RevSend Privacy Policy & Data Protection Charter

1. Introduction, Operating Entity, and Scope

1.1. This Privacy Policy ("Policy") governs the processing of personal data by NEVERSOFT LIMITED ("Company", "we", "us", or "our"), a company incorporated in the United Kingdom with its registered corporate office at:

1.2. This Policy applies to all interactions with our cloud marketing platform, websites (including revsend.io), mobile interfaces, RESTful APIs, documentation portals, and related services (collectively, the "Services").

1.3. Distinct Legal Capacities: Under United Kingdom and European data protection laws, the Company operates in two distinct legal capacities:

• As a Data Controller: In relation to our Customer account holder information, billing contacts, website visitor metrics, and direct commercial relationships.
• As a Data Processor: In relation to subscriber personal data, recipient email lists, phone numbers, and engagement telemetry uploaded or synchronized into RevSend by our Customers.

2. Legislative Framework and Regulatory Compliance

2.1. We design and operate our data handling workflows to comply with the most stringent global data protection and privacy standards, including:

• The United Kingdom General Data Protection Regulation (UK GDPR);
• The Data Protection Act 2018 (DPA 2018);
• The Privacy and Electronic Communications Regulations 2003 (PECR);
• The European Union General Data Protection Regulation (Regulation (EU) 2016/679);
• The California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA); and
• International anti-spam statutes including the CAN-SPAM Act 2003 and Canada's CASL.

3. Categories of Personal Data Collected

We collect and process personal data across four main operational categories:

A. Customer Account & Administrative Data (Controller)

• Identity & Profile Data: Full name, corporate email address, business telephone number, job title, company name, and encrypted authentication credentials.
• Financial & Billing Data: Business billing address, tax identification or VAT number, currency preference, and transaction histories. Payment card details are tokenized and processed directly by our PCI-DSS Level 1 certified payment gateway (Stripe); we do not store full primary account numbers (PAN) or security codes on our servers.
• Communication Records: Customer support tickets, live chat transcripts, email correspondence, and deliverability advisory records.

B. Customer Subscriber Data (Processor)

• Subscriber Contact Attributes: Email addresses, telephone numbers, first and last names, postal codes, and custom metadata fields imported by the Customer.
• E-Commerce Synchronization Data: Transaction values, abandoned checkout timestamps, order histories, and SKU references ingested via Shopify, WooCommerce, or Stripe integrations.
• Opt-In Audit Evidence: Timestamp of consent capture, opt-in IP address, lead source URL, and double opt-in verification logs maintained by the Customer.

C. Transmission & Engagement Telemetry

• Campaign Metrics: Open timestamps, click timestamps, bounce error codes, spam complaint classifications, and unsubscribe events.
• Technical Connection Telemetry: Originating IP address, Mail Transfer Agent (MTA) response codes, TLS handshake versions, user-agent headers, and browser/client identifiers.

D. AI Studio Inputs

• Prompts, brand guidelines, subject line draft strings, and campaign briefing parameters submitted to RevSend AI Studio.

4. Lawful Bases for Processing Under UK GDPR

Pursuant to Article 6 of the UK GDPR, we process personal data only when substantiated by at least one of the following recognized legal bases:

5. Detailed Purposes of Data Processing

We process personal data strictly for legitimate operational purposes, including:

• Providing, maintaining, optimizing, and monitoring the RevSend Platform;
• Executing automated domain warmup schedules and SPF/DKIM/DMARC cryptographic alignments;
• Calculating deliverability health scores and detecting ISP filtering blockades;
• Processing recurring subscription billings and automated invoices;
• Generating real-time AI copywriting suggestions via AI Studio without storing Customer data for public model training;
• Investigating abusive sending behavior, phishing attacks, malware distribution, and terms violations; and
• Fulfilling statutory disclosure obligations under orders issued by competent courts in England and Wales.

6. Subscriber Data Ownership & Non-Monetization Covenant

6.1. Absolute Non-Monetization: The Company hereby covenants and guarantees that it does not sell, rent, lease, monetize, broker, or trade Customer subscriber lists, email databases, or behavioral records to any third party, broker, or advertising syndicate.

6.2. Logical Tenant Isolation: All Customer Data resides in logically isolated database schemas. One Customer's subscriber database is never combined, cross-referenced, or enriched with the subscriber data of another Customer.

6.3. Artificial Intelligence Safeguards: Private Customer subscriber email lists and recipient behaviors are never ingested into public foundational AI training sets.

7. Tracking Technologies, Web Beacons, and Cookies

7.1. Platform Cookies: We utilize essential session and authentication cookies strictly necessary to provide secure workspace access, prevent Cross-Site Request Forgery (CSRF), and maintain user preferences.

7.2. Campaign Tracking Pixels: In accordance with industry-standard deliverability telemetry, emails dispatched through the Platform may embed a transparent 1x1 pixel tracking beacon to detect message opens, and wrapped redirect hyperlinks to record click-through rates (CTR). Customers are contractually obligated under our AUP to notify subscribers of engagement tracking in their own published privacy notices.

8. Authorized Sub-processors and Third-Party Disclosures

8.1. We engage trusted third-party service providers ("Sub-processors") to support platform infrastructure. All Sub-processors are bound by stringent Data Processing Agreements with equivalent data protection covenants. Current categories of Sub-processors include:

• Cloud Infrastructure & Compute: Amazon Web Services EMEA SARL (London and Frankfurt data centers) • Google Cloud Platform (EU/UK regions);
• Payment Processing: Stripe Payments Europe Ltd (PCI-DSS Level 1 Service Provider);
• Transactional SMS Gateways: Twilio Ireland Limited / Sinch MessageMedia;
• DNS & Threat Intelligence: Cloudflare Inc. • Spamhaus Technology Ltd.

9. International Cross-Border Data Transfers

9.1. Our primary production servers are located within the United Kingdom and the European Economic Area (EEA).

9.2. Where data must be transferred outside the UK or EEA to global support hubs or cloud sub-processors, we enforce appropriate statutory transfer safeguards recognized under UK GDPR Chapter V:

• UK International Data Transfer Agreements (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs);
• European Commission Adequacy Decisions under Article 45 GDPR; and
• Supplementary technical safeguards, including end-to-end data encryption and strict access perimeter controls.

10. Data Retention, Archival, and Deletion Schedules

10.1. Active Account Data: Customer Data and subscriber records are maintained throughout the active duration of the Customer's subscription.

10.2. Post-Termination Purge: Following account closure or termination, the Customer has thirty (30) days to download export archives. Upon expiration of this 30-day period, all subscriber lists, campaigns, and custom fields are permanently overwritten and purged from live databases within fourteen (14) days.

10.3. Operational Backups: Encrypted backup snapshots rotate on a rolling thirty (30) day retention cycle, after which data is automatically purged.

10.4. Financial Invoices: In accordance with United Kingdom tax legislation (HMRC guidelines), billing receipts, VAT records, and payment invoices are retained for six (6) statutory financial years.

11. Technical and Organizational Security Measures (TOMs)

Pursuant to Article 32 of the UK GDPR, we implement enterprise-grade security protocols:

• Encryption at Rest: All database volumes, subscriber lists, and persistent storage are encrypted using AES-256 with managed cryptographic key rotation.
• Encryption in Transit: All web traffic and API interactions enforce Transport Layer Security (TLS 1.3 / TLS 1.2 minimum) with strict HTTPS enforcement and HSTS preloading.
• Access Control: Strict Principle of Least Privilege, role-based access controls (RBAC), multi-factor authentication (MFA) required for all internal administrators, and complete audit logging.
• Penetration Testing: Regular third-party black-box and white-box security audits and automated vulnerability scanning.
• Physical Data Center Security: Infrastructure hosted in ISO 27001, SOC-1, and SOC-2 Type II certified tier-3 data centers with biometric access controls and 24/7 CCTV surveillance.

12. Data Subject Rights and Requests

12.1. Under the UK GDPR and EU GDPR, individuals have statutory rights regarding their personal data:

• Right of Access (Article 15): Right to obtain confirmation and receive a copy of your personal data.
• Right to Rectification (Article 16): Right to rectify inaccurate or incomplete records.
• Right to Erasure ("Right to be Forgotten", Article 17): Right to request deletion of personal records.
• Right to Restriction of Processing (Article 18): Right to restrict processing under certain conditions.
• Right to Data Portability (Article 20): Right to receive data in a structured, machine-readable format (JSON/CSV).
• Right to Object (Article 21): Right to object to processing based on legitimate interests or direct marketing.

12.2. Subscriber Inquiries: If you are a subscriber on an email list managed by one of our Customers, please contact the sending brand directly, as they are the Data Controller. RevSend provides automated 1-click unsubscribe links and Customer workspace tools to honor such requests immediately.

12.3. Exercising Your Rights: To submit a Data Subject Access Request (DSAR) regarding Customer account information, email our Data Protection Officer at dpo@revsend.io. We respond to all verified requests within one (1) calendar month.

13. Security Incident and Data Breach Notification Protocols

In the unlikely event of a confirmed security incident resulting in unlawful access, alteration, or disclosure of Customer Data, the Company shall:

• Notify affected Customers without undue delay (and within forty-eight (48) hours of confirmation);
• Provide comprehensive details regarding the scope, affected records, and remedial measures undertaken; and
• Notify the UK Information Commissioner's Office (ICO) within seventy-two (72) hours where mandated by Article 33 of the UK GDPR.

14. Protection of Children's Privacy

The RevSend Platform is strictly engineered for commercial business use by adults aged 18 and older. We do not knowingly solicit, collect, or process personal data from children under 18 years of age. If you believe a child has provided us with personal data, please contact us immediately for prompt deletion.

15. Supervisory Authority and Right to Lodge a Complaint

If you are resident in the United Kingdom and believe our data processing violates statutory obligations, you have the right to lodge a formal complaint with the UK supervisory authority:

16. Amendments to this Privacy Policy

We may update this Privacy Policy periodically to reflect technological advancements, operational enhancements, or statutory revisions. We will notify Customers of material changes by posting an alert within the account dashboard or via direct email notice thirty (30) days prior to implementation.

17. Data Protection Officer and Corporate Inquiries

For any questions, concerns, or legal notices concerning this Policy, please direct communications to: