Privacy policy

Revelane B.V. and its subsidiaries and affiliates ("Revelane", "we", "us") respect and protect your personal data: any information that can identify you as an individual. This Privacy Policy explains how we handle personal data in relation to:

• our websites (revelane.com and subdomains);

• the Revelane Operating System ("Revelane OS"), available at app.revelane.com, including all its modules such as CRM, Analytics, Forecasting and Pricing, and its integrations with third-party services such as Google Workspace, Microsoft 365 (together: the "Services");

• our consulting and implementation services, events, recruitment and communications.

Our role: controller or processor

For website visitors, prospects, event attendees, job applicants and the users who hold an account on our Services, Revelane is the data controller.

For personal data that our customers enter into, upload to or synchronise with the Services (for example contact details of their own customers and prospects, emails and calendar events), the customer is the data controller and Revelane acts as data processor on the customer's instructions. This processing is governed by the Data Processing Agreement that forms part of our customer agreement. If you are a contact of one of our customers and have questions about how they use your data, please contact that customer directly; we will assist them in responding.

1. Personal data we collect

Website visitors and prospects. Name, company, job title, email address, phone number and any information you provide in forms, meeting bookings or correspondence. We may enrich this with publicly available professional information (for example from LinkedIn or company websites).

Revelane OS users. When you or your organisation create an account we process your name, business email address, job title, organisation, role and permissions, profile picture, language and time-zone settings, and login credentials or single sign-on identifiers (Google or Microsoft).

Usage and technical data. IP address, browser and device type, pages and features used, actions taken in the Services, timestamps, error logs and performance metrics. We use this to operate, secure and improve the Services.

Customer data in the Services. Data our customers enter, import or synchronise: accounts, contacts, opportunities, orders, activities, notes, emails, calendar events and files. Revelane processes this data as processor (see "Our role" above).

Connected third-party accounts. If you connect a Google Workspace, Microsoft 365, HubSpot, Salesforce or other account to the Services, we receive the data those integrations provide, limited to the permissions (scopes) you grant. Google and Microsoft account data are described separately in section 2.

Job applicants. CV, cover letter, contact details, work history and any information you provide during the application process.

Events and marketing material. Photographs and video taken at events. You will be notified beforehand and we will ask permission before using such material.

2. Email and Calendar account data

The CRM module of Revelane OS lets you connect your Google Workspace or Microsoft 365 account so that your email and calendar work together with your customer records. This section explains what we access, how we use it and how you stay in control. It applies equally to both providers unless stated otherwise. Using the CRM module without this feature is also possible.

Google. Revelane's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Microsoft. Revelane accesses Microsoft 365 data through Microsoft Graph in accordance with the Microsoft APIs Terms of Use, and applies the same restrictions to Microsoft data as described below for all connected account data.

What we access

You choose which permissions to grant on Google's or Microsoft's consent screen. Your organisation's administrator may also grant consent on behalf of your organisation. Depending on the permissions granted, we access:

When reading email, we only retrieve messages whose sender or recipient matches a contact in your CRM workspace, together with their metadata (subject, date, participants, thread) and body. We do not access Google Drive, OneDrive, SharePoint, Teams, contacts or any other service unless you explicitly connect it.

How we use it

The email and calendar features are optional and switched off by default. We only access Google or Microsoft data after the relevant feature has been enabled in the CRM module for your workspace and you have connected your account. If a feature is switched off, we stop the related access and synchronisation.

We use connected account data only to provide and improve the user-facing features of the CRM module that you see and use: sending email, logging email and meeting activity on CRM records, showing timelines, computing engagement and next-step insights for your own workspace, and troubleshooting issues you report.

We do not:

• use Google or Microsoft data for advertising, or sell it;

• use Google or Microsoft data to train or improve generalised artificial-intelligence or machine-learning models;

• transfer Google or Microsoft data to third parties, except sub-processors that host or operate the Services on our behalf (section 5), when required by law with notice to you;

• allow humans to read your Google or Microsoft data, except (a) with your explicit permission, (b) for security or abuse investigations, (c) to comply with the law, or (d) when the data has been aggregated and anonymised for internal operations.

Where the Services use AI features on email or calendar content (for example to summarise a thread or suggest a next step), this is done only for you and your workspace and does not train models across customers. See our AI policy.

Storage and security

OAuth access and refresh tokens are stored encrypted at rest in the European Union. Email and calendar data synchronised to the CRM module is stored in our production database hosted in the EU and is accessible only to users in your organisation's workspace according to their permissions. Data in transit is encrypted with TLS.

Retention and revocation

You can disconnect your Google or Microsoft account at any time in Revelane OS under Settings → Integrations. You can also revoke access directly with the provider: for Google at myaccount.google.com/permissions; for a personal Microsoft account at account.live.com/consent/Manage; for a Microsoft work or school account, your administrator can revoke access in Microsoft Entra ID under Enterprise applications.

On disconnection we delete the OAuth tokens immediately and stop all synchronisation. Emails and calendar events already logged as activities on CRM records remain part of your organisation's CRM data and are governed by your organisation's retention settings; your organisation's administrator can delete them. When a workspace is terminated, all connected account data is deleted within 30 days, and from backups within 90 days.

3. Purposes of processing

We use personal data to:

• provide, operate, secure and support the Services and our consulting services;

• create and manage user accounts, authenticate users and enforce permissions;

• synchronise email, calendar and CRM data that users choose to connect;

• generate analytics, forecasts, benchmarks and recommendations within a customer's workspace;

• improve the Services, including through aggregated, de-identified usage statistics;

• communicate with you about the Services (service notices, security alerts, support) and, where permitted, about our offering (newsletters, events, product updates);

• manage our relationships with customers, prospects, partners and investors;

• recruit and hire;

• comply with legal obligations and protect our rights, property and users.

4. Legal bases

Under the General Data Protection Regulation (GDPR) we rely on:

• Performance of a contract (art. 6(1)(b)): to provide the Services and our consulting services to you or your organisation;

• Consent (art. 6(1)(a)): for marketing communications, non-essential cookies, connecting a Google or other third-party account, and use of event photography. You can withdraw consent at any time;

• Legitimate interests (art. 6(1)(f)): to secure and improve the Services, prevent fraud and abuse, maintain business relationships and conduct B2B marketing, where these interests are not overridden by your rights;

• Legal obligation (art. 6(1)(c)): for tax, accounting and other statutory duties.

Where Revelane processes customer data as processor, the legal basis is determined by the customer as controller.

5. Sharing and international transfers

We share personal data only with parties that help us provide the Services and run our business, under contracts that restrict them to our instructions:

We may also disclose personal data to authorities where the law requires it or to protect our rights, users or property.

Where data leaves the European Economic Area, we rely on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework where the recipient is certified) or on the Standard Contractual Clauses with supplementary measures. A current list of sub-processors for the Services is available on request via data@revelane.com and is provided to customers under the Data Processing Agreement.

We do not sell personal data.

6. Cookies

Our websites and the Services use functional cookies to keep you logged in and remember your preferences, and, with your consent, analytics and marketing cookies. Which cookies we use, why, and how to change your choices is described in our Cookie policy.

7. Security

We protect personal data with technical and organisational measures appropriate to the risk: encryption in transit (TLS) and at rest, workspace-level data isolation, role-based access control, single sign-on and multi-factor authentication for our staff, logging and monitoring, regular backups, secure development practices and vulnerability management. Access to customer data by Revelane staff is limited to what is needed to provide support and operate the Services, and is bound by confidentiality obligations.

No system is completely secure. If we become aware of a personal data breach that is likely to result in a risk to you, we will notify the affected customer or you, and the supervisory authority, as required by law.

8. Data retention

We keep personal data no longer than needed for the purposes above:

9. Your rights

You have the right to access the personal data we hold about you, to have it rectified or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent at any time without affecting processing that took place before withdrawal. Where automated decision-making with legal or similarly significant effect would occur, you have the right to human intervention; the Services do not currently make such decisions.

To exercise your rights, email data@revelane.com. We may ask you to verify your identity and will respond within one month, extendable by two months for complex requests. We may decline a request where the law requires us to keep the data.

If your request concerns data that Revelane processes on behalf of one of its customers, we will forward it to that customer or advise you to contact them directly.

You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or the supervisory authority in your country of residence.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The version number and effective date at the top show when it was last changed. For material changes affecting users of the Services we will notify you by email or within the Services before the changes take effect. Continued use of the Services after that date means the updated policy applies.

11. Contact

Data controller:

Revelane B.V., Legal Department
Molenpad 2, 1016 GM, Amsterdam, The Netherlands
CoC: 78408075
VAT: NL861380502B01

E: data@revelane.com

This Privacy Policy is effective from 01/10/2026.