Privacy policy

1.Who we are

1.1Revisa is provided by Prelude LTDA, CNPJ 30.493.260/0001-07, Rua Itaparica, 334/301, Serra, Belo Horizonte, MG, CEP 30240-130, Brazil.

1.2For anything about your personal data, or to exercise your rights, please contact Prelude's data protection contact (the encarregado under the LGPD):

2.Our role: controller or processor

2.1For account, billing, support and website data, Prelude is the controller: it decides why and how that data is processed, as this Policy describes.

2.2For the content that the organizations using Revisa ("Customers") and their users put in Revisa (documents, forwarded emails and the items made from them: "Customer Content"), Prelude is a processor: it processes that content for the Customer, who is the controller, following the Customer's instructions. Customer Content may contain other people's personal data, such as a supplier's contact on an invoice.

2.3If your personal data is in a Customer's Content, that Customer's own privacy notice applies to it, and the Customer is the one to ask first (Section 12.3). How Prelude processes that data for the Customer is set out in the Data processing agreement.

3.Data we process

3.1Prelude processes these categories of personal data:

• Account: your name and email, when you sign in to Revisa (through WorkOS).
• Organization: its name, its members and guests, and their roles.
• Content: Customer Content (Section 2.2).
• Billing: billing details, held by Stripe and RevenueCat. Prelude never has access to card numbers.
• Support: the messages you send Prelude.
• Technical data: what is needed to run the Service. The app's logs carry no personal data, the web server keeps no access logs, and monitoring metrics are aggregate.

4.Cookies and similar technologies

4.1The app uses only strictly necessary cookies and browser storage, to keep you signed in. The website uses no cookies and no trackers: it keeps only the currency you chose for prices, in your browser's local storage.

5.Purposes and legal bases

5.1Prelude processes personal data for the purposes and on the legal bases below (LGPD art. 7; GDPR art. 6):

6.Artificial intelligence

6.1When a Customer uses AI models it connects itself (ChatGPT, Claude or others), those providers act for the Customer, under their own terms: the Customer chooses them, and they are not Prelude's subprocessors.

6.2When a Customer uses AI models made available by Prelude, the feature is optional and described before it is enabled; the providers involved are listed among the subprocessors in Section 7, with the notice provided for in Section 15; and Prelude processes the data only to provide that feature.

6.3In both cases, Prelude doesn't use Customer Data to train AI models without the Customer's prior agreement.

7.Who we share it with

7.1To run Revisa, Prelude uses the providers below, which process personal data on its behalf ("subprocessors"):

8.Requests from authorities

8.1Prelude discloses personal data to authorities only when the law requires it: under a court order or another binding request from a competent authority. Prelude checks that the request is valid, discloses only what it requires, and notifies the affected Customer, unless the law prohibits notifying it.

9.International transfers

9.1Some of these providers are outside Brazil and the European Union. When data goes to them, Prelude relies on the safeguards the law provides: standard contractual clauses and the other mechanisms of LGPD art. 33, and the EU–US Data Privacy Framework where the provider is certified under it.

10.How long we keep it

10.1Prelude keeps data while the account is active. After an organization is deleted, its data clears from backups within 30 days. Billing and tax records are kept as long as Brazilian law requires, generally 5 years.

11.Security

11.1Connections to Revisa are encrypted. Only an organization's members, and the guests it invites, can see its items. Data is backed up, and Prelude's staff's access is limited to what their work requires.

11.2No system connected to the internet is completely secure. Prelude maintains these measures and keeps them up to date, but can't guarantee that unauthorized access will never happen.

11.3If a security incident may cause relevant risk or harm to data subjects, Prelude notifies Brazil's National Data Protection Authority (ANPD) and the affected data subjects, as the LGPD requires, and, where applicable, the competent supervisory authority and the data subjects under GDPR arts. 33 and 34. What Prelude notifies the Customer of in case of an incident is set out in the Data processing agreement.

12.Your rights

12.1Each data subject has the rights given by the law that applies to them: the LGPD (art. 18) in Brazil and the GDPR in the European Union. Among them, you may ask Prelude for:

• confirmation that your personal data is being processed, and access to it;
• the correction of incomplete, inaccurate or outdated data;
• the anonymization, blocking or deletion of data that is unnecessary, excessive or processed unlawfully;
• the deletion of the data;
• the portability of the data to another service or product provider;
• Prelude to stop processing it (objection);
• information about the entities with which Prelude shares your data;
• information about the possibility of not giving consent and the consequences of refusing;
• the withdrawal of your consent, where consent is the legal basis for the processing.

12.2To exercise any of these rights, or if you have a question about your personal data, contact Prelude's data protection contact (Section 1.2). Prelude replies within 15 days (LGPD) or one month (GDPR). You may also complain to Brazil's National Data Protection Authority (ANPD) or, in the European Union, to your country's data protection authority.

12.3For personal data in a Customer's Content, send your request to that Customer, who is the controller. Prelude helps the Customer answer it.

13.Minors

13.1Revisa is a service for businesses and isn't meant for people under 18.

14.Representative in the European Union

14.1[TODO: GDPR art. 27 representative in the EU — pending decision]

15.Changes to this Policy

15.1Prelude may change this Policy. For material changes, Prelude gives notice by email or in the app at least 30 days in advance.

16.Language

16.1This Policy is written in Portuguese and translated into English and Italian. If the versions differ, the Portuguese version prevails.