This English version is provided for convenience. In the event of any discrepancy, the French version prevails.

1. Data Controller

The controller of the data described here is:

Reavo, a French simplified joint-stock company (SAS) with a share capital of €200
Registered office: 9 rue de l’Herberie, 01600 Trévoux, France
Bourg-en-Bresse Trade and Companies Register no. 105 455 240 (EUID: FR0101.105455240)
Contact: contact@reavo.co

This policy covers three groups of people: visitors to the reavo.co website, Users of the app.reavo.co platform, and professionals whose details appear in Reavo’s prospecting database (“Prospects”).

2. Website Visitors

Audience measurement: we measure the website’s traffic and performance in aggregate, without cookies and without identifying visitors.
Contact form: name, email address, company (optional) and message, used to reply to you (legitimate interest) and kept for three years after our last exchange.
Booking a demo: demo bookings go through a scheduling service embedded in the website; the information you enter there (name, email, time slot) is passed to us to organise the meeting.

3. Platform Users

3.1 Data processed

Account: name, email address, password (stored in hashed form by our authentication provider, never readable by Reavo).
Your company: website, description of your business, your offers and your customers, service area, sender name, signature, and the documents, links and texts you upload.
Use of the Service: your searches, lists, drafted, approved and sent emails, sending dates and follow-ups.
Dedicated sending mailboxes (Pro and Growth plans): addresses provided by Reavo on its sending domains, with the display name you choose. Reavo sends the emails you have approved from these mailboxes and reads the messages they receive, to show you your prospects’ replies, sorted automatically, and stop their follow-ups. Reavo never asks you to connect your own mailbox and never reads it.
Reavo assistant: your conversations with the built-in assistant, and what it reads from your account to answer you; the ones you choose to forward are read by the Reavo team.
Subscription and billing: plan, dates, payment history and invoices. Card details are entered and stored by our payment provider; Reavo never has access to them.
Technical data: connection and error logs, needed for the security and proper operation of the Service.

3.2 Purposes and legal bases

Performance of the contract (art. 6.1.b GDPR): creating and managing the account, providing the Service, sending approved emails, billing, support.
Legal obligation (art. 6.1.c GDPR): keeping invoices and accounting records.
Legitimate interest (art. 6.1.f GDPR): platform security, fraud and abuse prevention, improving the Service, usage statistics.

For the documents and content you upload and for your emails, Reavo acts as a processor: it processes them only to provide the Service to you.

3.3 Reavo team access to your account

To help you (a question, a problem to solve) or for the security of the Service, an authorised member of the Reavo team may access your account and use it as you would, without knowing your password. Each access has a stated reason, is limited to thirty minutes, and is recorded in a log (who, when, why, and what was done) kept for one year. During such access, payment, subscription, password, mailbox connection and automatic sending remain blocked. This processing is based on the performance of the contract (support) and on our legitimate interest in keeping the Service secure. You can ask whether your account has been accessed in this way by writing to contact@reavo.co.

4. Prospects

This section informs professionals whose data Reavo collects without obtaining it directly from them (article 14 GDPR).

4.1 Data and sources

Reavo builds a database of companies and their decision-makers, intended for business-to-business prospecting. It contains: first and last name, job title, company, business email address and business phone number when published, links to public professional profiles, and the source and date of each piece of information.

This data comes from the public company register, company websites and their public archives, the press, business directories and search engine results. When no address has been found publicly, an address may be inferred from the format used by the company or confirmed by a provider specialised in finding and verifying business email addresses.

4.2 Purpose, legal basis and recipients

This data is used to allow Reavo’s Users to offer their products or services to professionals, in their professional capacity. This processing is based on the legitimate interest of Reavo and its Users in business-to-business prospecting (art. 6.1.f GDPR). The data of one person may be made available to several Users.

Every email drafted by Reavo allows the recipient to decline further contact with a single word in reply. Where their details came from (public sources: the company website, the Sirene register, professional directories and press) is stated in this policy and on request. The User who sends the email is responsible for sending it.

4.3 Retention and objection

Prospect data is kept for three years from its last collection or update, then deleted. Anyone may ask at any time to be removed from Reavo’s database by writing to contact@reavo.co: their data is then deleted, and only a minimal identifier is kept so that it is never collected again.

4.4 Your replies to the emails you receive

When you reply to an email sent through the Service, your reply is received by a Reavo sending mailbox, then read and classified automatically (interest, question, refusal, request to stop, automatic reply) so that it can be shown to the User who wrote to you and their follow-ups stopped. If you ask not to be contacted again, Reavo may record your objection itself: you are then no longer contacted by any User of the Service, and your data is removed from its database (section 4.3). This classification is based on the legitimate interest of Reavo and the User in handling replies and on the obligation to honour objections.

5. Artificial Intelligence

The Service uses artificial intelligence models to read and summarise company websites, judge how well they match a search, identify decision-makers, draft emails and follow-ups, sort the replies received by the dedicated sending mailboxes and answer in the assistant. The texts needed for these tasks (website content, information about your company, Prospect Data, replies received) are sent to these models at the time of processing, with specialised providers. Results are checked by automated rules and, for emails, read by the User before anything is sent. No decision producing legal effects concerning a person is made solely on the basis of this processing.

6. Processors and Recipients

Data is processed on our behalf by the following categories of providers:

Database, file and application hosting: servers located in the European Union (Paris region for the application).
Authentication: secure management of accounts and passwords.
Payment: secure payment processing, PCI-DSS certified.
Artificial intelligence models: the processing described in section 5.
Business email finding and verification: providers established in the European Union.
Dedicated sending mailboxes: providing the mailboxes, their domains and their warm-up, and the business email service that hosts them.
Email delivery: the Service’s notifications and contact form messages.
Team email: exchanges with Users and Prospects.

Each is contractually bound to protect the data entrusted to it and to process it only on our behalf. We do not sell or rent our Users’ data. Prospect Data is made available to Users under the conditions described in section 4. For the processing Reavo carries out on behalf of the User, Reavo’s commitments are set out in the Data Processing Agreement, schedule 2 of the Terms & Conditions.

7. Transfers outside the European Union

Some providers, in particular of artificial intelligence models, email delivery and payment, may process data outside the European Union, especially in the United States. These transfers are covered by appropriate safeguards: an adequacy decision (EU-US Data Privacy Framework, for certified companies) or the European Commission’s standard contractual clauses.

8. Retention Periods

User account and content (profile, documents, lists, emails): for the life of the account, then deleted within 30 days of its closure.
Invoices and accounting records: 10 years, as required by law.
Technical logs: 12 months at most.
Log of Reavo team access to your account: 1 year (section 3.3).
Contact form messages: 3 years after the last exchange.
Prospect data: 3 years after its last collection or update (section 4.3).

9. Cookies

The application only uses cookies that are strictly necessary for it to work (keeping you signed in, security). The website sets no advertising or tracking cookies, and its audience measurement works without cookies. These necessary cookies do not require consent (article 82 of the French Data Protection Act), which is why no cookie banner is shown. The embedded demo scheduling service may set its own cookies when you use it.

10. Your Rights

Under the GDPR and the French Data Protection Act, you have the rights of access, rectification, erasure, restriction, portability and objection, as well as the right to set instructions regarding your data after your death. Prospects in particular may object at any time to the processing of their data (section 4.3).

To exercise these rights, write to us at contact@reavo.co. We reply within one month. You may also lodge a complaint with the CNIL, the French data protection authority: www.cnil.fr.

11. Security

Reavo implements appropriate technical and organisational measures: encrypted connections (HTTPS), separation of each account’s data at database level, encryption of access to dedicated sending mailboxes, payment data entrusted to a certified provider, access to data restricted to authorised people, and every team access to an account justified, time-limited and logged (section 3.3).

12. Data Breaches

In the event of a data breach likely to put your rights and freedoms at risk, Reavo notifies the CNIL within 72 hours of discovering it and informs you as soon as possible when the risk is high, in accordance with articles 33 and 34 GDPR.

13. Changes

We may change this policy. In the event of a substantial change, Users are informed by email or within the Service. The date of the last update appears at the top of this page.

14. Contact

For any questions regarding this policy or your personal data: contact@reavo.co

Privacy Policy