Privacy Policy

Revo Chat is a live chat service that lets businesses talk to their customers on their websites and messaging channels (WhatsApp, Facebook Messenger, Instagram, Telegram and email). This policy explains who processes your personal data, for what purposes and on what legal basis, who we share it with, how long we keep it and what rights you have under the EU General Data Protection Regulation (GDPR) and other applicable laws.

1. Who we are

ULUMEŞE TARIM FİDANCILIK PEYZAJ SANAYİ VE TİCARET LİMİTED ŞİRKETİ, a limited liability company registered in Türkiye, operates Revo Chat (“Revo Chat”, “we”, “us”) · Çamlık Mah. Leylak Sk. Açelya Sitesi D5 Blok No: 3/5 İç Kapı No: 22, Pendik, 34912 Istanbul, Türkiye · Email: [email protected]

ULUMEŞE operates the Revo Chat platform, its servers and the WhatsApp, Messenger and Instagram connections. Subscriptions are sold by Ludexa Group Limited (England and Wales, company number 17335104 · 71-75 Shelton Street, Covent Garden, London WC2H 9JQ). Ludexa is a separate controller for the sales contract, invoices and payment records; it does not access businesses’ conversation or visitor data.

2. Our two roles

• Where we are the controller: data about the people who use Revo Chat on behalf of a business (account owners, admins and agents), billing details, visitors to revochat.app and anyone who contacts us directly.
• Where we are a processor: data about the people a business chats with on its own website and channels. That business is the controller; we process the data on its behalf and on its instructions (see our Data Processing Agreement).

If you reached us through a chat bubble on a business’s website: your conversation is processed on behalf of that business, so please send any request about your data to the business first. If you contact us instead, we will forward your request to the business without delay and help it respond. By default, the chat bubble does not create a visitor record or store a persistent identifier in your browser until you open it; this starts earlier only if the site owner obtains your consent through its own consent tool or turns on pre-chat tracking.

3. What we collect, why, and our legal basis

Where we are the controller (legal bases under GDPR Article 6(1)):

• Identity and contact details (name, email, phone number) and a hash of your password — to create and manage your account · performance of a contract (b)
• Billing details (name or company name, billing address, optional tax ID) — collected on the Stripe checkout page on Ludexa’s behalf; invoicing and tax compliance · legal obligation (c), contract (b)
• Payment records — collecting payments and issuing refunds. We never see or store your full card number; it is handled only by Stripe · contract (b)
• Security data (IP address, browser, session and dashboard audit logs) — keeping the service secure, preventing abuse and meeting record-keeping duties · legitimate interests (f), legal obligation (c)
• Support conversations — answering your requests · contract (b), legitimate interests (f)
• Service notifications (trial ending, renewal, payment problems) — running your subscription · contract (b)

How we collect it: sign-up and billing forms, your use of the dashboard, Sign in with Google, the chat bubble on our website, strictly necessary cookies and email. We do not send marketing emails; if we ever want to, we will ask for your consent first.

Data we process on behalf of businesses: the name and email a visitor provides; messages, files and voice messages; IP address and the approximate city derived from it, browser and the addresses of pages visited; and channel identifiers (WhatsApp phone number, email address, Messenger, Instagram and Telegram user IDs, sender name and profile photo). We never use this data for advertising, profiling or training AI models.

4. Who we share data with

We share personal data only with the service providers needed to run Revo Chat:

• Vultr (US company; servers in Frankfurt, Germany) — all service data · hosting
• Cloudflare (US, global network) — website traffic (IP addresses, requests) · network security, speed and cookieless page measurement with Cloudflare Web Analytics (page views and load times; it uses no cookies or browser storage and does not identify visitors)
• Anthropic (Claude), OpenAI (US) — the conversation content and knowledge base needed for an AI response · automatic replies, suggestions, summaries and voice transcription. Businesses can turn off automatic replies and voice transcription separately in the dashboard, or use their own provider key.
• Resend (US) — email address and message content · notification emails
• Web push services (Google, Apple, Mozilla, Microsoft; US) — notification content and device endpoint · instant notifications to agents (only if the agent turns them on)
• Ludexa Group Limited (UK) — the account owner’s name and email, subscription and invoice records · selling subscriptions, invoicing and refunds
• Stripe (Stripe Payments Europe, Ireland and Stripe Payments UK, United Kingdom; infrastructure in the US) — billing and payment details · collecting payments, renewals and refunds. Stripe processes card data as an independent controller under its own privacy policy.
• Meta (WhatsApp, Messenger, Instagram; US/Ireland) and Telegram — channel messages · only for channels a business connects. Meta’s script loads on the channel connection page in the dashboard, and Google’s sign-in script loads when you open the sign-in window.
• Destinations set by the business — if a business sets up Slack or Telegram notifications or webhooks in the dashboard, new conversation and message details are sent there on its instructions.
• Our accountant and public authorities (Türkiye) — where required by law.

We do not sell your personal data. Optional advertising-measurement sharing relies on the explicit consent explained below.

5. International transfers

Revo Chat’s data is stored on servers in Frankfurt, Germany. Revo Chat is operated from Türkiye and several of the providers listed above are based in the United States, so personal data may be accessed from or transferred to countries outside the European Economic Area. To learn more about these transfers, contact us at [email protected].

6. How long we keep data

• Account data: for as long as your account is open. You can delete your account yourself in the dashboard: Settings → Security (or Billing, if the account is paused) → “Delete account”. Seven days after you confirm the request with your password, your account and all related data (conversations, files, voice messages, visitor records, channel connections, team and settings) are permanently deleted. You can cancel the request within those 7 days, and admins receive an email once deletion is complete. You can also request deletion by email, in which case it is completed within 30 days. If an account is paused for non-payment, admins receive a warning email 60 days after the pause, and on day 90 (at least 30 days after the warning) the account’s data is permanently deleted in the same way; if you pay before then, nothing is lost. Database backups are kept for 14 days, so deleted data disappears from backups automatically within that cycle.
• Billing records: for as long as the tax and commercial law of the relevant country requires (10 years for ULUMEŞE’s records under Turkish law).
• Security and audit logs: kept with the business account and deleted when the account is deleted (removing a single agent does not delete them); records the law requires us to keep longer are kept for that period.
• Conversations: for the shorter of the retention period the business chooses and its plan’s history limit (if both are unlimited, for as long as the account is open). Closed conversations past that period are deleted automatically along with their files. This deletion pauses while an account is paused for non-payment.
• Visitors who never started a chat (browser details, pages visited, IP address): deleted automatically 30 days after they were last seen.

7. Your rights

Under the GDPR you have the right to:

• access your personal data and receive a copy;
• have inaccurate data corrected;
• have your data erased;
• restrict how we process it;
• receive the data you gave us in a portable format;
• object to processing based on our legitimate interests;
• withdraw your consent at any time, where we rely on consent;
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you (we make no such decisions);
• lodge a complaint with the data protection authority in the EU country where you live or work, or where you believe an infringement took place.

8. How to make a request

Email [email protected], preferably from the email address registered with us, or write to the postal address above. We may ask you to confirm your identity. We respond free of charge within one month; for complex requests we may extend this by up to two further months and will tell you why. For deletion steps, see Data Deletion.

9. Cookies (revochat.app)

By default, we use strictly necessary cookies: a session cookie (to keep you signed in), cookies that remember your theme and language, and short-lived security cookies set for a few minutes when you sign in with Google or connect a Facebook Page. Only after the new advertising-measurement consent may Meta Pixel use advertising cookies (_fbp and _fbc) and session storage for deduplication. This choice is optional. We count page views and measure load times with Cloudflare Web Analytics, which uses no cookies or browser storage (legal basis: legitimate interests, Article 6(1)(f)).

When you register from a tagged advertising link, its campaign labels are associated with your business account for our internal sign-up and first-payment reports. If you separately opt in on the registration screen, advertising click IDs and your sign-up and first successful payment events are sent to Google Ads and Meta for advertising measurement. Under this basic permission, we do not send email, phone or chat content; Meta also receives a one-way hash of the business account ID. With the new consent, Meta Pixel may receive your IP address and browser information directly and use _fbp/_fbc advertising cookies and session storage to avoid repeated events. Pixel and server use the same event ID. Earlier, narrower permissions do not become Pixel permissions. Stored click/browser IDs are encrypted and removed within 90 days; Meta cookie duration also depends on Meta and browser settings. Registration works without permission. Withdrawing on the Security page stops new uploads and removes stored IDs and advertising cookies in this browser. Other open tabs check the choice again on focus or navigation. Events already received by platforms are not automatically retracted. Source records are deleted with the account. No new browser matching is performed without the new consent.

A separate new v3 permission also covers visits, pricing views, actual demo use, trial starts and checkout starts shared with Google and Meta. These steps are not purchases. The preference cookie lasts up to90days; the random visit cookie lasts30minutes. Visit identifiers and events are retained for at most90days. No full URLs, search terms, chat or form text are sent. Google uploads of these intermediate events require a valid advertising click ID. Services work without permission; withdraw through Measurement preferences or account Security. Earlier v1/v2 permissions are not expanded to these new events.

Separate Google email matching permission: if you explicitly opt in, only your own Revo account email is normalized and hashed server-side using SHA-256. The one-way hash is sent to Google Ads to match your sign-up and first real payment to ads. It accompanies the same event when a click ID is available; otherwise matching is attempted using the hash. A hash is not anonymous data. Phone numbers, addresses, chat content and your customers’ information are not scanned or sent for this purpose. Permission and the encrypted stored hash last at most 90 days. You can withdraw this permission separately on the Security page; this stops new hash uploads without changing basic measurement consent. Existing permissions are not expanded and past events are not resent under a new permission.

Separate usage analytics permission (Google Analytics 4): only if you separately accept Analytics in Privacy preferences, GA4 measures public landing/registration pages, pricing and demo use. If you create your account with this permission, registration, trial start, checkout and the first real payment are also measured using a random analytics identifier. Dashboard/chat content, names, email addresses and phone numbers are not sent. Google may receive IP and browser information through network requests. The preference cookie, random identifier and local analytics records last up to90days; GA4 event retention is configured separately in the property. Withdrawing Analytics in the same preferences stops new analytics from this browser and deletes its analytics cookies and pending local events. Advertising permission does not change automatically. Declining does not affect service. The GA4 first payment is not imported into Ads as a second conversion.

Separate remarketing permission: when you accept the advertising-personalization preference on our website, the Google tag sends only your visitor/registered-customer/paying-customer category for remarketing and customer exclusions. This preference cookie and Google ad cookies are configured for up to 90 days; browsers may remove them earlier. Google can also receive your IP and browser information during the network request. Actual dashboard URLs, form/chat text and email are not added to the tag. The Google ad tag is not loaded without permission. Withdraw through the same preference screen; this is independent of measurement and email matching permissions.

Meta server measurement and separate email matching: when you explicitly save the new measurement choice, Meta server events may include the browser information and valid user IP from your actual request. Existing permissions are not expanded; a server or Stripe IP is never sent as yours. If you also choose Meta matching on registration or Security, only a SHA-256 hash of your own Revo account email is added to registration and the first real payment. Google email permission is not Meta permission. Raw email, phone numbers, addresses and customer chats are not scanned. Consented browser data and hashes are encrypted and retained for at most 90 days. Withdraw Meta email matching separately on Security without changing Google matching or basic measurement. Full measurement withdrawal stops new server/Pixel delivery. Earlier events are not resent under new permission.

10. Children

Revo Chat is a service for businesses and is not directed at children. We do not knowingly collect personal data from children through our own website.

11. Additional information for people in Türkiye (KVKK)

For people in Türkiye, this policy is also our notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK). We process data on the legal bases in KVKK Article 5(2) (performance of a contract, legal obligation and legitimate interests), and you have the rights listed in KVKK Article 11. We respond to applications within 30 days free of charge; if handling your request involves an additional cost, the fee set by the Personal Data Protection Board may apply. If your application is rejected, the answer is insufficient or we do not respond in time, you may complain to the Personal Data Protection Board (KVKK Kurulu). Transfers of personal data from Türkiye to Vultr, Cloudflare, Anthropic, OpenAI, Resend and Ludexa Group Limited are made under KVKK standard contracts signed with these recipients under KVKK Article 9 and notified to the Personal Data Protection Board. The Turkish version of this notice is the authoritative text for KVKK purposes.

12. Changes to this policy

When we change this policy, we update the date at the top of the page. If a change materially affects how we use your data, we will also email account owners before it takes effect.