Terms of Service.

3.3 AI Inputs, Outputs, and Automation Data

If you use Revala’s AI, automation, classification, summarization, prospecting, enrichment, outreach, or recommendation features, we may collect and process:

• prompts;
• queries;
• instructions;
• uploaded files;
• CRM records used as context;
• outreach drafts;
• generated summaries;
• classifications;
• recommendations;
• response summaries;
• lead scoring or prioritization signals;
• system-generated notes;
• workflow decisions;
• model outputs;
• user edits to outputs;
• approval or rejection actions; and
• related usage, quality, evaluation, and performance data.

We may use this information to provide the Service, improve output quality, evaluate system performance, improve AI features, develop new features, monitor abuse, maintain security, and train, test, tune, validate, or improve models, systems, workflows, prompts, classifiers, and analytics, unless a separate written agreement or product setting states otherwise.

3.4 Information From Email, Calendar, and Other Integrations

If you connect Revala to a third-party service, such as Microsoft Outlook, Google Workspace, Gmail, calendar software, CRM software, data providers, cloud storage, authentication providers, or other tools, we may collect and process information from that service as necessary to provide the integration.

Depending on the integration and permissions you authorize, this may include:

• account identifiers;
• email address;
• calendar metadata;
• message metadata;
• message content;
• thread IDs;
• subject lines;
• sender and recipient information;
• timestamps;
• attachments;
• reply content;
• delivery status;
• authentication tokens;
• refresh tokens;
• workspace identifiers;
• contact records;
• file metadata; and
• other information made available through the integration.

For email integrations, Revala may use this information to send authorized outreach, track replies, classify responses, summarize communications, log activity, prevent duplicate outreach, support follow-up workflows, maintain audit trails, and improve the Service.

You may disconnect integrations through your account settings or the third-party provider’s settings. Disconnecting an integration may limit or disable parts of the Service.

3.5 Information Automatically Collected

When you access or use the Service, we may automatically collect:

• IP address;
• device identifiers;
• browser type;
• operating system;
• device type;
• referring and exit pages;
• pages viewed;
• features used;
• session information;
• date and time of access;
• clickstream data;
• log files;
• API usage;
• error logs;
• performance data;
• security logs;
• authentication activity;
• approximate location derived from IP address; and
• similar internet, electronic network, device, and usage information.

We use this information to operate, secure, troubleshoot, monitor, analyze, and improve the Service.

3.6 Cookies and Similar Technologies

We may use cookies, pixels, local storage, web beacons, SDKs, and similar technologies to collect information about your use of our website, application, emails, and marketing.

These technologies may be used for:

• essential functionality;
• authentication;
• security;
• remembering preferences;
• analytics;
• performance monitoring;
• product usage analysis;
• marketing attribution;
• advertising; and
• measuring the effectiveness of communications.

Some cookies are necessary to provide the Service and cannot be disabled through our systems. Other cookies may be optional, depending on your location and our cookie tools.

You can usually control cookies through your browser settings. If we provide a cookie preference tool, you may use it to manage non-essential cookies. Disabling cookies may affect Service functionality.

3.7 Information From Public and Third-Party Sources

We may collect information from public sources, commercial data providers, customers, users, partners, integrations, websites, directories, property records, business records, public filings, social media, broker materials, landlord materials, tenant materials, listing platforms, and other third-party sources.

This may include:

• business contact information;
• company information;
• property information;
• ownership information;
• tenant information;
• broker information;
• brokerage information;
• publicly available real estate data;
• market data;
• transactional context; and
• other information relevant to commercial real estate prospecting, leasing, CRM, and analytics.

We may combine this information with information collected through the Service.

4. How We Use Information

We may use information for the following purposes.

4.1 Provide and Operate the Service

We use information to:

• create and manage accounts;
• authenticate users;
• provide CRM functionality;
• manage properties, prospects, tenants, owners, contacts, deals, and activity;
• enable search, filtering, reporting, and dashboards;
• support outreach workflows;
• send authorized communications;
• log activity;
• detect replies;
• classify responses;
• generate summaries;
• support comments and collaboration;
• provide AI and automation features;
• process payments;
• manage subscriptions;
• provide support; and
• fulfill contractual obligations.

4.2 Improve, Develop, and Personalize the Service

We use information to:

• analyze product usage;
• improve workflows;
• improve AI outputs;
• develop new features;
• test functionality;
• debug errors;
• evaluate performance;
• train, tune, validate, and improve AI and machine-learning systems;
• improve classification, summarization, routing, matching, search, and recommendations;
• develop benchmarks and analytics;
• personalize the user experience; and
• improve overall Service quality.

4.3 Create De-Identified, Aggregated, and Derived Data

We may use information to create de-identified, aggregated, statistical, analytical, benchmarking, derived, operational, model-evaluation, or similar data.

We may use and retain this data for any lawful business purpose, including to:

• operate the Service;
• improve Revala;
• develop AI and machine-learning features;
• train, test, tune, and validate systems;
• create benchmarks;
• analyze commercial real estate trends;
• improve prospecting workflows;
• develop new products;
• publish or share aggregated insights;
• support business intelligence; and
• commercialize Revala’s platform intelligence.

We do not intend for de-identified or aggregated data to identify you or any individual person. We will not attempt to re-identify de-identified data except as permitted by law, such as to test whether our de-identification processes are effective.

4.4 Security, Fraud Prevention, and Abuse Monitoring

We use information to:

• secure the Service;
• detect unauthorized access;
• prevent fraud;
• prevent abuse;
• monitor suspicious activity;
• enforce permissions;
• debug security issues;
• protect against spam, scraping, credential abuse, and misuse;
• maintain audit logs;
• protect Revala, users, customers, and third parties; and
• enforce Revala’s Terms of Service.

4.5 Communications

We may use information to:

• send service announcements;
• send security alerts;
• respond to inquiries;
• provide support;
• send administrative notices;
• send billing notices;
• send product updates;
• send onboarding communications;
• send marketing communications;
• invite you to demos or product discussions; and
• otherwise communicate with you.

You may opt out of marketing emails by using the unsubscribe link in the email or contacting us. Opting out of marketing emails does not stop transactional, security, billing, support, or service-related communications.

4.6 Legal, Compliance, and Business Purposes

We may use information to:

• comply with law;
• respond to lawful requests;
• enforce contracts;
• protect rights and property;
• resolve disputes;
• collect amounts owed;
• maintain business records;
• conduct audits;
• support tax, accounting, and reporting obligations;
• evaluate corporate transactions; and
• defend against legal claims.

5. How We Use AI and Machine Learning

Revala may use artificial intelligence, machine learning, automation, large language models, embeddings, classification systems, ranking systems, and related technologies to provide and improve the Service.

This may include using information to:

• generate outreach drafts;
• summarize emails and replies;
• classify tenant responses;
• identify likely rejection reasons;
• suggest follow-ups;
• prioritize prospects;
• summarize deal activity;
• analyze properties;
• extract information from documents;
• support search and retrieval;
• generate reports;
• create internal analytics;
• evaluate output quality;
• improve prompts and workflows;
• train, tune, test, validate, and improve AI systems; and
• develop new AI-enabled features.

AI outputs may be inaccurate, incomplete, outdated, biased, duplicative, or unsuitable for your intended use. You are responsible for reviewing and verifying AI outputs before relying on them.

Revala may use Customer Data, prompts, outputs, usage data, feedback, and related information to improve, train, test, evaluate, and develop AI and automation features unless Revala has agreed otherwise in a separate written agreement or product setting.

6. How and When We Disclose Information

We may disclose information as described below.

6.1 Service Providers and Vendors

We may disclose information to service providers, vendors, contractors, and subprocessors who help us operate our business and provide the Service, including providers of:

• cloud hosting;
• database infrastructure;
• authentication;
• security;
• analytics;
• monitoring;
• customer support;
• payment processing;
• email delivery;
• communications;
• data storage;
• AI and machine-learning infrastructure;
• large language models;
• automation tools;
• error logging;
• sales operations;
• billing;
• legal;
• accounting; and
• similar business functions.

These parties are authorized to process information as needed to provide services to Revala and are expected to protect information consistent with their obligations to us.

6.2 Your Organization, Workspace, and Authorized Users

If you use the Service through an organization, workspace, brokerage, team, owner group, employer, or customer account, information may be visible to that organization’s administrators and authorized users.

Administrators may be able to:

• add or remove users;
• manage permissions;
• view activity;
• access Customer Data;
• view reports;
• export data;
• configure integrations;
• manage billing;
• review usage; and
• control the workspace.

You should not use a workspace account for personal information or activity you do not want your organization to access.

6.3 Integrations and Third-Party Services

If you connect or use a third-party service with Revala, we may disclose information to that third-party service as needed to provide the integration.

Third-party services may include:

• Microsoft;
• Google;
• email providers;
• calendar providers;
• CRM systems;
• data providers;
• payment processors;
• cloud storage providers;
• analytics tools;
• automation tools;
• authentication providers; and
• other software platforms.

Third-party services are governed by their own terms and privacy policies. Revala is not responsible for the privacy practices of third-party services.

6.4 AI and Model Providers

We may disclose information to AI infrastructure providers, model providers, embedding providers, inference providers, and related vendors as necessary to provide, secure, evaluate, and improve AI features.

Where appropriate, we use contractual, technical, and organizational measures designed to protect information processed by these providers.

6.5 Professional Advisors

We may disclose information to attorneys, accountants, auditors, insurers, bankers, consultants, and other professional advisors.

6.6 Legal, Safety, and Enforcement Purposes

We may disclose information if we believe disclosure is necessary or appropriate to:

• comply with law;
• respond to subpoenas, warrants, court orders, or government requests;
• protect the rights, property, or safety of Revala, users, customers, or others;
• enforce our Terms of Service or other agreements;
• detect, investigate, or prevent fraud, abuse, security incidents, or unlawful activity;
• collect amounts owed; or
• defend against legal claims.

6.7 Corporate Transactions

We may disclose or transfer information in connection with a merger, acquisition, financing, investment, reorganization, bankruptcy, sale of assets, due diligence process, or similar corporate transaction involving Revala.

6.8 Affiliates

We may disclose information to Revala affiliates, subsidiaries, parent entities, or related entities, if any, for purposes consistent with this Privacy Policy.

6.9 De-Identified and Aggregated Information

We may disclose de-identified, aggregated, statistical, benchmarking, analytical, or derived information for any lawful business purpose, including product improvement, research, marketing, industry analysis, benchmarking, commercial insights, AI development, and business intelligence.

7. We Do Not Sell Personal Information for Money

We do not sell personal information for money.

However, some privacy laws define “sale,” “sharing,” or “targeted advertising” broadly. If we use advertising, analytics, retargeting, or similar cookies or pixels, certain disclosures of identifiers, device data, internet activity, or similar information to advertising or analytics partners may be considered a “sale,” “sharing,” or targeted advertising under applicable privacy laws.

Where required, we will provide a way to opt out of such sale, sharing, or targeted advertising.

8. Your Privacy Choices

Depending on your location and the information involved, you may have choices regarding your information.

8.1 Account Information. You may update certain account information by logging into the Service or contacting us.

8.2 Marketing Communications. You may opt out of marketing emails by using the unsubscribe link in our emails or contacting us at privacy@revala.ai. You may still receive transactional, administrative, billing, support, security, and service-related communications.

8.3 Cookies. You may control cookies through your browser settings. If Revala provides a cookie preference tool, you may use it to manage non-essential cookies. Some cookies are required for authentication, security, and Service functionality.

8.4 Connected Services. You may disconnect certain integrations through your Revala settings or the third-party provider’s settings. Disconnecting an integration may limit Service functionality.

8.5 Customer-Controlled Data. If your personal information was submitted to Revala by one of our customers, such as your employer, brokerage, landlord, owner, or another user, you may need to contact that customer directly to exercise privacy rights.

9. Privacy Rights

Depending on where you live, you may have rights regarding your personal information. These rights may include the right to:

• know whether we process your personal information;
• access personal information we hold about you;
• request correction of inaccurate personal information;
• request deletion of personal information;
• request portability of personal information;
• opt out of certain processing for targeted advertising;
• opt out of the sale or sharing of personal information;
• limit the use or disclosure of sensitive personal information;
• object to certain processing;
• withdraw consent where processing is based on consent;
• appeal a decision regarding a privacy request; and
• not be discriminated against for exercising privacy rights.

California residents have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, including rights to know, delete, opt out of sale or sharing, correct inaccurate information, limit use of sensitive personal information, and avoid discrimination for exercising privacy rights.

To exercise privacy rights, contact us at privacy@revala.ai.

We may need to verify your identity before responding. Verification may require matching information you provide with information we maintain.

If you submit a request through an authorized agent, we may require proof that the agent is authorized to act on your behalf and may require you to verify your identity directly.

We will respond to privacy requests as required by applicable law.

10. California Notice at Collection

This section applies to California residents to the extent the CCPA applies to Revala.

The categories of personal information we may collect include:

• identifiers, such as name, email address, phone number, IP address, account identifiers, and device identifiers;
• commercial information, such as subscription, billing, product usage, and customer relationship information;
• professional or employment-related information, such as company, title, role, brokerage, owner, tenant, or commercial real estate affiliation;
• internet or electronic network activity, such as log data, usage data, browser data, device data, and cookie data;
• geolocation data, such as approximate location derived from IP address;
• audio, electronic, or similar information, such as call recordings or support communications, if applicable and where lawful;
• inferences, such as preferences, usage trends, lead prioritization signals, or product analytics; and
• sensitive personal information, only if voluntarily submitted or necessary for account security, such as account login credentials or authentication information.

We collect these categories from:

• you;
• your organization;
• other users;
• connected services;
• service providers;
• public sources;
• third-party data providers;
• cookies and tracking technologies; and
• your use of the Service.

We use these categories for the business and commercial purposes described in this Privacy Policy.

We may disclose these categories to:

• service providers;
• vendors;
• AI and model providers;
• analytics providers;
• payment processors;
• integrations;
• your organization and authorized users;
• professional advisors;
• legal authorities; and
• parties involved in corporate transactions.

We do not knowingly sell or share personal information of consumers under 16.

We do not use sensitive personal information for purposes that require a right to limit under the CCPA unless we provide the required notice and choice.

11. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Retention periods may depend on:

• the nature of the information;
• the sensitivity of the information;
• the purposes for collection;
• the duration of your account or subscription;
• contractual obligations;
• legal, tax, accounting, audit, or reporting obligations;
• security needs;
• dispute resolution;
• backup and disaster recovery practices; and
• legitimate business needs.

Customer Data may be retained during the subscription term and for a commercially reasonable period after termination to allow account administration, export, legal compliance, backup, or dispute resolution.

We may retain de-identified, aggregated, analytical, derived, benchmark, usage, model-evaluation, and product-improvement data indefinitely, provided it does not identify you or any individual person.

If deletion is not technically feasible from backup or archival systems, we may retain information until those systems are overwritten or retired, while restricting active use where appropriate.

12. Data Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, disclosure, alteration, or destruction.

These safeguards may include:

• access controls;
• authentication;
• encryption;
• logging;
• monitoring;
• vendor review;
• least-privilege access;
• backup controls;
• secure development practices; and
• incident response procedures.

No method of transmission, storage, or processing is completely secure. We cannot guarantee absolute security.

You are responsible for protecting your account credentials, devices, networks, email accounts, connected services, and user permissions.

13. International Users and Transfers

Revala is based in the United States. If you access or use the Service from outside the United States, your information may be transferred to, stored in, or processed in the United States or other countries where Revala, its service providers, or its vendors operate.

These countries may have privacy laws that differ from those in your location.

Where required by applicable law, we will use appropriate safeguards for international transfers.

Revala does not currently claim certification under the EU-U.S. Data Privacy Framework, UK Extension, or Swiss-U.S. Data Privacy Framework unless separately posted by Revala.

14. Children

The Service is intended for business users and is not directed to children.

We do not knowingly collect personal information from children under 13.

We do not knowingly sell or share personal information of consumers under 16.

If you believe a child has provided personal information to Revala, contact us at privacy@revala.ai and we will take appropriate steps to delete the information.

15. Sensitive Personal Information

The Service is not designed to collect or process highly sensitive personal information.

You should not submit:

• Social Security numbers;
• driver’s license numbers;
• passport numbers;
• government identification numbers;
• payment card numbers;
• bank account credentials;
• health information;
• genetic information;
• biometric information;
• children’s information;
• precise geolocation data;
• racial or ethnic origin;
• religious or philosophical beliefs;
• union membership;
• sexual orientation; or
• other sensitive personal information unless Revala has expressly agreed in writing.

If you submit sensitive personal information without approval, you do so at your own risk and represent that you have all rights, notices, consents, and lawful bases necessary to do so.

16. Publicly Available and Business Contact Information

Revala may process publicly available information, business contact information, and commercial real estate information from public records, websites, directories, property materials, brokerage materials, tenant materials, owner materials, public filings, third-party data providers, and similar sources.

This may include information about owners, tenants, brokers, landlords, properties, shopping centers, companies, and business contacts.

We may use this information to provide, improve, and develop the Service, including prospecting, CRM, analytics, AI features, search, benchmarking, and commercial real estate intelligence.

Publicly available information and business contact information may be treated differently under certain privacy laws.

17. Customer Responsibilities

Customers and users are responsible for:

• providing required privacy notices to individuals whose information is submitted to Revala;
• obtaining required consents;
• ensuring Customer Data is lawfully collected and shared with Revala;
• complying with anti-spam, telemarketing, texting, privacy, data protection, brokerage, advertising, and communications laws;
• responding to privacy requests where the customer controls the data;
• maintaining accurate account permissions;
• protecting account credentials; and
• ensuring Revala is not used to process prohibited or restricted data.

Revala is not responsible for a customer’s own privacy notices, data collection practices, outreach practices, or legal compliance.

18. Third-Party Links and Services

The Service may contain links to third-party websites, applications, platforms, or services.

Revala does not control the privacy practices of third parties. Your use of third-party services is subject to their terms and privacy policies.

You should review third-party privacy policies before using or connecting those services.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

When we update the policy, we will revise the “Last Updated” date. If changes are material, we may provide additional notice, such as by email, in-product notice, or prominent website notice.

Your continued use of the Service after an updated Privacy Policy becomes effective means you acknowledge the updated policy.

20. Contact Us

If you have questions about this Privacy Policy or wish to exercise privacy rights, contact us at:

Revala, LLC
Email: privacy@revala.ai

For legal notices, you may also contact: legal@revala.ai

Appendix A: Categories of Personal Information Collected

Appendix B: Data Use for AI and Product Improvement

Revala may use Customer Data, Usage Data, Service Data, prompts, outputs, feedback, and related information to:

• operate AI features;
• generate summaries and recommendations;
• classify replies and activity;
• detect patterns;
• improve workflows;
• evaluate model quality;
• reduce errors;
• develop new features;
• create de-identified or aggregated datasets;
• train, tune, test, validate, and improve AI and machine-learning systems; and
• improve the overall Service.

Revala may retain de-identified, aggregated, usage, analytical, benchmarking, model-evaluation, and derived data for these purposes even after account termination, provided the data does not identify you or any individual person.

Organizations that require different AI-training or data-use restrictions should address those restrictions in a separate written agreement with Revala.

Appendix C: Items Intentionally Removed From the VTS/Salesforce Model

The following items were intentionally removed because they do not appear to fit Revala’s current business:

• resident amenity reservations;
• building access control geolocation;
• tenant/resident building-experience data;
• CCTV and office visitor logs;
• event attendance;
• event badge data;
• COVID/health screening;
• biometric identification;
• certifications and training credentials;
• public developer communities;
• Data Privacy Framework certification claims;
• AppExchange-style marketplace language;
• student/education-specific language; and
• broad consumer-facing marketplace language.