================================================================================ REVERN PRIVACY POLICY ================================================================================ Effective date: 20 August 2026 Last updated: 20 August 2026 Version: 1.0 Data controller: REVERN Location: New South Wales, Australia All privacy enquiries: help@revern.io (mark the subject "Privacy") This Privacy Policy explains how Revern collects, holds, uses and discloses Personal Information. It is written to meet the requirements of Australian Privacy Principle 1.3 (an APP privacy policy), Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 and the UK GDPR, and the notice requirements of the California Consumer Privacy Act as amended by the California Privacy Rights Act. It forms part of, and should be read with, the Revern Terms of Service (tos.txt). -------------------------------------------------------------------------------- CONTENTS -------------------------------------------------------------------------------- 1. What Revern is, in one paragraph 2. Summary of our key privacy commitments 3. Scope of this policy 4. Our roles: controller and processor 5. Information we collect 6. Information we deliberately do not collect 7. How photographs are handled, step by step 8. Why we process, and our legal bases 9. Automated processing and AI 10. People who appear in the images you upload 11. Biometric information 12. Who we disclose information to (sub-processors) 13. Overseas disclosure and international transfers 14. Sharing within an Organisation 15. How long we keep information 16. Deletion and how to delete your data 17. Security 18. Cookies, storage and tracking 19. Marketing communications 20. Your rights, generally 21. Australian rights and complaints 22. European Economic Area and United Kingdom rights 23. California and other United States state rights 24. Other jurisdictions 25. Data breach notification 26. Government and law enforcement requests to us 27. Children 28. Changes to this policy 29. How to contact us and how to complain ================================================================================ 1. WHAT REVERN IS, IN ONE PARAGRAPH ================================================================================ Revern is an artificial intelligence tool that takes a photograph and estimates where it was taken, or what make and model of vehicle appears in it. It is used by councils, agencies, emergency services, researchers and insurers. Because photographs frequently contain images of people, vehicles, homes and other things connected to identifiable individuals, we have designed the system so that it never attempts to identify a person, never uses a face as evidence of where a photograph was taken, never reads a numberplate, and never writes an uploaded photograph to our servers' storage. This policy explains all of that in detail, including where copies of an image do exist, and for how long. ================================================================================ 2. SUMMARY OF OUR KEY PRIVACY COMMITMENTS ================================================================================ This summary is a convenience. The detailed sections govern. * We do not store your photographs. Our analysis backend holds an uploaded image only in memory for the duration of the request. It is never written to disk and never written to object storage. See Section 7. * We do not use faces. Face detection, face matching and face recognition are not enabled anywhere in the system. The location agent is instructed that faces and body features must never inform a location estimate. See Sections 6 and 11. * We do not read numberplates. The vehicle agent is instructed never to read or report a registration mark. It identifies a model, not a vehicle, and not a keeper. See Section 6. * We do not send your device's GPS coordinate to our server. If a photograph has embedded GPS, the coordinate stays on your device. Our server is told only a true or false value indicating that GPS was present. See Section 5.4. * We do not train models on your data. Not our models, and not anyone else's. Our model providers operate under terms that exclude submitted content from provider training. See Section 9.4. * Our logs record shapes, not content. The analysis backend's audit log records that a request happened, what type it was, how many text lines and candidates were involved, and how long it took. We separately keep operational telemetry against your account, covering route, status, duration, model, token counts, cost and credits charged. Neither records the image, the recognised text, or the resolved coordinate. See Section 5.7. * We store the answer, not the question. A saved case file contains the coordinate, radius, tier, confidence, candidates, evidence and notes. It does not contain the photograph. See Section 5.5. * Your data is disclosed overseas. Analysis requires sending your image to model and vision providers outside Australia, including in the United States. If you enable certain optional models, this includes providers outside Australia, the EEA and the United States. See Sections 12 and 13. ================================================================================ 3. SCOPE OF THIS POLICY ================================================================================ 3.1 This policy applies to Personal Information we collect through: (a) the Revern operator console at https://revern.io and its subdomains; (b) the Revern mobile applications; (c) the Revern analysis backend and any Revern API; (d) our marketing site, sales enquiries and support channels; and (e) our dealings with customers, prospects, suppliers and applicants. 3.2 This policy does not apply to: (a) third-party websites, services or content we link to; (b) the internal privacy practices of a customer organisation using Revern, which are governed by that organisation's own policy; or (c) the handling of Personal Information by a third-party provider under its own controller relationship with you, such as Stripe's handling of your payment card, or Google's or Apple's handling of your single sign-on account. 3.3 "Personal Information" in this policy means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether recorded in a material form or not. Where the GDPR applies, it also means "personal data" as defined in Article 4(1). ================================================================================ 4. OUR ROLES: CONTROLLER AND PROCESSOR ================================================================================ 4.1 We act as a data controller (an APP entity handling information for our own purposes) in respect of: * account and identity information; * organisation and membership records; * onboarding answers; * billing, subscription and credit ledger records; * technical, security and audit logs; * support correspondence; and * marketing and website analytics. 4.2 We act as a data processor on your behalf, and you are the controller or APP entity, in respect of: * the photographs and supporting frames you upload; * the text, capture time, camera model, scope and area hints you supply; * the case files produced from them, including coordinates, radii, evidence, notes, vehicle candidates and summaries. Where we act as your processor, we process that data only on your documented instructions, which for the self-service product are these Terms and your use of the console. We do not determine the purposes for which you analyse an image, and we do not know what investigation it relates to. 4.3 If you require a written data processing agreement, standard contractual clauses, a UK international data transfer addendum, or an equivalent instrument, contact help@revern.io. Our standard data processing addendum is available on request. ================================================================================ 5. INFORMATION WE COLLECT ================================================================================ 5.1 ACCOUNT AND IDENTITY INFORMATION Collected when you create an account or sign in. * Email address. * Password, stored only as a salted hash by our authentication provider. We never see or store your plaintext password. * Display name, where you provide one or where it is supplied by your single sign-on provider. * Where you sign in with Google or Apple: the identifier, email address and, where released, the name supplied by that provider. Apple users may elect to use Apple's private email relay, in which case we receive only the relay address. * Account creation and update timestamps. * Email confirmation and password reset state. * Session and refresh tokens issued by our authentication provider. Source: you, or your single sign-on provider. 5.2 ORGANISATION AND MEMBERSHIP INFORMATION Collected when you create or join an organisation. * Organisation name. * Organisation kind, being one of: local council, state agency, federal or national agency, emergency service, private company, or other. * The identity of the organisation owner. * The membership roster, including each member's account identifier, role (owner or operator) and the date they joined. * Invitations, including the invited person's email address, their account identifier, the identifier of the person who sent the invitation, and the invitation's status. * Which workspace you are currently acting in (personal, or a named organisation). Source: you, and other members of your organisation. Note on invitations: to invite someone, we look up whether the email address you give corresponds to an existing Revern account. The lookup returns only whether an account exists and, if so, its internal identifier. It does not disclose any other information about that person to you, and it does not expose the list of Revern account holders. 5.3 ONBOARDING INFORMATION Collected once, during first-run onboarding. Answering is required to complete onboarding; the free-text fields are optional. * What you will use Revern for (investigations and enforcement; emergency and incident response; planning, assets and compliance; research and open-source verification; insurance and claims; or free text). * Your role (investigator or officer; analyst; ranger or compliance officer; emergency management; engineering or planning; team lead or manager; executive; IT or data; or free text). * Which capability you want to start with. * How many people will use Revern. * How you do this work today, including whether you currently use manual search, satellite or street-level imagery, GIS, a commercial OSINT platform, a general-purpose AI assistant, or nothing formal. * The date you completed onboarding. We use these answers to configure your console, to recommend a plan, and to decide what to build next. We do not sell them and we do not disclose them outside our own product and analytics work. 5.4 ANALYSIS INPUT Collected each time you run an analysis. This is the most sensitive category we handle and Section 7 sets out its full lifecycle. What is transmitted to our analysis backend: * The photograph, as a base64-encoded image at up to 2576 pixels on the long edge. It is sent at full frame and is deliberately not cropped or redacted, because the agent zooms into regions of it during the investigation and anything removed beforehand can never be recovered. * Any supporting frames you add, being further views of the same place. * Any region you draw around a particular vehicle in a busy frame. * The capture timestamp from the image's EXIF metadata, where present. This is used for sun angle and shadow reasoning. * The camera make and model from EXIF, where present. * A boolean indicating whether the image contained embedded GPS. * Any search scope you set, being an ISO country code. * Any area hint you type, in free text, such as a suburb and state. * Text recognised on your device by on-device optical character recognition, with confidence values. * Country hints and clue labels derived on your device. * Place-name strings worth sending to a geocoder. * Your interface locale. * Which model you selected and whether you chose a faster or fuller run. * Your authentication token, which is verified before any work begins. What is NOT transmitted: * The GPS coordinate embedded in the image. Only the boolean is sent. This is a deliberate design decision: it means a server-side estimate cannot be contaminated by the answer, and it means we never receive the actual location of your device or of the photograph from its metadata. * Your device's live location. * Any EXIF field other than capture time and camera make and model. 5.5 ANALYSIS OUTPUT AND CASE FILES Stored in our database when an analysis completes and is saved. For a location result: * A result identifier. * Your account identifier and, where the result is filed to an organisation, the organisation identifier. * Creation timestamp. * The confidence tier. * Place name, locality, region and country, where determined. * Latitude and longitude. * The radius of uncertainty in metres. * A confidence value. * The duration of the run in milliseconds. * The full candidate set, retained verbatim as structured data, including each candidate's coordinate, radius, place names, and evidence entries. * The agent's notes and caveats. For a vehicle result: * A result identifier, your account identifier, any organisation identifier, and a creation timestamp. * The leading candidate's make, model, year range and body style. * A confidence value and the run duration. * A written summary. * The full candidate set, including each candidate's reasoning, observations, and the URLs and attribution of the reference photographs retrieved for comparison. Case files contain no photograph. They contain the derived result only. IMPORTANT: a case file may nonetheless constitute Personal Information about a third party in your hands, because a coordinate can be a person's home. See Section 10. 5.6 BILLING AND SUBSCRIPTION INFORMATION * Your plan, billing period and renewal date. * Your credit balance. * An append-only credit ledger recording, for each movement: the amount, the resulting balance, the reason (location, car, refine, grant, top-up, renewal), the seconds of agent time a charge covers, and an optional note. * Our payment processor's customer identifier and subscription identifier for your account. * A record of which purchases have already been applied, so a payment announced more than once is only credited once. We do not collect or store your card number, expiry date, or security code. Those are collected directly by our payment processor. We receive from the processor only the identifiers above, the amount, the currency, the outcome, and the billing email address you gave it. 5.7 TECHNICAL, SECURITY AND AUDIT INFORMATION Analysis backend audit log. Deliberately narrow. For each request it records: * The event type (locate, locate refused, locate rejected, car, car refused, feedback, or error). * A short non-cryptographic hash of the requesting IP address, used to correlate requests from the same source for rate limiting and abuse detection. The raw IP address is not written to this log. * Counts only: how many lines of recognised text, how many place queries, whether an image was present (true or false), how many supporting frames, and how many candidates were returned. * The duration of the request. * A short reason string on a refusal, rejection or error. It does not record the image, the recognised text itself, the place queries themselves, or any resolved coordinate. This is a deliberate constraint so that we cannot build a log of where people have been. Rate limiting. We hold, in memory and for at most one minute, a counter of requests against the hashed IP address. The default limit is twenty requests per minute. Caching. Resolved place lookups and vehicle reference-image lookups are cached in memory, keyed on the query string, for up to twenty-four hours. The cache holds no image and no account identifier. Identity cache. A verified session token is cached in memory for sixty seconds so that a multi-request analysis does not re-verify on every call. Operational telemetry. Separately from the audit log above, our analysis backend writes one row per request to an internal `api_requests` table and one row per failure to an internal `error_events` table. Unlike the audit log, these records are linked to your account identifier, because they exist so that we can measure the service commercially and support you. They record: * your account identifier, where you were authenticated; * the route called, the HTTP method, the status code, and whether it succeeded; * the duration of the request; * the hashed client value described above; * which model and provider ran, the input, output and cached token counts, our computed provider cost in USD, and the credits charged; * for failures: the error kind, a truncated error message, a stack trace, the route, and a grouping fingerprint in which identifiers and numbers are stripped so that one fault affecting many operators appears as one row with a count. These tables do not record the image, the recognised text, the place queries, or any resolved coordinate. They carry row-level security with no policy at all, which means they are unreachable from any browser session and are written and read only with our server-side privileged key. Administrative dashboard. We operate an internal dashboard, accessible only to authorised Revern personnel, which reads the telemetry tables above in order to monitor availability, error rates, provider cost and usage. It does not display uploaded images, recognised text or case file coordinates. Infrastructure logs. Our hosting providers generate their own request logs which may include IP addresses, user agents, timestamps, request paths and response codes. These are held under those providers' retention policies and are used for operations, security and abuse investigation. Application error reports. Where the console or backend encounters an error, we may record a stack trace, the request shape, and a short reason string. We take care that these do not include image content. 5.8 SUPPORT, SALES AND FEEDBACK * Correspondence you send to help@revern.io, help@revern.io, help@revern.io, help@revern.io or help@revern.io, including anything you choose to attach. * Records of enterprise enquiries, quotes and negotiations. * Accuracy feedback: where you explicitly choose to tell us that a result was right or wrong, we record the verdict and the hashed client value. We do not receive the image or the coordinate with it. This is used only to evaluate accuracy and is never used for training. 5.9 WEBSITE AND PRODUCT ANALYTICS We use Vercel Web Analytics on the console and marketing site. It is a privacy-oriented, cookieless analytics product: it does not set a cookie, does not use a persistent device identifier, and does not track visitors across sites. It records: * pages viewed and the referring page; * country, and where available region and city, derived from the IP address at the edge. Vercel does not store the raw IP address; * browser, operating system and device type; * a hash derived from the request that distinguishes visits within a single day and is discarded daily, so a visitor cannot be followed from one day to the next. See Section 18 for cookies and Section 19 for marketing. ================================================================================ 6. INFORMATION WE DELIBERATELY DO NOT COLLECT ================================================================================ The following are design constraints of the system, not merely statements of current practice. 6.1 Faces. We do not enable face detection, face landmarking, face matching, or face recognition anywhere in the system. Our landmark and logo detection provider is called with only two features requested, landmark detection and logo detection; face and object detection are not requested. The location agent's instructions state that it must never attempt to identify a person and never name one, and that faces and body features must never inform a location estimate. Clothing, uniforms and dress may be read as cultural or regional context only. 6.2 Numberplates. The vehicle identification agent's instructions state that it must never read or report a numberplate, because a plate identifies a keeper rather than a car. Vehicle identification returns a make, model, generation or year range and body style. 6.3 Individual vehicles. The reference photograph lookup can find photographs of a model. It cannot and does not find a specific vehicle. 6.4 The photograph itself, on our servers. See Section 7. 6.5 Your embedded GPS coordinate. See Section 5.4. 6.6 Payment card details. See Section 5.6. 6.7 Sensitive information, as a matter of intent. We do not seek to collect information about your health, disability, racial or ethnic origin, political opinions or associations, religious or philosophical beliefs, trade union membership, sexual orientation or practices, criminal record, or genetic or biometric characteristics. We recognise that a photograph you upload may incidentally contain such information, for example an image taken outside a place of worship, a medical facility or a political gathering. We do not analyse for it, do not infer it, and do not retain the photograph. The Terms of Service prohibit you from using Revern to infer any of it. 6.8 Limits of these commitments. These are constraints we place on our system and its instructions. They are strong, but they are safeguards rather than absolute technical guarantees, because the underlying components are probabilistic. We do not warrant that they can never be circumvented by a determined user, and the Terms of Service prohibit attempting to circumvent them. If you believe you have observed a failure of any of these commitments, please report it to help@revern.io. ================================================================================ 7. HOW PHOTOGRAPHS ARE HANDLED, STEP BY STEP ================================================================================ This is the most important section of this policy. Read it in full. 7.1 On your device or in your browser. When you select an image, the console reads it locally. On-device text recognition and clue extraction run before anything is sent. The console stores the image for the run in progress in your browser's IndexedDB, in a database named "revern", so that reloading the page does not lose an analysis that is mid-flight or just completed. This copy is on your own machine, under your control, and is not accessible to us. It is replaced when you start a new run, and it is removed when you clear your browser's site data for revern.io. The mobile application keeps its own local history file on the device so that the app works offline. That copy is on your device and is not uploaded. 7.2 In transit. The image is transmitted to our analysis backend over TLS, base64 encoded, at up to 2576 pixels on the long edge. 7.3 On our analysis backend. The image is decoded into memory. It is normalised: we detect the true format from its magic bytes rather than trusting the declared type, and where a request will carry several images we produce a capped copy at up to 2000 pixels on the long edge, because that is the limit our model provider imposes on multi-image requests. The full-resolution copy is retained in memory only so that the agent's zoom tool can crop from it without losing detail. The image is never written to disk. It is never written to object storage. It is never placed in a queue, a cache, or a database. It exists only in the memory of the process handling your request, and that memory is released when the request ends. We do not operate a Supabase Storage bucket for uploaded images. There is no image table. 7.4 Disclosure to processing providers. To analyse the image we must send it to third parties. Specifically: (a) The reasoning model provider. The full frame, the capped copy, and any zoomed crops the agent takes are sent to the model provider you selected in the model picker. By default this is Anthropic. See Section 12 for the full list and Section 13 for where they are located. (b) The landmark and logo detection provider, where configured. A copy of the frame is sent to Google Cloud Vision with only landmark detection and logo detection requested. (c) Street-level imagery provider. We do not send your image to the street-level imagery provider. We send it a coordinate and a heading, and it returns a panorama image to us for the agent to compare against your frame. The coordinate we send is the agent's current hypothesis. (d) Geocoding providers. We do not send your image. We send place-name strings and coordinates. (e) Points-of-interest data. We do not send your image. We send bounding boxes and feature types. (f) Web search and web page retrieval. We do not send your image. The agent constructs text search queries describing what it sees, such as "skyline with tower shaped like" or an exact string it read from a sign, and may fetch a page to confirm. These queries are executed through our model provider's search tooling. A query may describe features of your image in words. (g) Vehicle reference photographs. We do not send your image. We send a text query naming a make, model and year to a public media repository, which returns photographs of that model. 7.5 After the analysis. The image is discarded from our backend's memory with the request. What survives is the case file described in Section 5.5, which contains the derived result and not the photograph. 7.6 Retention by our processing providers. Our providers apply their own retention. We have configured our model providers under business or enterprise terms which exclude submitted content from being used to train their models. Providers may nonetheless retain submitted content for a limited period for abuse monitoring, safety and legal compliance, typically up to thirty days, in accordance with their published terms. We do not control those periods. Links to each provider's policy are in Section 12. 7.7 What this means in practice. If you upload a photograph of a person's house, our servers do not keep the photograph. Our providers may hold it briefly. The coordinate we estimate, however, is saved to your case archive, may be shared with your organisation, and is Personal Information about that household if the household is reasonably identifiable from it. Section 10 explains your responsibilities in that situation. ================================================================================ 8. WHY WE PROCESS, AND OUR LEGAL BASES ================================================================================ 8.1 Purposes. We process Personal Information to: (a) create and administer your account and authenticate you; (b) provide the analysis service you request; (c) create, store, display and share case files within the workspace you selected; (d) meter usage, maintain your credit ledger, take payment and prevent duplicate or missed billing; (e) operate organisations, memberships and invitations; (f) configure your console and recommend a plan based on your onboarding answers; (g) provide support and respond to your correspondence; (h) secure the service, apply rate limits, detect and investigate abuse, fraud and misuse, and enforce the Terms of Service; (i) evaluate and improve the accuracy of the product, using aggregate and de-identified information and voluntary accuracy feedback, but never by training a model on your data; (j) understand product usage in aggregate and plan development; (k) send service communications, and, where permitted, marketing; (l) comply with our legal obligations, including tax, accounting, anti-money-laundering and sanctions obligations; and (m) establish, exercise or defend legal claims. 8.2 Legal bases under the GDPR and UK GDPR. Where the GDPR or UK GDPR applies, we rely on the following bases. Purpose Legal basis -------------------------------- ------------------------------------------ Account creation and Art. 6(1)(b) performance of a contract authentication Providing the analysis service Art. 6(1)(b) performance of a contract to you (your own data) Processing image content Art. 6(1)(f) legitimate interests of the relating to third parties controller. Where you are our customer, you are the controller and you must identify your own lawful basis. We process it as your processor under Art. 28. Storing case files Art. 6(1)(b) performance of a contract Organisations and invitations Art. 6(1)(b) performance of a contract, and Art. 6(1)(f) legitimate interest in enabling team collaboration Onboarding answers Art. 6(1)(f) legitimate interest in configuring the product and understanding demand Billing and payment Art. 6(1)(b) performance of a contract, and Art. 6(1)(c) legal obligation for tax and accounting records Security, rate limiting, abuse Art. 6(1)(f) legitimate interest in detection, audit logging protecting the service and third parties, and Art. 6(1)(c) where required by law Accuracy evaluation and Art. 6(1)(a) consent, for voluntary voluntary feedback feedback; Art. 6(1)(f) for aggregate and de-identified analysis Service communications Art. 6(1)(b) performance of a contract Marketing to business contacts Art. 6(1)(f) legitimate interest, subject to opt-out; Art. 6(1)(a) consent where required by local law Legal compliance Art. 6(1)(c) legal obligation Legal claims Art. 6(1)(f) legitimate interest, and Art. 9(2)(f) where special categories are incidentally involved 8.3 Legitimate interests assessment. Where we rely on legitimate interests, we have considered the necessity of the processing, the reasonable expectations of the individuals concerned, and the impact on them, and we have concluded that our interests are not overridden. The principal mitigations are the design constraints in Section 6, the non-retention of images in Section 7, the deliberately narrow audit logging in Section 5.7, and the contractual prohibitions on targeting individuals in the Terms of Service. You may object to legitimate-interests processing under Section 22. 8.4 Australian Privacy Principles. Where the Privacy Act 1988 (Cth) applies, we collect Personal Information only where it is reasonably necessary for our functions and activities (APP 3), by lawful and fair means, and generally from the individual concerned. Where we collect Personal Information about an individual from someone else, which is inherently the case for people depicted in an uploaded photograph, it is impracticable for us to notify that individual under APP 5, because we do not know who they are, do not attempt to identify them, and do not retain the image from which they might be identified. Section 10 sets out the customer's corresponding obligation. ================================================================================ 9. AUTOMATED PROCESSING AND AI ================================================================================ 9.1 The core of the service is automated. A large multimodal model, directed by an agent loop, reasons about your image, calls tools, retrieves external data and produces an estimate. Reasoning traces and evidence entries are surfaced in the console so that a human reviewer can see how the system reached its answer. 9.2 Not a decision about you. The system does not make any decision about the user of the service. It does not score you, profile you, price you differently, or determine your eligibility for anything. 9.3 Article 22 GDPR. Article 22 gives individuals a right not to be subject to a decision based solely on automated processing which produces legal effects or similarly significantly affects them. Revern does not make such decisions. However, a customer using Revern in an enforcement, compliance, insurance or investigative context could produce such an effect on a third party. For that reason: (a) the Terms of Service require the customer to obtain meaningful human review before any action is taken on an output; (b) the Terms of Service prohibit taking adverse action on an output alone; and (c) the customer, not Revern, is the controller of that decision and is responsible for Article 22 compliance, including providing the data subject with meaningful information about the logic involved. If you are an individual who believes an automated Revern output has affected you, contact the organisation that ran the analysis. You may also contact us at help@revern.io and we will assist that organisation to respond, but we will not usually be able to identify you in our records, because we do not retain the images and do not index case files by the people who might appear in them. 9.4 No training on your data. We do not use your inputs, outputs or case files to train, fine-tune, retrain, evaluate or otherwise improve any machine learning model, whether ours or a third party's. Our model providers are engaged under business or enterprise terms under which submitted content is not used for provider model training. Voluntary accuracy feedback is used for evaluation only, never for training. 9.5 Accuracy is not guaranteed. Output is a probabilistic estimate and may be wrong. The system expresses its uncertainty through a radius, a confidence value and a tier, and applies a policy under which an address-level result is not returned without independent supporting evidence. That policy reduces but does not eliminate the risk of an overprecise answer. See Section 13 of the Terms of Service. 9.6 Human oversight. We conduct periodic review of refusal behaviour, sample outputs, and reported failures. Where a systemic accuracy or safety problem is identified we will address it, and where appropriate notify affected customers. ================================================================================ 10. PEOPLE WHO APPEAR IN THE IMAGES YOU UPLOAD ================================================================================ 10.1 A photograph submitted to Revern may contain, or relate to, Personal Information about people who are not our customers and who have no relationship with us. It may show people, a person's home, their vehicle, their workplace, or their property. 10.2 If you upload such an image, you are the controller or APP entity in respect of that Personal Information. We process it as your processor, under your instruction, and only to perform the analysis you requested. 10.3 Your obligations. Before uploading, you must satisfy yourself that: (a) you have a lawful basis to collect, hold, use and disclose the Personal Information in that image for the purpose of the analysis; (b) you have complied with any collection notice, consent, authorisation, warrant, statutory function or exemption your jurisdiction requires; (c) the image was not obtained through unlawful surveillance, unlawful interception, trespass, unlawful access or deception; (d) you have completed any privacy impact assessment, data protection impact assessment or algorithmic impact assessment required before deploying an automated visual analysis tool; and (e) you will record any resulting estimate as an unverified inference rather than as a fact, consistent with APP 10 and GDPR Article 5(1)(d). 10.4 Our mitigations. We reduce the risk to those individuals by not retaining the image, by never attempting to identify a person, by never using a face as evidence, by never reading a numberplate, by not logging the recognised text or the resolved coordinate, by rate limiting so that bulk automated use is impractical, and by instructing the system to decline requests that appear aimed at tracking or confronting a specific private individual. 10.5 If you are such a person. If you believe your Personal Information has been processed through Revern by one of our customers, please contact that customer, who is the controller. If you do not know who it was, or need assistance, write to help@revern.io and we will help where we reasonably can. Please understand the practical limits: we do not retain uploaded photographs, we do not perform face recognition, and we do not index case files by the individuals who might appear in the underlying images, so we will usually be unable to search our systems for you by name or by likeness. We can act on a specific case file identifier or coordinate if you can supply one, and we will pass a request to the relevant customer. ================================================================================ 11. BIOMETRIC INFORMATION ================================================================================ 11.1 We do not collect, capture, generate, store, use, disclose, sell, lease, trade or otherwise profit from biometric identifiers or biometric information, as those terms are used in the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, the Washington My Health My Data Act, or the Privacy Act 1988 (Cth) definition of biometric information and biometric templates. 11.2 Specifically, we do not create, derive or retain a face template, face geometry scan, faceprint, voiceprint, retina or iris scan, fingerprint, hand scan, or gait or body-shape template from any image. 11.3 Face detection, face landmarking, face matching and face recognition features are not enabled in any provider integration used by the service. Our landmark and logo detection provider is invoked with only landmark and logo detection requested. 11.4 The reasoning model that analyses an image is a general multimodal model and, in the ordinary course of interpreting a scene, forms transient internal representations of everything in the frame. Those representations are not biometric templates, are not extracted, are not persisted by us, and are not used for identification. The model is instructed not to identify or name any person and not to use faces or body features as evidence. 11.5 We do not sell, licence, disclose or otherwise make available any image or any derived representation of a person to any data broker, advertiser, or identification service. ================================================================================ 12. WHO WE DISCLOSE INFORMATION TO ================================================================================ 12.1 We do not sell Personal Information, and we do not share it for cross-context behavioural advertising. 12.2 We disclose Personal Information to the following categories of recipient. A. SUB-PROCESSORS AND SERVICE PROVIDERS Provider Purpose Data disclosed --------------------- ------------------------------ ---------------------- Anthropic PBC Primary reasoning model for Uploaded image, capped (United States) location and vehicle copy, zoomed crops, analysis; agentic web search recognised text, hints, and web page retrieval tools prompts, search queries OpenAI, L.P. Alternative reasoning models, Uploaded image and (United States) where you select one in the associated prompt model picker content Moonshot AI Alternative reasoning models, Uploaded image and (People's Republic where you select one in the associated prompt of China) model picker. See the warning content in Section 13.4. Google LLC Landmark detection and logo Uploaded image (Cloud Vision) detection only. Face and (United States) object detection not requested. Google LLC Street-level panorama imagery Coordinate, heading and (Street View Static for visual comparison, and the field of view. No and Maps JavaScript) in-console panorama viewer uploaded image. Mapbox, Inc. Forward and reverse geocoding, Place-name strings, (United States) map tiles and the globe view coordinates OpenStreetMap Fallback geocoding (Nominatim) Place-name strings, Foundation and feature inventory coordinates, bounding (United Kingdom, (Overpass) boxes community-operated) Wikimedia Foundation Reference photographs of Text query naming a (United States) vehicle makes and models make, model and year Supabase, Inc. Authentication, database and All account, (United States, row-level security organisation, case with regional file, credit and project hosting) billing-reference data Stripe, Inc. Payment processing, Email address, account (United States) subscriptions and invoicing identifier, amount, and the card details you give Stripe directly Vercel Inc. Hosting of the operator Request metadata, IP (United States) console, and cookieless web address, user agent, analytics page views, coarse location derived from IP at the edge Render Services, Inc. Hosting of the analysis Request metadata, IP (United States) backend address, user agent Google LLC / Apple Single sign-on, where you Authentication Inc. choose it assertion, identifier, email address We may add or change sub-processors. An up-to-date list is maintained at https://revern.io/subprocessors. Enterprise customers may subscribe to notification of changes. B. PROFESSIONAL ADVISERS Lawyers, accountants, auditors and insurers, under duties of confidentiality, where reasonably necessary. C. LAW ENFORCEMENT, REGULATORS AND COURTS Where required or authorised by law, or where reasonably necessary to protect life, prevent serious harm, or establish, exercise or defend legal claims. See Section 26. D. CORPORATE TRANSACTIONS A prospective or actual purchaser, investor or successor in connection with a merger, acquisition, financing, reorganisation or sale of assets, under confidentiality obligations. If such a transaction completes, your information may be transferred, and this policy will continue to apply until the successor publishes a policy that is no less protective, of which you will be notified. E. WITHIN YOUR ORGANISATION See Section 14. 12.3 Aggregate and de-identified information. We may create and disclose aggregate or de-identified statistics that do not identify any individual, for example the median duration of an analysis or the distribution of confidence tiers. We do not attempt to re-identify de-identified information and we contractually prohibit recipients from doing so. ================================================================================ 13. OVERSEAS DISCLOSURE AND INTERNATIONAL TRANSFERS ================================================================================ 13.1 Australian Privacy Principle 8. We disclose Personal Information to recipients outside Australia. The countries in which those recipients are likely to be located are: * United States of America * United Kingdom * Member states of the European Union * Singapore, and other regions where our database provider hosts projects * People's Republic of China, only where you select a Moonshot model Before disclosing, we take reasonable steps to ensure the recipient does not breach the Australian Privacy Principles, principally by contract. You acknowledge that, in respect of a disclosure to an overseas recipient made with your consent or as necessary to provide the service you requested, we may not be accountable under the Privacy Act for that recipient's handling, and you may not be able to seek redress in Australia. 13.2 GDPR and UK GDPR transfers. Where we transfer personal data out of the EEA or the United Kingdom, we rely on: (a) an adequacy decision, where one applies to the destination; (b) the European Commission's Standard Contractual Clauses (Decision 2021/914) and, for the United Kingdom, the ICO's International Data Transfer Addendum; and (c) supplementary technical and organisational measures, including encryption in transit and the non-retention of images described in Section 7. A copy of the transfer mechanism relevant to your data is available from help@revern.io. 13.3 Transfer impact. We have assessed the principal transfers and consider the risk to be mitigated by the fact that we do not retain images, that our audit logging excludes content and coordinates, and that case files contain derived results rather than source material. Nonetheless, transfer of an image to a model provider for analysis is inherent to the service and cannot be avoided while using it. 13.4 IMPORTANT WARNING ABOUT OPTIONAL MODEL PROVIDERS. The model picker may offer models operated by Moonshot AI, which is based in the People's Republic of China. If you select such a model, your uploaded image and the associated prompt content are transmitted to and processed in the People's Republic of China, which is not the subject of an adequacy decision under the GDPR and whose legal framework provides state authorities with broad access powers. Selecting one of these models is your decision and, by doing so, you instruct us to make that transfer. We strongly recommend that government, law enforcement, emergency service and regulated customers, and any customer handling images relating to identifiable individuals, restrict their operators to the default provider. Enterprise customers can have non-default providers disabled at the account level. Contact help@revern.io or help@revern.io to arrange this. 13.5 Data residency. Standard deployments do not offer a choice of data residency. Enterprise customers may request a deployment and data-residency review. Contact help@revern.io. ================================================================================ 14. SHARING WITHIN AN ORGANISATION ================================================================================ 14.1 If you file a case file to an organisation, it is visible to every current member of that organisation, including members who join after it was filed. This includes the coordinate, radius, tier, confidence, the full candidate set, all evidence entries and notes, and, for a vehicle identification, all candidates and their reference photographs. 14.2 This is the purpose of an organisation and is enforced by our row-level security rules. It is not an accident, and it cannot be disabled on a per-case basis. If you do not want a result shared, switch to your personal workspace before running the analysis. 14.3 Case files filed to a personal workspace are visible only to you and are not shared with any organisation, including one you later join. 14.4 A case file may be edited or deleted only by the operator who created it. Other members can read it but not change or remove it. 14.5 Credits are never shared. Credit balances and ledgers are per operator on every plan. An organisation owner cannot see another member's ledger through the console. 14.6 Organisation owners can see the membership roster, including each member's account identifier and role. Invitation records show the invited email address to members of the organisation. 14.7 Leaving an organisation removes your access to its shared case files. Case files you filed to the organisation remain in the organisation. 14.8 If you are an employee or officer of a customer organisation, that organisation may have rights and obligations in relation to your use of Revern under its own policies and applicable workplace and public-sector legislation. Consult your organisation's privacy policy. ================================================================================ 15. HOW LONG WE KEEP INFORMATION ================================================================================ Category Retention ---------------------------- ---------------------------------------------- Uploaded photographs and Not retained by us. Held in the memory of the supporting frames request that processes them and released when it ends. A local copy is kept in your own browser or on your own device until you replace it or clear your site data. Copies held by processing Per that provider's policy, typically up to providers 30 days for abuse and safety monitoring. Case files (location and Until you delete them, or until 90 days after vehicle) your account is deleted, whichever is first. Organisation case files are retained while the organisation exists. Account and profile For the life of the account, then deleted within 30 days of account deletion, subject to backups being purged within 90 days. Organisation records and For the life of the organisation, then 30 days. membership Invitation records are deleted 12 months after they are accepted, declined or withdrawn. Onboarding answers For the life of the account. Retained in aggregate, de-identified form thereafter. Credit ledger, invoices and 7 years from the end of the financial year in billing records which the transaction occurred, as required by Australian tax and corporations law. This survives account deletion. Analysis backend audit log 90 days. Operational telemetry 24 months for request records, then deleted or (api_requests, aggregated to non-identifying totals. 12 months error_events) for error records including stack traces. Web analytics Per Vercel's retention for the plan we are on, generally up to 12 months of aggregated page view data. The daily visitor hash is discarded every 24 hours. Rate-limit counters Up to 1 minute. Place and reference-image Up to 24 hours. caches Identity token cache 60 seconds. Hosting and infrastructure Per provider default, generally 30 days. logs Accuracy feedback verdicts 24 months, then deleted or aggregated. Support correspondence 3 years from the last message in the thread. Sales and enterprise records 7 years from the end of the relationship. Legal hold Where information is relevant to an actual or reasonably anticipated legal proceeding, regulatory investigation or dispute, it is retained until the matter and any appeal period concludes, notwithstanding the periods above. Backups Encrypted backups are retained for up to 90 days. Deleted records persist in backups until those backups expire, after which they are overwritten. We do not restore deleted records from backup except in a disaster-recovery event, and where we do, we re-apply pending deletions. ================================================================================ 16. DELETION AND HOW TO DELETE YOUR DATA ================================================================================ 16.1 Delete a single case file. Open the case file in the console and delete it. Only the operator who created it can delete it. 16.2 Delete your entire location archive. The settings page has a destructive action that permanently removes all of your saved location analyses, their coordinates and their evidence. It requires you to type the word DELETE to confirm, because it is the only control in the console that destroys evidence. It cannot be undone and is written to the audit trail. 16.3 Delete your vehicle archive. Delete vehicle identifications individually from the case list, or request a bulk deletion at help@revern.io. 16.4 Delete your entire account. Write to help@revern.io from your account email address, or use the account deletion control if one is available in your console build. Deleting your account cascades to your profile, your case files, your credit ledger and any organisation you own. 16.5 Consequences of account deletion. (a) Unused credits are forfeited and are not refundable. (b) If you own an organisation, deleting your account deletes the organisation and all of its shared case files, affecting every member. Transfer ownership first if that is not what you intend. (c) Case files you filed to an organisation you do not own are removed with your account, and will no longer be visible to your colleagues. Export anything the organisation needs before deleting. (d) Billing records required by law are retained as set out in Section 15. 16.6 Local copies. Deleting your account does not clear the copy of an image held in your own browser's storage or in the mobile app's local history. Clear your browser site data for revern.io, and delete the app or clear its data, to remove those. 16.7 Backups. See Section 15. 16.8 Timeframe. We complete deletion requests within 30 days, and within any shorter period required by applicable law. ================================================================================ 17. SECURITY ================================================================================ 17.1 Measures we apply. * Encryption in transit using TLS for all connections between your browser or device, our console, our analysis backend, and our providers. * Encryption at rest for our database and backups, as provided by our database platform. * Row-level security in the database. Every table holding customer data has policies scoped to the authenticated account, or to membership of an organisation. There is no public read path to any customer table, not even for aggregate counts. * Membership checks are performed through a security-definer function, so that a policy cannot be bypassed and cannot recurse. * Privilege separation. The privileged service key that can bypass row-level security exists only on the server and is never present in any browser or mobile build. Credit-granting and credit-spending functions have their execute permission revoked from all public and authenticated roles. * Authentication tokens are verified against our authentication provider on every analysis, before any work begins, so that a revoked session stops working promptly. * Billing is metered server-side from a duration the server measured. No usage figure is ever accepted from a client. * Credit spending is atomic, so concurrent runs cannot lose a charge. * Payment webhooks are signature-verified and idempotent, so a payment announced more than once is applied once. * Origin restriction. In production the analysis backend accepts requests only from our own console origins. * Rate limiting on the analysis backend. * Images are never persisted, which removes an entire class of breach. * Audit logs deliberately exclude image content, recognised text and resolved coordinates. * Least-privilege access for our personnel, with access to production data limited to those who need it for support or operations. 17.2 No guarantee. No method of transmission or storage is completely secure. We cannot and do not guarantee absolute security. 17.3 Your part. Use a strong, unique password, keep your credentials confidential, keep your organisation roster accurate, and protect the devices on which browser-local copies of images sit. 17.4 Reporting. Report a suspected vulnerability to help@revern.io. Report a suspected compromise of your account to help@revern.io immediately. ================================================================================ 18. COOKIES, STORAGE AND TRACKING ================================================================================ 18.1 Strictly necessary cookies and storage. We use cookies and browser storage that are necessary for the service to function: * Authentication session and refresh tokens, set by our authentication provider, so that you stay signed in. * Workspace state, recording whether you are acting in your personal workspace or in an organisation. * IndexedDB storage in a database named "revern", holding the image and event stream of the analysis in progress so that a page reload does not lose it. These cannot be disabled without breaking the service, and under the ePrivacy Directive and equivalent laws they do not require consent. 18.2 Analytics. We use Vercel Web Analytics, which is cookieless. It sets no cookie, stores no persistent device identifier, and does not track you across other websites. Because it sets no cookie and stores nothing on your device, it does not require consent under the ePrivacy Directive. Where we later adopt an analytics or session-recording product that does set a non-essential cookie or store data on your device, we will disclose it here and obtain consent through a banner first. Current analytics providers: Vercel Web Analytics (Vercel Inc.). You can prevent it entirely with any standard content blocker, without any loss of functionality. 18.3 Advertising. We do not use advertising cookies, do not run retargeting pixels on the console, and do not share information for cross-context behavioural advertising. 18.4 Do Not Track and Global Privacy Control. We honour the Global Privacy Control signal where our systems receive it, and treat it as an opt-out of sale and sharing for the purposes of applicable United States state law. We do not currently respond to Do Not Track headers, as there is no accepted standard for doing so. 18.5 Managing cookies. You can clear or block cookies and site storage through your browser settings. Clearing site data for revern.io will sign you out and discard any in-progress analysis held locally. ================================================================================ 19. MARKETING COMMUNICATIONS ================================================================================ 19.1 Service communications. We will send you communications necessary to operate your account, such as sign-in confirmations, password resets, invitation notices, billing receipts, renewal and failure notices, service incidents, security notices and changes to our terms. You cannot opt out of these while you hold an account. 19.2 Marketing. We may send product and company updates to business contacts where permitted by law. Every marketing message includes an unsubscribe link and our contact details, as required by the Spam Act 2003 (Cth). Where the GDPR or local law requires consent, we obtain it first. 19.3 Opting out. Use the unsubscribe link, or write to help@revern.io. Opting out of marketing does not opt you out of service communications. 19.4 We do not sell or rent contact details to third parties for their own marketing. ================================================================================ 20. YOUR RIGHTS, GENERALLY ================================================================================ 20.1 Depending on where you are, you may have rights to: * access the Personal Information we hold about you; * receive a copy in a portable format; * correct information that is inaccurate, out of date or incomplete; * delete information; * restrict or object to certain processing; * withdraw consent where we relied on it; * not be subject to solely automated decisions with legal or similarly significant effect; * opt out of sale, sharing or targeted advertising, although we do none of those; and * complain to a regulator. 20.2 How to exercise a right. Write to help@revern.io with: * the right you wish to exercise; * the email address on your Revern account; * enough detail to locate the information, such as a case file identifier or a date range. 20.3 Verification. We will verify your identity before acting, usually by confirming control of the account email address, and for higher-risk requests by additional means proportionate to the sensitivity. We will not collect more information than necessary to verify you. 20.4 Timeframes. We respond within 30 days for Australian requests, within one month (extendable by two further months for complex requests, with notice) for GDPR and UK GDPR requests, and within 45 days (extendable once by a further 45 days, with notice) for United States state privacy requests. 20.5 Cost. We do not charge for the first request in any twelve-month period. We may charge a reasonable, cost-based fee for manifestly unfounded, excessive or repetitive requests, or refuse them, and will tell you why. 20.6 Authorised agents. You may use an authorised agent where the applicable law permits it. We will require written authorisation and will verify both your identity and the agent's authority. 20.7 No retaliation. We will not deny you service, charge you a different price, or provide a different quality of service because you exercised a privacy right. 20.8 Practical limits. Section 10.5 explains why we will usually be unable to locate information about a person who merely appears in an image processed through Revern. ================================================================================ 21. AUSTRALIAN RIGHTS AND COMPLAINTS ================================================================================ 21.1 We are bound by the Australian Privacy Principles in Schedule 1 to the Privacy Act 1988 (Cth). 21.2 Access (APP 12). You may request access to the Personal Information we hold about you. We will give access unless an exception in APP 12 applies, for example where giving access would have an unreasonable impact on the privacy of others, would prejudice an investigation of unlawful activity, or would reveal our commercially sensitive information. If we refuse, we will tell you in writing, give reasons, and explain how to complain. 21.3 Correction (APP 13). You may request correction of information that is inaccurate, out of date, incomplete, irrelevant or misleading. Much of your information can be corrected directly in the console. 21.4 Anonymity and pseudonymity (APP 2). The service requires an account and cannot be used anonymously, because usage must be metered, billed and attributable for safety reasons. This is an exception permitted by APP 2.2(b) as it is impracticable for us to deal with unidentified individuals. 21.5 Government related identifiers (APP 9). We do not adopt, use or disclose a government related identifier as our own identifier of an individual. 21.6 Direct marketing (APP 7). See Section 19. 21.7 Complaints to us. Write to help@revern.io, marked for the attention of the Privacy Officer, setting out your complaint. We will acknowledge within 5 business days and respond substantively within 30 days. 21.8 Complaints to the regulator. If you are not satisfied with our response, you may complain to: Office of the Australian Information Commissioner GPO Box 5218, Sydney NSW 2001 1300 363 992 enquiries@oaic.gov.au www.oaic.gov.au 21.9 Notifiable Data Breaches. We comply with Part IIIC of the Privacy Act. See Section 25. ================================================================================ 22. EUROPEAN ECONOMIC AREA AND UNITED KINGDOM RIGHTS ================================================================================ 22.1 Where the GDPR or UK GDPR applies to our processing of your personal data, you have the rights in Articles 15 to 22: * Access (Art. 15), including a copy of the data and the information in this policy. * Rectification (Art. 16). * Erasure, the "right to be forgotten" (Art. 17), subject to our overriding obligations to retain billing records and to comply with law. * Restriction of processing (Art. 18). * Data portability (Art. 20), for data you provided to us that we process by automated means on the basis of consent or contract. Case files can be exported from the console. * Objection (Art. 21), including an absolute right to object to direct marketing, and a right to object to processing based on legitimate interests, which we will honour unless we demonstrate compelling legitimate grounds that override your interests. * Not to be subject to solely automated decision-making with legal or similarly significant effect (Art. 22). See Section 9.3. * Withdrawal of consent (Art. 7(3)), without affecting the lawfulness of processing before withdrawal. 22.2 Controller. Where we are the controller, the controller is Revern, whose details appear at the top of this policy. Where we act as processor, the controller is our customer. 22.3 Article 27 representatives. Where we are required to designate a representative in the European Union or the United Kingdom under Article 27, the current designation is published at https://revern.io/privacy. Until a designation is published, contact us directly at help@revern.io on any matter relating to our processing of your personal data. 22.4 Data Protection Officer. Where we are required to appoint a Data Protection Officer, the appointment is published at https://revern.io/privacy. Our Privacy Officer performs this function in the meantime and is contactable at help@revern.io. 22.5 Supervisory authority. You may lodge a complaint with the supervisory authority in the EU member state of your habitual residence, place of work or the place of the alleged infringement. A list is at https://edpb.europa.eu/about-edpb/board/members_en. In the United Kingdom, the Information Commissioner's Office, at https://ico.org.uk, telephone 0303 123 1113. 22.6 Statutory or contractual requirement. Providing your email address and agreeing to these terms is necessary to enter into a contract with us. If you do not provide them, we cannot create an account for you. Providing onboarding answers is a condition of completing onboarding but the free-text fields are optional. ================================================================================ 23. CALIFORNIA AND OTHER UNITED STATES STATE RIGHTS ================================================================================ 23.1 This Section applies to residents of California and, where the equivalent right exists, to residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware and other states with comprehensive privacy legislation. 23.2 Categories of personal information collected in the last 12 months, using the CCPA categories: Category Collected Source -------------------------------------------- ---------- ---------------- A. Identifiers (name, email, account id, Yes You, SSO provider IP address) B. Customer records (Cal. Civ. Code Yes You, Stripe 1798.80(e)) including billing information C. Protected classification characteristics No -- D. Commercial information (plan, purchases, Yes You, Stripe credit ledger) E. Biometric information No -- F. Internet or network activity Yes Automatically G. Geolocation data (coordinates estimated Yes Derived from your from your uploaded image; approximate uploaded image and city-level location from IP) from your IP H. Sensory data (photographs) Yes, You. Not retained transient by us. I. Professional or employment information Yes Your onboarding (role, organisation kind, team size) answers J. Education information No -- K. Inferences (product preferences from Yes Derived onboarding) Sensitive personal information under the CPRA: we do not collect precise geolocation of the consumer, racial or ethnic origin, religious beliefs, union membership, contents of mail or messages, genetic data, biometric data for identification, health data, or sex life or sexual orientation data. We do collect account log-in credentials, which are sensitive personal information, and we use them only to authenticate you, which is a purpose exempt from the right to limit under Cal. Civ. Code 1798.121. Note on category G: a coordinate estimated from an uploaded image is geolocation data about the place the image depicts. It is generally not the location of the Revern user. It may be geolocation data about a third party. See Section 10. 23.3 Purposes. As set out in Section 8.1. 23.4 Disclosure for a business purpose. In the last 12 months we disclosed categories A, B, D, F, G, H, I and K to the sub-processor categories listed in Section 12, for the business purposes stated there. 23.5 No sale, no sharing. We have not sold personal information, and have not shared it for cross-context behavioural advertising, in the preceding 12 months, and we do not do so. We do not have actual knowledge of selling or sharing the personal information of consumers under 16 years of age. 23.6 Your rights. Subject to verification, you have the right to know, the right to access and portability, the right to delete, the right to correct, the right to opt out of sale and sharing (which is not applicable as we do neither), the right to limit use of sensitive personal information (which is already limited as described), and the right to non-discrimination. Some states also provide a right to appeal a refusal. 23.7 How to exercise. Write to help@revern.io, or use the account controls in the console. See Section 20 for process, verification and timeframes. 23.8 Appeal. If we refuse your request and you reside in a state that provides an appeal right, you may appeal by replying to our decision within 30 days, marked "Privacy Appeal". We will respond within 45 days. If we deny the appeal, we will provide details of how to contact your state attorney general. 23.9 Retention. See Section 15. We retain each category only as long as reasonably necessary for the purpose for which it was collected. 23.10 Shine the Light. California Civil Code 1798.83 permits California residents to request information about disclosure of personal information to third parties for their direct marketing purposes. We make no such disclosures. ================================================================================ 24. OTHER JURISDICTIONS ================================================================================ 24.1 New Zealand. Where the Privacy Act 2020 (NZ) applies, we comply with the Information Privacy Principles and you may complain to the Office of the Privacy Commissioner at www.privacy.org.nz. 24.2 Canada. Where PIPEDA or a substantially similar provincial law applies, you may complain to the Office of the Privacy Commissioner of Canada at www.priv.gc.ca. 24.3 Elsewhere. Where the law of your jurisdiction confers rights not described here, we will honour them to the extent they apply to us. Write to help@revern.io. 24.4 Conflict. Where a mandatory local law conflicts with this policy, that law prevails to the extent of the conflict for individuals in that jurisdiction. ================================================================================ 25. DATA BREACH NOTIFICATION ================================================================================ 25.1 We maintain a data breach response plan covering detection, containment, assessment, notification and review. 25.2 Australia. Where we suspect an eligible data breach under Part IIIC of the Privacy Act 1988 (Cth), we will assess it within 30 days and, if it is likely to result in serious harm, notify the Office of the Australian Information Commissioner and affected individuals as soon as practicable. 25.3 GDPR and UK GDPR. Where we are the controller, we will notify the competent supervisory authority within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in a risk to individuals, and will notify affected data subjects without undue delay where the risk is high. Where we are the processor, we will notify the customer controller without undue delay. 25.4 United States. We will notify affected residents and, where required, state attorneys general in accordance with applicable state breach notification statutes. 25.5 Customer notification. Where a breach affects a customer's inputs or case files, we will notify the customer's account contact without undue delay and provide the information reasonably necessary for the customer to meet its own notification obligations. ================================================================================ 26. GOVERNMENT AND LAW ENFORCEMENT REQUESTS TO US ================================================================================ 26.1 We disclose customer information to a government authority only where we are legally compelled, or where disclosure is otherwise permitted or required by law, or where reasonably necessary to prevent a serious and imminent threat to life or health. 26.2 Our practice on receiving a request is to: (a) check that it is valid, properly issued, and served on the correct entity; (b) require a warrant, court order, subpoena or other compulsory process appropriate to the data sought, rather than an informal request; (c) narrow the request to the minimum data actually required; (d) notify the affected customer before disclosing, and give them a reasonable opportunity to challenge, unless we are legally prohibited from doing so or there is an imminent risk to life; and (e) where we are prohibited from notifying, seek to have the prohibition lifted or time-limited. 26.3 What we can and cannot produce. We cannot produce photographs, because we do not retain them. We cannot produce recognised text or resolved coordinates from our audit log, because it does not record them. We can produce account records, organisation records, billing records, and case files, which contain estimated coordinates and evidence. 26.4 Transparency. We intend to publish periodic transparency reporting on the number and type of government requests received, once volume makes that meaningful. ================================================================================ 27. CHILDREN ================================================================================ 27.1 The service is not directed to children. You must be 18 or over to hold an account. We do not knowingly collect Personal Information from anyone under 18 as a user. 27.2 We recognise that a photograph uploaded by a customer may contain images of children. We do not identify anyone in an image, do not retain the image, and do not use faces. The Terms of Service prohibit uploading child sexual abuse material and prohibit any use aimed at locating an individual. 27.3 If you believe a person under 18 has created an account, or that a child's Personal Information has been processed in a way that concerns you, contact help@revern.io and we will investigate and, where appropriate, delete. ================================================================================ 28. CHANGES TO THIS POLICY ================================================================================ 28.1 We may update this policy. The current version is always published at https://revern.io/privacy with an effective date and version number. 28.2 For a material change, we will give at least 30 days' notice by email to your account address, or by prominent in-console notice, before it takes effect. 28.3 Where a change requires your consent under applicable law, we will obtain it before applying the change to you. 28.4 We maintain an archive of prior versions, available on request from help@revern.io. ================================================================================ 29. HOW TO CONTACT US AND HOW TO COMPLAIN ================================================================================ Privacy Officer REVERN New South Wales, Australia All enquiries, including privacy and data rights requests, support, security reports, reports of misuse, legal notices, and sales: help@revern.io Please mark the subject line with the nature of your enquiry, for example "Privacy request", "Data deletion", "Security", or "Report of misuse". We acknowledge privacy enquiries within 5 business days and aim to resolve them within 30 days. If you are not satisfied, you may escalate to the regulator in your jurisdiction, as set out in Sections 21, 22, 23 and 24. ================================================================================ END OF PRIVACY POLICY ================================================================================