Privacy policy
This policy describes how Revintia handles personal data. If you use Revintia as a customer, you are the data controller for the information you enter about your own customers and staff; Revintia is the processor for that data. For your own account and for enquiries via the website, Revintia is the controller.
What data we process
Account data: name, work email, company name, country, company size and type of operation, any message sent with the request, your role in the application and, once access is opened, company registration number, contact person and billing email. Operational data: what you enter yourself, such as customers, cases, hours, parts and invoices. Technical logs: timestamps, IP address, browser type, error messages with the page address, and system events. To limit abuse, a salted hash of the IP address and email is stored when the forms are submitted. With a trial request we also store campaign parameters (UTM) and the domain of the site you came from, so we can see which channels work. Enquiries via the contact form: name, email, company if given, topic and the message itself.
Why
To deliver the service, to provide support, to run and secure the system, to see which channels bring enquiries, and to comply with bookkeeping law. The legal bases are our contract with you (Article 6(1)(b) GDPR), our legitimate interest in operations, security and channel measurement (Article 6(1)(f)) and legal obligations (Article 6(1)(c)). We do not sell data on, and we do not use it for third-party advertising.
Where the data lives
The database and files are hosted in the European Union, in Frankfurt. All traffic to and from the system is encrypted with TLS.
Processors and sub-processors
Supabase (database, files and login, EU/Frankfurt), Resend (outgoing email from the application), Lovable (hosting of the website, delivered through Cloudflare's network, and sending of sign-in, invitation and password-reset emails) and, when the SMS module is used, Twilio (SMS). Supabase, Resend, Cloudflare and Twilio are US companies. Where data becomes accessible to them outside the EU/EEA, this is based on the European Commission's standard contractual clauses in their data processing agreements. When a company or VAT number is looked up, the number is sent to public registers, directly or through private lookup services: the EU VIES system (via vatcomply.com or directly), the Danish CVR register via cvrapi.dk and the Norwegian Brønnøysund Register. The list is updated here if it changes. If you click for directions to an address, Apple Maps or Google Maps opens with the address. If you choose to add a visit to Google Calendar or Outlook, the visit's time, address, customer name, case number and case description are sent to the calendar you choose. This only happens when you click, and those services process the data under their own terms. A calendar file you download is not sent anywhere.
How long
Data is kept for as long as you have an account. When a subscription or trial ends, nothing is deleted automatically: you can still sign in and view your data, you can get a complete data export by writing to us, and data is deleted when you ask. Enquiries via the contact form and trial requests that do not lead to an account are likewise kept until you ask for deletion. Invoices and other accounting records are kept for as long as bookkeeping law requires. The database is copied every night. The copies are kept for 30 days and then deleted automatically; the most recent copy is never deleted before a newer one exists. Until then, deleted data may remain in the copies. Uploaded files are not included in the copies. In the settings you can choose a retention period for completed cases; the system then shows which cases are due for clean-up but does not delete anything by itself.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and the right to object. The system has built-in tools that help answer access and erasure requests. Write to us if you want to exercise your rights. You can also lodge a complaint with a supervisory authority, such as the Danish Data Protection Agency (Datatilsynet).
Cookies, local storage and visit statistics
Revintia sets no tracking or marketing cookies. The application uses your browser's local storage for your login session (so you are not asked to sign in on every click), your chosen language and theme, display settings such as the dashboard layout, the selected company and printer settings, drafts of cases you are creating or editing, time registrations that could not be sent because there was no connection, and a local error log for troubleshooting. This stays in your own browser. Signing out removes the login session and drafts of cases you were editing. Time registrations waiting for a connection remain until they have been sent. Everything else remains until you clear your browser data, and a draft of a new case, which may contain customer details, remains until the case is created. Hosting sets one technically necessary cookie (__cf_bm from Cloudflare) to tell people from automated traffic; it expires after 30 minutes. The hosting provider (Lovable) also collects simple, cookieless visit statistics on the public pages: which page was shown, the referring address, browser type and language, and a temporary session ID. It is used only to count visits and is not shared with advertisers.