Privacy Policy

1. Introduction

ReveLumi is a company based in São Paulo, Brazil, that provides a technical platform for qualitative research over WhatsApp, combining artificial intelligence agents with real-time human supervision.

This Privacy Policy describes how ReveLumi collects, processes, stores, shares, and protects personal data in compliance with LGPD, GDPR, and other applicable data protection laws.

As a rule, ReveLumi acts as an operator or processor of research participants' personal data under documented instructions from the Contracting Organization. For platform user data and institutional data collected directly, ReveLumi acts as controller.

2. Key definitions

Contracting Organization means the legal entity that hires ReveLumi and defines the research objective, questions, context, contact base, and legal basis.

Participant means the individual who receives an invitation and voluntarily answers a WhatsApp interview. Research Data includes messages, audio, transcripts, attachments, and metadata generated during the interview. Insights are analytical results, themes, quotes, and reports derived from that data.

3. Roles and responsibilities

The Contracting Organization is responsible for obtaining contacts lawfully, informing participants when required, defining the research, selecting the audience, and handling data subject requests within its control.

As operator, ReveLumi processes data only for the contracted purpose, applies technical and organizational security measures, maintains logical isolation between organizations, observes retention periods, and cooperates with regulatory requests.

ReveLumi does not control the origin of contacts, the research topic, content voluntarily provided by participants, or later use of insights by the Contracting Organization.

4. Data we collect

Participant data may include WhatsApp phone number, name, email, profile metadata, conversation content, and technical message metadata.

Platform user data may include name, email, Google OAuth profile photo, panel interactions, preferences, settings, IP address, browser, and session information.

5. Legal bases

Processing may rely on consent, legitimate interest, contractual performance, or another applicable basis. The Contracting Organization is solely responsible for identifying, documenting, and demonstrating the valid legal basis for sharing contacts with ReveLumi and conducting the research.

6. How we use data

We use participant data to conduct interviews according to the Controller's configuration, generate insights and reports, operate the service, and monitor technical quality.

ReveLumi does not use identifiable participant data for direct marketing, independent commercial profiling, sale to third parties, or training third-party AI models.

We use platform user data for authentication, access control, operations, support, panel improvement, and operational communications.

6a. Usage data and product analytics

We use Amplitude for product analytics. We collect platform usage metadata, not interview content, reports, or research strategy.

To request deletion of your analytics data, contact the privacy email listed in this policy. Requests are processed under applicable law.

7. Sharing and subprocessors

We share data only with providers needed to operate the service, including Supabase, AWS, Google/Gemini, Meta/WhatsApp, Langfuse, and Amplitude.

ReveLumi does not sell personal data. The Contracting Organization receives Research Data and Insights generated from its own studies.

8. Ownership and use of insights

Research Data, transcripts, quotes, summaries, reports, and other Insights belong to the Contracting Organization. After that data is consumed, exported, or integrated by the Contracting Organization, subsequent processing is governed by that organization's policies.

9. International transfers

Personal data may be transferred to and processed on servers in the United States and other jurisdictions where subprocessors operate. We use appropriate safeguards, including standard contractual clauses when applicable.

10. Data retention

Conversation data is retained while the research is active and for the contractually defined period. Account data is retained while the account is active and deleted within 90 days after closure. Anonymized data may be retained indefinitely to improve the service.

11. Security

ReveLumi uses encryption in transit and at rest, Row Level Security, role-based access controls, OAuth 2.0, continuous monitoring, and least privilege for human access to production data.

No system is entirely immune to failures. If a security incident affects personal data, ReveLumi will notify the Contracting Organization and, when applicable, the competent authority.

12. Your rights

Depending on jurisdiction, you may have rights to access, correction, deletion, portability, objection, withdrawal of consent, processing restriction, and challenge of automated decisions.

To exercise rights within processing operated by ReveLumi, contact privacy@revelumi.com. Requests related to data already exported or consumed by the Contracting Organization should be directed to that organization.

13. Cookies and technologies

The ReveLumi platform uses strictly necessary cookies for authentication and basic operation. We do not use cookies for advertising tracking, remarketing, or behavioral profiling.

14. Minors

ReveLumi does not intentionally collect data from minors under 18 without consent from a legal guardian. The Contracting Organization is responsible for excluding minors from its base when the topic is not appropriate and for obtaining required consents.

15. Operator liability limitation

To the fullest extent permitted by applicable law, ReveLumi's liability is limited to its own failures in the technical execution of the service and custody of data under its processing.

16. Data Processing Agreement

Contracting Organizations that need a specific DPA may request a custom agreement at privacy@revelumi.com.

17. Policy updates

This policy may be updated from time to time. When significant changes are made, the date at the top of this page will be updated and, when applicable, platform users will be notified.

18. Contact and DPO

For privacy and data protection matters, contact privacy@revelumi.com. Address: São Paulo, SP, Brazil.

19. Governing law and venue

This policy is primarily governed by LGPD and other applicable Brazilian laws. For data subjects in the European Economic Area, GDPR applies complementarily. Disputes will be resolved in the courts of São Paulo, SP, without prejudice to the data subject's right to use the forum of their jurisdiction when applicable.