1. Who we are and what this policy covers
Revometrics is a product operated by Altaveron LLC, a company registered in the Republic of Armenia and based in Yerevan ("we," "us," or "our").
This policy covers personal information we handle in connection with our websites, accounts, applications, workspaces, AI tools, support, and related services. Personal information means information that identifies a person or can reasonably be linked to them. It can appear in account details, uploaded files, prompts, Outputs, and technical records.
For accounts, security, support, and our own business operations, we decide how information is used and act as a controller. When a business customer gives us personal information to handle only on its instructions, we act as its processor. A customer that submits information about other people, such as employees or clients, is responsible for the notices and permissions needed; contact us if that processing requires a data-processing agreement.
Privacy contact: [email protected].
2. Information we collect and its sources
What we collect depends on the features you use and what you choose to provide:
- Account and workspace details: name, email, profile, sign-in records, memberships, roles, invitations, and settings, from you, an administrator, or a login provider.
- Content: files, prompts, messages, conversation history, Outputs, and related metadata, including any personal information in them.
- Connected sources: records retrieved from databases, files, or services you connect, plus connection settings and credentials.
- Billing: billing contacts and administrators, linked workspaces, subscriptions, transactions, invoices, and limited card details from Paddle, such as brand and last four digits. Full payment details stay with Paddle.
- Support: messages, attachments, problem reports, and feedback you send us.
- Technical and usage records: IP address, device and browser details, pages and features used, errors, security events, session identifiers, and usage metering. Analytics is described in section 7.
- Search: queries and retrieved results when a feature searches the web. Queries generated from your content can contain personal information.
Information needed for an account, purchase, or requested task is required for that part of the Service; everything else is optional. Other people can also provide information about you, for example through invitations or content they upload.
Signing in with Google: if you choose Google sign-in, Google shares your name, email address, whether that email is verified, and a Google account identifier. We use them only to create your account, sign you in, and keep it secure. We request no other access to your Google account, do not use this information for advertising or to train AI models, and do not sell it or share it except with the service providers that run sign-in for us. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. It is kept and deleted with your account as described in section 9.
3. How and why we use information
We use information to create and manage accounts; deliver requested AI and workspace functions; maintain connections; control access; meter usage; administer subscriptions; support users; diagnose failures; secure the Service; prevent fraud and abuse; communicate about accounts and service changes; and meet legal obligations or establish, exercise, or defend legal claims.
We also use usage and performance information to understand and improve the Service, aggregating or de-identifying it where we can. This does not include training models on private content.
Where the law requires a legal basis, we use the basis appropriate to the activity:
| Activity | Basis, where applicable |
|---|---|
| Individual accounts and requested services | Taking requested steps before a contract and performing our contract with you, to the extent the processing is necessary for it. |
| Business contacts, support, security, and service administration | Our legitimate interests in running, protecting, and improving the Service and communicating with customers, balanced against affected individuals' rights; contract or legal obligation where appropriate. |
| Optional analytics and promotional communications | Consent where required. Where a legally available exception permits another basis, only within that exception and with the required notices and choices. |
| Legal compliance and claims | Compliance with applicable legal obligations, or legitimate interests in protecting rights and resolving disputes where permitted. |
| Customer-directed processing | The customer's documented instructions and applicable processing agreement. The customer determines the lawful grounds for its collection and instructions; this does not displace our own duties. |
You may withdraw consent through the relevant control or by contacting us. Withdrawal does not affect processing that was lawful before it and does not prevent processing under another valid, independently applicable basis.
4. AI, external search, and no training
When you request an AI feature, we process your instructions and relevant context to generate a response or perform the requested task. Depending on the feature, that context can include selected file contents, retrieved database records, conversation history, images, metadata, or information derived from them. It may be sent to the providers needed to perform the task.
We do not use private customer files, prompts, connected data, or Outputs to train or fine-tune AI models. The AI model providers we use for these features may not use that content to train or improve their models under the terms that apply to our use. Search providers receive the queries needed to retrieve results, and their terms may allow them to retain and use those queries to operate and improve their own services. Our own rule also applies to private content included in feedback, support requests, and security reports. There is no general training opt-in in this policy.
Search and image tools may receive a query or prompt derived from your files or conversation, which can contain information from them. Limited support or security review of a request is not model training.
AI-generated information may be inaccurate. Contact us to request correction or other applicable remedies for personal information we control. If a customer uses an Output to make a decision about someone, that customer is responsible for assessing the lawfulness of its use. We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing.
5. Who receives information
Our application infrastructure is hosted on Amazon Web Services (AWS). To provide the Service, we also use AI, search, security, analytics, communications, and payment providers. Depending on the feature, these providers receive the information needed for their role, which may include relevant customer content, search queries, account details, or technical information.
| Recipient category | Information handled and purpose |
|---|---|
| Cloud infrastructure | AWS provides hosting, storage, databases, authentication, delivery, and related infrastructure. See AWS data privacy information. |
| AI model and image-generation services | We use AI services available through AWS and direct integrations with AI providers. These services process prompts, relevant content and conversation context, images, and associated request information to generate responses, analyze information, or create images. The providers and models used can vary by feature and request. |
| Web and image search services | Search providers process queries and associated request information to retrieve relevant web information or existing images. Queries can be derived from your instructions, files, or conversation and can contain personal information included in that context. |
| Security and bot-protection services | Process technical signals, such as IP address, browser information, and interaction signals, to detect automated abuse and protect registration and use of the Service. |
| Usage analytics services | Process browser and device information, identifiers, page and feature events, and related usage data to help us measure visits, understand use, and diagnose performance or errors, subject to applicable consent and preference controls. |
| Email delivery and support services | Process contact information, service messages, support correspondence, and content you include in a support request to deliver communications and help resolve requests. |
| Paddle and payment participants | Complete and administer purchases. Paddle acts as an independent controller for relevant transaction processing, rather than simply as our processor. See Paddle's Privacy Policy. |
| Authorized workspace users and recipients you select | Access content according to the relevant workspace, sharing, integration, or publishing settings. |
| Advisers, authorities, and transaction parties | Professional advice; valid legal requirements; protection of rights and safety; and an actual or proposed business sale, financing, or reorganization, subject to appropriate confidentiality and lawful-processing requirements. |
Providers that process information on our behalf may use it only for the purposes we allow, under contractual duties. Some recipients decide their own purposes, including Paddle for payments, bot-protection providers for improving abuse detection, and services you connect; their own privacy notices also apply. Processing by AI, search, and other providers does not necessarily take place within our AWS environment; see section 8.
We may change providers as the Service develops. Where we process information for a business customer, we notify subprocessor changes and obtain authorization as our data-processing agreement and applicable law require. For details about specific providers, their locations, or safeguards, contact [email protected].
We do not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or disclose it to other parties for their own marketing.
6. Workspaces, billing accounts, and sharing
Workspace owners and administrators manage membership and access. They can view generated content in the workspace, subject to content passwords, but their role does not give them access to other members' conversations. If someone else manages your workspace, ask them about its data practices.
A billing account administrator can see its billing contact details, linked workspaces, transactions, invoices, and limited payment-method details, including history from before they took over. Billing access does not give access to workspace files or conversations.
Content you publish or share can be seen by the audience you allow. Public links can be forwarded, indexed, or copied, and disabling a link cannot remove copies others already hold. Revoking a connected service stops future access but does not remove content already imported.
8. Locations and international transfers
We are established in the Republic of Armenia. Our application infrastructure and stored data are hosted on AWS in the United States. AI and search providers that handle a request may process it in the United States or other countries where they operate, and our authorized personnel may access information from the locations where they work.
Those countries may provide different legal protections. Where applicable law restricts a transfer, we use an available lawful transfer mechanism and any required supplementary safeguards. The mechanisms used for relevant transfers are data-protection terms in our agreements with providers, including standard contractual clauses where required, and adequacy decisions where available. Contact our privacy address for information about the safeguards and how to obtain a copy where entitled, subject to necessary redactions.
9. Retention and deletion
We retain personal information only for as long as needed for the purposes described here, taking account of the type of information, active use, customer instructions, security needs, legal obligations, and potential claims. We then delete it or render it anonymous where that can be done reliably. Pseudonymous records that remain linkable to a person continue to be treated as personal information.
| Record | How long we keep it |
|---|---|
| Account and workspace records | While your account exists. When you delete your account, your access ends immediately and we delete your conversations, files, connections, automations, and everything in your Personal workspace, normally within minutes and at most within 30 days. Content you created in a shared workspace stays with that workspace. We keep billing and transaction records, a one-way hash of your email address to prevent repeated free sign-ups, and usage statistics that no longer identify you. We may delete a free account that has not been signed in to for 24 months, after telling you by email at least 30 days in advance; signing in keeps the account. |
| Files, conversations, Outputs, and connected copies | While your account and the relevant workspace exist, until you or an authorized workspace administrator deletes them, subject to customer instructions and any processing agreement. Generated content keeps recent version history: the latest five versions and any version used by an active shared link. |
| Security, usage, and diagnostic logs | Operational and diagnostic logs: up to 14 days. Authentication, security, and payment-related logs: up to 90 days. Records of AI model requests: up to 30 days. Product usage events: up to 13 months. Longer retention applies only where a specific incident or legal obligation requires it. |
| Backups and recovery copies | Deleted database records can remain in restricted recovery copies for up to 35 days, and deleted or replaced stored files for up to 90 days, after which they expire automatically. Recovery copies are used only to restore the Service after a failure. |
| Billing, support, and dispute records | Billing-account, subscription, and transaction records: while the billing account is active and afterwards for as long as needed to handle refunds, disputes, chargebacks, and our accounting with Paddle. Support correspondence: while needed to resolve the request and any follow-up. Paddle retains its own records under its policy and legal obligations. |
| Provider-held request data | AI and search providers we engage may keep request data for a limited period set by their terms, for purposes such as abuse monitoring, security, or legal compliance, and then delete it. |
Subscription cancellation stops renewal under the purchase terms; it does not itself delete the workspace. Account deletion, removal from a workspace, revocation of a connector, and removal of public sharing have different effects. We may need to verify authority and resolve administration of shared workspaces or billing before closing an account. This does not override an individual's statutory privacy rights.
Archiving a billing account does not erase transaction records or invoices. We and Paddle retain relevant billing records for the applicable accounting, tax, dispute, and other lawful purposes described here and in Paddle's own privacy notice.
Where a valid legal requirement, dispute, or security investigation requires limited retention after a deletion request, we restrict the retained information to that purpose and delete it when the requirement ends. We will explain a refusal or limitation where required. Information held independently by a customer organization, public recipient, or payment provider may require a request to that recipient.
10. Security and confidentiality
We use technical and organizational measures appropriate to the nature and risks of the processing, including controls over access to private content and the providers authorized to handle it. These include encryption of data in transit and at rest, role-based workspace and content permissions, optional multi-factor authentication, rate limiting and automated-abuse protection, security logging, and restricted personnel access.
Authorized personnel may access information where needed to operate, support, secure, or troubleshoot the Service, or comply with law, subject to appropriate access and confidentiality restrictions. Public sharing and customer-authorized access are governed by the relevant settings and instructions.
No service can guarantee absolute security. That limitation does not remove our legal or contractual obligations. If a personal-data breach occurs, we will assess it, take appropriate action, and notify affected customers, individuals, or authorities as required by the applicable rules. Different notification requirements may apply to different recipients.
11. Your choices and privacy rights
Depending on the applicable law and processing, you may have rights to access or receive a copy of your personal information; correct it; request deletion; restrict or object to processing; obtain portable information; withdraw consent; and opt out of certain advertising, sale, sharing, or profiling activities. Your access rights also include information about the processing and the identities of recipients to whom your personal information has been or will be disclosed, to the extent required by applicable law. Additional protections may apply to certain automated decisions.
Contact [email protected] to exercise a right, identify the account or activity involved, and explain your request. We may ask for information reasonably needed to verify identity or authority, taking account of the request's sensitivity. Where allowed, an authorized agent may act for you subject to appropriate verification.
We respond within the period required by the applicable law and explain any permitted extension, refusal, or limitation. We do not charge a fee unless the law permits it, and we will explain any permitted charge before proceeding. We do not discriminate against you for exercising protected privacy rights.
Where a customer organization controls the information, we may refer the request to it and assist as required under the applicable agreement and law. We handle requests concerning processing for which we are independently responsible.
You may challenge our response through [email protected] and complain to a competent data-protection authority. In Armenia, this is the Personal Data Protection Agency of the Ministry of Justice. You may also contact the data-protection authority in your country.
12. Age requirements
The Service is intended for people aged 18 or older. We do not knowingly permit children to create their own accounts. If you believe a child has registered or supplied information in a way inconsistent with this policy, contact us so we can investigate and take appropriate action.
The account age requirement does not establish that uploaded files never contain information about children. Customers submitting information about other people remain responsible for the applicable permissions and requirements, and our own processing obligations continue to apply.
13. Updates and contact
We may update this policy to reflect changes in the Service, our practices, or legal requirements. We will identify the effective date and provide notice of material changes through appropriate channels. If a change requires consent or another legal step, we will complete that step before the relevant processing. An update does not by itself authorize new purposes or model training on private content.
For privacy questions or requests, contact us at [email protected]. For account and product support, use [email protected].