Privacy Policy

This Privacy Policy explains what personal data Revnaris collects, how we use it, and the rights you have over it. It applies to our website at revnaris.com, our product, and all services we provide.

1.Overview

Revnaris is a hospitality CRM operated by Isloo Tech ("we", "us", "Revnaris"). We act in two roles depending on whose data is being processed:

• When you are a user of Revnaris — a hotel staff member, administrator, or someone exploring our website — we are the data controller of your personal data.
• When Revnaris processes data about guests of our customer hotels, we act as a data processor. The hotel is the controller. The hotel's own privacy notices apply to their guests. We process that data only under instructions from the hotel, as described in our Data Processing Agreement.

This policy focuses on the first case. If you are a guest who stayed at a hotel using Revnaris and want to know what the hotel does with your data, please contact that hotel directly.

2.Information we collect

Information you provide

When you request a demo, start an onboarding, or contact us, you give us:

• Account details — name, work email, hotel or group name, role, password (hashed, never stored in plain text).
• Property information — the hotels you operate, number of rooms, your PMS, and other setup details.
• Communications — any content you send us through our contact form, email, or support channels.
• Billing details — company name, VAT number, billing address. Payment card data is handled by Stripe; we never see or store it.

Information we collect automatically

• Usage data — the pages and features you use, actions you take, timestamps, approximate location (city-level, derived from IP).
• Device and browser — IP address, browser type and version, operating system, screen size, referring URL.
• Cookies and similar — see our Cookie Policy.

Information from third parties

• When you connect a PMS (Cloudbeds, Mews, WuBook or another system), that system shares reservation and guest records with Revnaris on your behalf.
• When you connect WhatsApp Business, email, or voice channels, inbound messages and metadata flow into Revnaris.

3.How we use information

We use personal data to:

• Provide, maintain, and improve the Revnaris service.
• Authenticate you and keep your account secure.
• Process payments and send invoices.
• Respond to your enquiries, support requests, and feedback.
• Send transactional emails about your account (new sign-ins, billing, service changes).
• Send marketing emails about Revnaris, which you can opt out of at any time.
• Detect and prevent fraud, abuse, and security incidents.
• Comply with legal obligations.
• Analyse how the product is used in aggregate, so we can improve it.

4.Legal basis for processing

Where the EU or UK General Data Protection Regulation applies to you, we rely on the legal bases below. Where another privacy regime applies — for example the CCPA/CPRA in California, the PDPL in the UAE or Saudi Arabia, the PDPA in Singapore, or Pakistan's own data protection law — we apply the equivalent lawful basis and honour the equivalent rights.

• Contract — most processing is necessary to deliver the service you have signed up for.
• Legitimate interests — for security, product improvement, and limited direct marketing to existing customers.
• Consent — for non-essential cookies and marketing to non-customers. You can withdraw consent at any time.
• Legal obligation — for tax records, responses to lawful requests from authorities, and other legal duties.

5.Who we share with

We do not sell personal data. We share it only with:

• Sub-processors — service providers who process data on our behalf under written agreements. See the full list below.
• Your organisation — information about your actions in Revnaris is visible to other users at your hotel group according to their role.
• Authorities — when required by law or in response to valid legal process (court order, subpoena). We review each request and push back where appropriate.
• Successors — in the event of a merger, acquisition, or asset sale, your data may transfer. You will be notified and given rights to object.

6.Sub-processors

The current list of sub-processors we use to deliver the service:

Provider	Purpose	Region
Amazon Web Services	Primary hosting and database	Your chosen deployment region
Cloudbeds	PMS integration (per-customer)	US / EU
WuBook	PMS integration (per-customer)	Your chosen deployment region
Mews	PMS integration (per-customer)	EU
Stripe	Payment processing	Ireland / US
PayPal	Payment processing	Luxembourg
WhatsApp Business (Meta)	Inbound messaging	Ireland
Anthropic	AI model inference	US (standard contractual clauses)
Resend	Transactional email	EU
Datadog	Operational monitoring	EU

We give customers 30 days' notice before adding or changing a sub-processor. The current list is also available on request.

7.International transfers

You choose where your instance runs. At onboarding you select a deployment region — the European Union, the United Kingdom, the United States, the Middle East, Asia-Pacific, or your own infrastructure. Your tenant's database, backups and file storage stay in that region. We do not replicate customer data to another region, and we do not move your instance without your written instruction.

Two categories of data movement are therefore possible, and we treat both as restricted transfers where the law requires it:

• Our access from Pakistan. Revnaris is operated by Isloo Tech, which is established in Pakistan. Pakistan is not currently covered by a UK or EU adequacy decision. Where our staff access personal data from Pakistan for support, administration or engineering work, that access is a restricted transfer.
• Sub-processors outside your region. Some sub-processors operate from a different country to your deployment region — see the table above.

For both, we rely on the appropriate transfer mechanism for the regime that applies to you: EU Standard Contractual Clauses for EEA data, the UK International Data Transfer Addendum for UK data, and comparable contractual safeguards elsewhere. These sit alongside technical measures that apply everywhere: encryption at rest and in transit, role-based access control, least-privilege and time-boxed support access, and audit logging of every access to customer data.

If your own regulator or policy requires that no one outside your region can access the data at all, say so during onboarding. We can scope support access to personnel and infrastructure inside your region as a contractual commitment.

8.Data retention

We keep personal data only as long as necessary for the purposes described above:

• Account data — while your account is active, plus 90 days after cancellation.
• Billing records — 7 years, as required by tax law in most jurisdictions.
• Support correspondence — 2 years.
• Usage and analytics logs — 13 months, then aggregated.
• Marketing contacts — until you unsubscribe, plus a short grace period for suppression records.

You can request deletion sooner. See Your rights.

9.Your rights

Under the GDPR and UK GDPR you have the rights below. Customers under other regimes — California, the Gulf, Singapore and elsewhere — have closely equivalent rights, and we apply this same list to everyone rather than operating a two-tier policy:

• Access — request a copy of the personal data we hold about you.
• Rectify — correct inaccurate or incomplete data.
• Erase — request deletion of your data (subject to legal retention requirements).
• Restrict — ask us to pause processing in certain circumstances.
• Portability — receive your data in a portable, machine-readable format.
• Object — object to processing based on legitimate interests, including direct marketing.
• Withdraw consent — where processing is based on consent, you can withdraw it at any time.
• Complain — to the data protection authority where you live or work. In the EEA that is your national DPA; in the UK it is the Information Commissioner's Office.

To exercise any right, email [email protected]. We respond within 30 days, usually sooner.

10.Security

We protect personal data with:

• Encryption at rest (AES-256) and in transit (TLS 1.2+).
• Role-based access control, with least-privilege defaults for Revnaris staff.
• Multi-factor authentication for all administrative access.
• Row-level tenant isolation at the database layer, so one customer's data cannot be read by another.
• Continuous monitoring for unusual activity.
• Regular backups with encryption and tested restores.
• Independent security assessments at least annually.

We'll notify affected customers and relevant authorities of a personal data breach within 72 hours, as required by the GDPR and in line with comparable regimes elsewhere.

11.AI and automated processing

Revnaris uses AI to classify inbound messages, draft responses, extract booking intent, and surface recommendations. We use large language models provided by Anthropic under contract, with the following commitments:

• Model providers do not train on your data.
• The AI's decisions are logged and visible in the audit trail — we do not operate a "black box".
• Humans always have the ability to override, take over, or hand back any AI-handled conversation.
• For decisions with significant impact (billing changes, contract terms, discount overrides), humans must approve.

You have the right under GDPR Article 22 — and we extend the same right to every customer regardless of region — to request human review of any decision that affects you and was made solely by automated processing.

12.Children

Revnaris is a B2B product and is not intended for anyone under 18. We do not knowingly collect personal data from minors. If you believe a minor has given us personal data, email [email protected] and we will delete it.

13.Changes

We may update this policy as the product and law evolve. Material changes will be notified in-product and by email at least 30 days before they take effect. The "Last updated" date at the top always reflects the current version.

14.Contact us

If you have any questions, want to exercise a right, or need to report an issue, please contact:

• Email (including data protection requests): [email protected]
• Mail: Isloo Tech, A1K1, Shirazi Rd, K Sector D-18, Islamabad, Pakistan