This Privacy Policy explains how IBL Holding Ltd. (“IBL,” “we,” “us,” or “our”), as the operator of Reveiler, collects, uses, discloses, stores, and otherwise processes personal data in connection with the Reveiler website, platform, applications, and related services (collectively, the “Service”). Reveiler is primarily a business-to-business service used by organizations and their authorized users.
This policy is intended to describe our current application-level practices. Certain infrastructure, backup, provider-side deletion, and external authorization actions depend on third-party platforms. We do not represent that data has been deleted from an external provider or backup system unless that deletion is supported and confirmed.
1. Roles and scope
Depending on the context, IBL may act as a controller of personal data (for example, account administration, billing, security, website operations, and our own business communications) or as a processor/service provider acting on instructions from a customer organization. Where a customer uses Reveiler to process its contacts, prospects, employees, business relationships, mailbox data, or other customer-provided information, the customer generally determines the purposes and means of that processing and is responsible for its own legal basis, notices, permissions, and instructions.
If you interact with Reveiler through an organization, that organization may have its own privacy obligations and policies. Requests relating to data controlled by that organization may need to be directed to the organization.
2. Personal data we process
Account and user data: name, business email, organization, role, authentication and account identifiers, permissions, workspace membership, and support communications.
Customer and workspace data: organization profile, products, markets, strategy, Company Brain content, settings, policies, configuration, and customer-authored notes or materials.
Professional and contact data: names, job titles, employers, professional history, business contact details, public profiles, professional links, industries, and related business information.
Prospect and discovery data: candidate companies and people, relevance signals, matching information, research findings, provenance, and source references.
Uploaded and imported data: files, spreadsheets, lists, documents, CRM-style records, and other materials a customer chooses to provide.
Intelligence and generated data: summaries, classifications, recommendations, scores, drafts, research outputs, inferred business relationships, and AI-generated or AI-assisted content.
Outreach data: campaigns, sequences, recipients, messages, delivery records, suppression status, sending-account identifiers, and engagement or outcome information.
Connected mailbox data: mailbox identity, authorization status, message identifiers, sender information, subject, message body or relevant portions of a message, timestamps, and other data needed to send authorized messages and reconcile relevant replies.
Usage, credit, subscription, and transaction data: plan, entitlements, credits, consumption events, orders, payment status, and related records. Payment-card information may be processed directly by a payment provider rather than stored by Reveiler.
Technical and security data: IP address where generated by platform operations, browser/device information, authentication events, audit events, consent records, diagnostics, and security signals.
3. Sources of data
You, your organization, and other authorized users.
Files, imports, connected systems, and information submitted to the Service.
Publicly available websites, company websites, professional pages, news and media sources, government or public records, and other lawful public sources.
Licensed or commercial business-information, search, retrieval, enrichment, and data services.
Google and Microsoft when a user expressly connects a mailbox or authorizes account access.
Service providers supporting hosting, application infrastructure, AI, communications, payment, security, and related operations.
4. How we use personal data
Provide, operate, secure, maintain, and improve Reveiler.
Authenticate users and enforce workspace, role, entitlement, and tenant boundaries.
Build and maintain customer-directed business intelligence, Company Brain information, prospect discovery, enrichment, and research workflows.
Generate customer-requested summaries, drafts, recommendations, classifications, and other AI-assisted outputs.
Enable customer-authorized outreach, select eligible sending accounts, send messages, reconcile relevant replies, and record outreach outcomes.
Manage plans, credits, subscriptions, orders, and customer support.
Detect abuse, investigate security events, maintain auditability, and protect the Service and its users.
Comply with law, enforce agreements, and establish, exercise, or defend legal claims.
Produce aggregated or de-identified information where reasonably designed not to identify an individual.
5. AI, research, enrichment, and data minimization
Reveiler may use artificial intelligence and external search, retrieval, research, or enrichment services to perform customer-requested workflows. Inputs may include public URLs, professional names, roles, company information, source content, customer-provided materials, and limited correspondence content when required for a feature. Reveiler applies provider governance and data-category controls designed to prevent a provider from receiving a category of data merely because it is approved for another category.
Reveiler’s internal provider-routing architecture, provider approvals, and routing logic are proprietary administrative controls. Customer-facing privacy materials may describe categories of processing without exposing proprietary routing rules. Where applicable law or contract requires identification of a subprocessor, that requirement takes precedence.
6. Google Workspace and Gmail data
A user may choose to connect a Google account to Reveiler. Reveiler requests only the Google permissions needed for enabled mailbox features. For the current outreach workflow, the intended permissions include the ability to send mail on the user’s behalf and to read mailbox content needed to identify and reconcile replies to Reveiler-managed outreach. Reveiler is not designed as a general-purpose Gmail inbox.
When Gmail access is authorized, Reveiler may use mailbox profile information to identify the sending account; send customer-authorized outreach; search for candidate replies; retrieve message information needed to determine whether a message is a relevant reply; associate a relevant reply with the correct workspace, sending account, recipient, outreach activity, and conversation; and classify or summarize a relevant reply for the customer’s workflow.
Reveiler does not use Google Contacts API data for the described mailbox workflow and does not require Gmail access to browse a user’s mailbox for unrelated purposes. Access is subject to the permissions actually granted by the user and the configuration available in production.
Reveiler’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Users may disconnect a mailbox in Reveiler. The application immediately makes the mailbox unavailable for Reveiler sending and synchronization and removes application-controlled credentials. Reveiler also attempts applicable external revocation. Because final revocation is controlled by Google, Reveiler does not claim external revocation is complete unless it is confirmed. Historical outreach and relevant reply records may remain as customer business records until deleted under the applicable retention or customer-deletion process.
7. Microsoft 365 and Outlook data
A user may choose to connect a Microsoft account. Reveiler uses delegated permissions so the Service acts on behalf of the signed-in user within the permissions granted. Intended mailbox permissions include sending mail and reading mail needed for reply reconciliation, together with identity/session permissions required for OAuth. Reveiler does not require application-wide access to all mailboxes for this workflow.
Microsoft mailbox data is used for the same limited outreach purposes described above: identifying an authorized sending account, sending customer-authorized messages, identifying relevant replies, reconciling them to the appropriate Reveiler records, and supporting customer-directed follow-up and learning.
8. Automated outreach and customer responsibilities
Reveiler provides tools that customers may use to research business contacts and conduct outreach. Customers determine whom to contact, the purpose of the communication, applicable campaign rules, and the legal basis for their outreach. Customers are responsible for complying with applicable marketing, electronic communications, privacy, employment, anti-spam, telemarketing, and sector-specific laws, including honoring opt-outs and suppression requirements.
Reveiler may provide technical controls, suppression functions, eligibility rules, and automated assistance, but those controls do not replace the customer’s legal review or obligations.
9. Cookies, analytics, and consent
Reveiler may use strictly necessary technologies required for authentication, security, session management, preferences, and core operation. Optional analytics or marketing technologies, where used and where consent is required, are designed to remain off until the required consent is granted and to stop after consent is withdrawn. Consent choices may be recorded for compliance and preference management.
10. Disclosure of personal data
Service providers and subprocessors that support the Service, subject to appropriate contractual or other safeguards where required.
Google, Microsoft, payment providers, and other services a customer or user chooses to connect or use, according to the user’s instructions and those providers’ terms.
Professional advisers, auditors, insurers, regulators, courts, or authorities where reasonably necessary for legal, compliance, security, or claims purposes.
A successor or participant in a merger, acquisition, financing, reorganization, sale of assets, or similar corporate transaction, subject to applicable law.
Other parties when the customer or user directs or authorizes the disclosure.
11. International processing and transfers
Reveiler and its service providers may process data in countries other than the country in which the customer or user is located. Where applicable law requires a transfer mechanism or additional safeguards, IBL will use appropriate contractual or legal mechanisms, which may include standard contractual clauses or other recognized safeguards.
12. Security
We use administrative, technical, and organizational measures designed to protect personal data, including tenant and workspace access controls, role-based authorization, server-side secret handling, audit controls, and privacy/security governance. No system can guarantee absolute security. Infrastructure-level encryption, backup, key-management, and provider-side controls may be operated by the relevant platform or service provider and are not represented here beyond what has been verified.
Reveiler maintains application controls intended to prevent customer users from accessing internal provider-routing governance, secrets, tokens, or other customers’ data.
13. Retention and deletion
We retain personal data for as long as reasonably necessary for the purposes described in this policy, to provide the Service, comply with customer instructions, maintain security and auditability, meet legal obligations, resolve disputes, and enforce agreements. Retention periods vary by data type and context.
Customer privacy workflows can delete application records within the supported ownership scope. Certain minimal privacy-request and audit records may be retained where necessary for accountability, security, legal compliance, or proof that a request was handled. Archive functionality is not the same as deletion.
Deletion of a database reference does not necessarily delete an underlying private storage object, external-provider copy, or backup. Where the application cannot directly perform or prove deletion in an external platform, the disposition is treated as an external/platform dependency rather than represented as completed deletion.
14. Privacy rights and requests
Depending on applicable law and your relationship with Reveiler, you may have rights to request access, correction, deletion, restriction, objection, portability, or withdrawal of consent. You may also have the right to complain to a competent supervisory authority.
To submit a privacy request, contact hello@reveiler.com. If the data is controlled by a Reveiler customer, we may direct the request to that customer or assist the customer as required by our agreement and applicable law. We may need to verify identity and authority before fulfilling a request.
15. Business contact and professional data
Reveiler may process professional information relating to business contacts, prospects, partners, and other individuals acting in a professional capacity. Such information may originate from public sources, licensed/commercial sources, customer records, or direct interactions. Customers remain responsible for determining whether their intended use of such information is lawful in the relevant jurisdiction.
16. Children
Reveiler is a business service and is not directed to children. Individuals who are not legally able to enter into or be authorized under a business service arrangement should not create an account or connect a mailbox.
17. Changes to this policy
We may update this Privacy Policy to reflect changes in the Service, law, providers, or our practices. We will update the effective date and provide additional notice where required by law or contract.
18. Contact
Website: https://reveiler.com