Privacy Policy

This Privacy Policy explains what Personal Data AI Code that Works, LLC dba RevAStack ("RevAStack," "we," "us," or "our") collects through https://revastack.ai and the 308-aliased domains revastack.com, revastack.dev, and revastack.io (collectively, the "Site"), how we use it, who we share it with, and the rights you have over it. We aim for plain English; defined terms are introduced where they matter.

• We collect Personal Data you give us when you fill out a form (name, email, optional product-interest selections, optional free-text), and limited technical data set by analytics and error-monitoring cookies (subject to your consent).
• We use it to respond to you, send product updates you opt into, improve the Site, and run security and fraud-prevention controls.
• We share it with the named third-party Processors listed below — Supabase (database + auth), Vercel (hosting), GoHighLevel (CRM + email delivery), PostHog (product analytics), Sentry (error monitoring), and Google (Google Tag Manager + GA4 + future Meta Pixel and Google Ads when enabled).
• We do not sell Personal Data. We do not engage in cross-context behavioral advertising.
• You have rights under the GDPR, UK GDPR, and CCPA/CPRA. Exercise them by emailing alex@revastack.ai.

The following capitalized terms have the meanings set out here:

• "Site" — the website at https://revastack.ai and the 308-aliased domains revastack.com, revastack.dev, and revastack.io.
• "App" — the RevAStack Brand Engine application at https://app.revastack.ai, which is a separate product offering governed by its own terms of service and privacy notice presented at sign-in.
• "Service" — the Site and any associated forms, content, and communications described in this Policy. The App is NOT included in "Service" for purposes of this Policy.
• "User" / "you" — any natural person who visits the Site, submits a form, or otherwise interacts with the Service.
• "Personal Data" — any information that identifies you, relates to you, or could reasonably be linked to you, as that term is defined under the EU/UK GDPR and the California Consumer Privacy Act (as amended by the CPRA) ("CCPA").
• "Processing" — any operation performed on Personal Data (collection, storage, use, disclosure, deletion), as defined under GDPR Article 4(2).
• "Controller" — the entity that determines the purposes and means of Processing. For Personal Data collected through the Service, RevAStack is the Controller.
• "Processor" — a third-party service provider that Processes Personal Data on the Controller's behalf under a Data Processing Agreement.

The Controller of your Personal Data collected through the Service is AI Code that Works, LLC dba RevAStack, a limited liability company organized under the laws of Texas, United States. Our mailing address is 2303 Ranch Road 620 S., Suite 160-240, Lakeway, TX 78734, United States.

Contact for any privacy-related question, rights request, or complaint: alex@revastack.ai. We do not currently maintain a separate EU representative or UK representative; if you reside in the EEA or the UK and prefer to contact a representative in your jurisdiction, please email us at the address above and we will route your request.

We collect the following categories of Personal Data through the Service:

• Information you give us through a form. Every form on the Site is wired to a single canonical Server Action (`submitLead`) that stores the submission in our `leads` database table. The fields collected vary by form but draw from a single typed schema: required — email address; optional — first name, last name, phone number, company, role, free-text describing your build goal or use case, and the multi-checkbox selection of RevAStack products you are interested in (Brand Engine, Lead Engine).
• Provenance metadata captured with each form submission. We attach to each `leads` row the page slug you submitted from, the call-to-action tag of the specific form, any UTM parameters in the URL (`utm_source`, `utm_medium`, `utm_campaign`, `utm_term`, `utm_content`), the HTTP `Referer` header (if present), and your consent flags (whether you opted into marketing email and analytics cookies) along with the timestamp of the consent. The database schema includes an optional `consent_ip` column for the IP address that submitted the consent, but no form on the Site currently populates it — the column is null on every row written today, and the value is never derived server-side. The IP address that submitted the form is read transiently for per-IP rate limiting (capped at approximately 10 requests per minute per IP) and is not written to the lead record. Separately, once we activate Meta (see § Who we share Personal Data with), that same transiently-read submission IP is forwarded to Meta's Conversions API as a match key for the consent-gated server-side `Lead` event — only when you have not denied marketing consent and your browser does not send a Global Privacy Control signal; it is still not stored on the lead record. If we begin populating `consent_ip` (for example, to support cookie-banner audit trails under future GDPR enforcement guidance), this Policy will be updated.
• Technical / device data set by analytics and error-monitoring tools, gated by your cookie-banner choice. When you grant analytics consent, PostHog (product analytics) opts in and begins capturing aggregate usage events (pages viewed, referrer, browser and OS metadata, viewport dimensions, and a pseudonymous device identifier) with cookies named `ph_*`. The PostHog SDK initializes in opt-out mode (`opt_out_capturing_by_default: true`) and only opts in after consent; withdrawing consent re-asserts opt-out and resets the SDK's local identity. When you grant analytics consent, Sentry (error monitoring) also begins session-mode session replay (no session-mode replays are captured before consent — the SDK initializes with `replaysSessionSampleRate: 0` and the `<SentryReplayConsentGate>` only calls `start()` after consent is granted). Regardless of analytics consent, Sentry captures error breadcrumbs (the list of UI actions that preceded a crash), browser metadata, and a short rolling buffer (~15-30 seconds) that is flushed to Sentry only when an error occurs — the Sentry SDK's default PII masking (`maskAllText`, `maskAllInputs`, `blockAllMedia`) keeps the error buffer free of identifiers, which we rely on as a legitimate-interest basis for debugging. We opt every Sentry scope — client-side, server-side, and edge-runtime — out of automatic IP capture by setting `ip_address: null`: the client-side scope is opted out on every page mount via our observability seam, and the server-side and edge-runtime scopes apply a `beforeSend` hook that strips `event.user.ip_address` along with the common IP-bearing request headers (`X-Forwarded-For`, `X-Real-IP`, `True-Client-IP`, `CF-Connecting-IP`) from every event before it leaves the runtime.
• GTM-relayed tag data (subject to your consent). When you grant analytics consent, our Google Tag Manager container (GTM-W2SXSCM6) loads Google Analytics 4 cookies (`_ga`, `_gid`, and other `_ga_*` measurement-ID cookies). When you grant marketing consent in the future, we may additionally load Meta Pixel cookies (`_fbp`, `fr`) and Google Ads conversion cookies (`_gcl_*`) — neither is currently active.
• Network metadata captured by our hosting provider, Vercel, including your IP address, request URL, HTTP method, response status, and timestamp, retained for security, abuse prevention, and operational logging.
• Information you send us by email. If you email us at the address above, your email address, your name (if you provide it), the subject line, and the body of the email.

For California residents, the following categories of Personal Information from CCPA Section 1798.140 are collected through the Service:

• Identifiers — name, email address, phone number (where provided), IP address.
• Customer record information (Cal. Civ. Code § 1798.80(e)) — name, email, phone, company name.
• Commercial information — products you express interest in.
• Internet or other electronic network activity — pages visited, referrer URL, UTM parameters, browser/OS metadata.
• Geolocation data — country/region inferred from IP. We do NOT collect precise (city-block-level) geolocation.
• Inferences drawn from the above — none currently used to build a consumer profile reflecting preferences or characteristics.
• Sensitive Personal Information (CPRA) — none collected.

We do not knowingly collect Personal Information about minors under 16. See the Children's Privacy section below.

We Process Personal Data only for the specific purposes set out below, and only on the GDPR legal basis named for each. We rely on the equivalent basis under the UK GDPR for UK residents.

• To respond to your form submission, send the product update or waitlist communication you opted into, and route the lead to our CRM (GoHighLevel) for follow-up. Legal basis: performance of pre-contractual steps at your request (GDPR Article 6(1)(b)) and, for opt-in marketing communications, your consent (GDPR Article 6(1)(a)).
• To send you marketing emails about RevAStack products, RevAStack Brand Engine, and the broader RevAStack product family. We send marketing email only when you have opted in via a form or via reply-to-our-emails confirmation. Legal basis: your consent (GDPR Article 6(1)(a)); you can withdraw consent at any time by clicking the unsubscribe link in any email or emailing us.
• To operate and improve the Site through aggregated analytics. Legal basis: your consent (analytics category, GDPR Article 6(1)(a)) where required, or our legitimate interests in understanding which pages and content perform (GDPR Article 6(1)(f)) where consent is not required.
• To monitor for errors, debug, and maintain the security and integrity of the Site. Legal basis: our legitimate interests in keeping the Site secure and functional (GDPR Article 6(1)(f)).
• To prevent abuse and enforce our Terms of Service. We use rate-limiting (capped at approximately 10 form submissions per IP address per minute) and may temporarily block IP addresses that exceed the threshold. Legal basis: our legitimate interests in fraud and abuse prevention (GDPR Article 6(1)(f)).
• To comply with our legal, regulatory, and tax obligations, and to establish, exercise, or defend legal claims. Legal basis: compliance with a legal obligation (GDPR Article 6(1)(c)) and our legitimate interests in defending claims (GDPR Article 6(1)(f)).

Where our basis is legitimate interests, we have carried out a balancing test and concluded that our interests are not overridden by your interests, fundamental rights, or freedoms. You may object to legitimate-interests Processing on grounds relating to your particular situation by emailing us at the address above.

We do not engage in automated decision-making that produces legal or similarly significant effects on you, including profiling under GDPR Article 22.

We share Personal Data only with the third-party Processors listed below, and only to the extent each one needs to perform a function on our behalf. We have entered into Data Processing Agreements with each Processor, or rely on the Processor's published standard data-processing terms incorporating the EU Standard Contractual Clauses (which take effect when we accept the provider's terms of service); operator-side execution of each provider's DPA is tracked in GitHub Issue #473. Each Processor is itself the Controller of the limited operational metadata it must retain to run its service:

• Supabase, Inc. (United States) — database and authentication. Stores `leads` records, consent state, and audit/usage event ledgers. Privacy notice: https://supabase.com/privacy.
• Vercel Inc. (United States) — hosting and edge runtime. Receives every HTTP request to the Site, including IP address and request metadata. Privacy notice: https://vercel.com/legal/privacy-policy.
• GoHighLevel (LeadConnector LLC, United States) — CRM, email delivery, and lead workflow automation. Receives `leads` records after submission for follow-up email communications. Privacy notice: https://www.gohighlevel.com/privacy-policy.
• PostHog Inc. (United States, with EU cloud option) — product analytics. Receives pseudonymous page-view and page-leave events. Session replay is NOT enabled in our PostHog configuration today; if we enable it in the future, this Policy will be updated. Privacy notice: https://posthog.com/privacy.
• Functional Software, Inc. dba Sentry (United States) — error monitoring and session replay. Receives error stack traces, breadcrumbs, and session replays. Session-mode replay fires only after you grant analytics consent (via `<SentryReplayConsentGate>`). A short rolling buffer is maintained regardless of consent and flushed to Sentry only when an error occurs; it relies on the Sentry SDK's default PII masking to remain free of identifiers. Privacy notice: https://sentry.io/privacy.
• Google LLC (United States) — Google Tag Manager (the tag-relay container we run at `GTM-W2SXSCM6`), Google Analytics 4 (when analytics consent is granted), and, in the future, Google Ads (when marketing consent is granted). Privacy notice: https://policies.google.com/privacy.
• Meta Platforms, Inc. (United States) — ad-conversion measurement, through two consent-gated paths that activate when we turn Meta on for this site. (1) The Meta Pixel (cookies `_fbp`, `fr`, loaded through our Google Tag Manager container) measures ad-conversion performance, gated on marketing consent. (2) When you submit a marketing opt-in form, we send a server-side `Lead` event to Meta's Conversions API: a hashed (SHA-256) copy of your email address, first and last name, and phone number (where you provided them), your Meta browser identifiers (`_fbp`/`_fbc`) where present, and the IP address of your submission, so the conversion is attributed even if the browser pixel did not fire. The server event is gated on your tracking consent — if you deny marketing consent (via the cookie banner), your browser sends a Global Privacy Control signal, or you submit a non-marketing form, the server event is skipped before any Meta call; test submissions are also excluded. Both Meta paths are NOT yet active on this site — we will not begin sharing data with Meta until this disclosure is live and the Meta integration is switched on. Our legal basis is your consent where consent is required (EEA/UK/Switzerland) and our legitimate interest in measuring the effectiveness of our advertising (GDPR Article 6(1)(f)) elsewhere. Privacy notice: https://www.facebook.com/privacy/policy.

We do not sell Personal Data within the meaning of the CCPA, the CPRA, or any other US state privacy law that recognizes a right to opt out of sale. We do not share Personal Data for cross-context behavioral advertising. We will update this Policy and provide a conspicuous opt-out mechanism before that changes.

Beyond Processors, we may disclose Personal Data: (i) in response to a subpoena, court order, or other valid legal process, (ii) to law enforcement or governmental authorities to comply with applicable law, (iii) to protect our rights, property, or safety, or those of our users or the public, and (iv) in connection with the sale or merger of our business, in which case we will give you notice and an opportunity to object where required by law.

All of our Processors named above operate primarily from the United States. When we transfer Personal Data from the European Economic Area (EEA), the United Kingdom, or Switzerland to a country that the European Commission has not deemed to provide adequate protection, we rely on appropriate safeguards, including:

• The European Commission's Standard Contractual Clauses (Module 1: Controller-to-Controller; Module 2: Controller-to-Processor) (Commission Implementing Decision (EU) 2021/914), incorporated into our agreements with each Processor.
• The UK Addendum to the EU SCCs (issued by the ICO) for transfers from the UK.
• Where applicable, the EU-US Data Privacy Framework (DPF) or its UK Extension, for Processors that have self-certified under the DPF.
• Supplementary technical and organizational measures (encryption in transit and at rest, access controls, pseudonymization) where the transfer risk assessment recommends them.

You may request a copy of the relevant safeguards by emailing us at the address above. Please note that copies of executed agreements with third parties may be redacted to protect commercially sensitive terms.

We keep Personal Data only as long as we need it for the purpose it was collected, or as long as required by law. Our default retention periods are:

• Lead-capture records (the `leads` table) — 24 months from the date of your last interaction with us (form submission, email reply, or other inbound engagement), after which we delete or anonymize the record. We may retain a suppression-list entry (your email address tagged 'do not contact') indefinitely to honor opt-out requests.
• Analytics events (PostHog, GA4) — 14 months from event capture. After 14 months, individual events are deleted; aggregated, non-identifying summaries may be retained indefinitely for trend analysis.
• Sentry error events and breadcrumbs — 30 days from capture, after which they are deleted by Sentry's retention policy.
• Session replays — 30 days from capture; we apply field-level masking by default so most replays do not contain identifying input.
• Audit and usage-event ledgers (Supabase `audit_events` and `usage_events`) — 7 years, to support security investigations, billing reconciliation, and statutory record-keeping obligations.
• Email correspondence with us — for the duration of our ongoing relationship plus up to 7 years thereafter, for tax, accounting, and dispute-resolution purposes.
• Backups and disaster-recovery snapshots — up to 35 days after the source record is deleted, after which the backup retention window closes.

Where we are required by law to retain certain records (for example, tax records or records related to an active legal claim), we will keep them for the statutory period and apply the shortest retention period above only after the statutory period expires.

Depending on where you live and the law that applies to you, you have one or more of the following rights over your Personal Data.

To exercise any of the rights above, email us at alex@revastack.ai with the subject line "Privacy Rights Request" and tell us (a) which right you want to exercise, (b) which jurisdiction's law applies to you (e.g., GDPR, CCPA), and (c) enough information for us to identify your records (typically the email address you used to submit a form).

We will acknowledge receipt of your request within 10 business days and complete our response within the statutory window applicable to you — typically within 1 month under the GDPR (extendable by 2 further months for complex requests), and within 45 days under the CCPA/CPRA (extendable by 45 further days on notice).

We may need to verify your identity before acting. For GDPR and CCPA requests, we typically verify by confirming you control the email address on file. We do not require additional documentation unless your request involves a high-risk action (e.g., deletion of an account with substantial history) or we have reason to believe your account has been compromised.

You may designate an authorized agent to make a request on your behalf. For California residents, the agent must provide proof of authorization (a written designation signed by you, or a power of attorney). We will then verify both the agent's authority and your identity, and may contact you directly to confirm.

There is no fee for exercising your rights. We reserve the right to charge a reasonable fee for, or refuse to act on, requests that are manifestly unfounded or excessive — in particular because of their repetitive character.

Our use of cookies and similar technologies (localStorage, sessionStorage, pixel tags) is described in detail in our Cookie Policy, including the specific cookies set, their purposes, durations, and how to manage your preferences. The Cookie Policy is incorporated into this Privacy Policy by reference.

Our consent model is Google Consent Mode v2 in default-deny / Basic mode. Tags loaded through our Google Tag Manager container (currently GA4; in the future Meta Pixel and Google Ads when activated) do NOT fire until you have granted analytics or marketing consent through the cookie banner. PostHog opts in only after you grant analytics consent (the SDK is initialized with `opt_out_capturing_by_default: true`); Sentry session-mode session replay only starts after you grant analytics consent (via `<SentryReplayConsentGate>`). The functional cookie that stores your consent decision (`revastack_consent`) is set the first time you interact with the banner.

We apply technical and organizational measures designed to protect Personal Data against unauthorized access, alteration, disclosure, or destruction, including:

• Encryption in transit via TLS 1.2+ for every connection between you and the Site and between our services and Processors.
• Encryption at rest for the Supabase database and Vercel build artifacts.
• Row-Level Security (RLS) policies on the `leads` table and every other tenant-scoped table, enforcing isolation at the database layer rather than relying on application-level filtering.
• Least-privilege access controls — service-role credentials are never exposed to client bundles or browser code, and operator access to production data is gated and logged.
• Per-IP rate limiting on the form-submission endpoint to mitigate abuse and credential-stuffing.
• Automated error monitoring (Sentry) and audit-event ledgers in the database, so unusual activity surfaces quickly.

No security measure is perfect. We do not guarantee the absolute security of any Personal Data and you transmit it to us at your own risk. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours where required by law, and notify you without undue delay where the breach is likely to result in a high risk to your rights and freedoms (GDPR Articles 33-34).

The Service is not directed to, and we do not knowingly collect Personal Data from, individuals under the age of 16. If you are under 16, do not submit Personal Data through the Service or send us email. If we learn that we have collected Personal Data from a child under 16 without verified parental consent, we will delete that Personal Data as soon as reasonably possible.

If you are a parent or guardian who believes that we may have collected Personal Data from your child without your consent, please contact us at alex@revastack.ai and we will investigate and respond promptly.

The Site may contain links to third-party websites, products, or services that we do not control. This Privacy Policy applies only to the Service. We are not responsible for the privacy practices of third-party sites, and we encourage you to read their privacy notices before submitting Personal Data to them.

The RevAStack Brand Engine application at https://app.revastack.ai is a separate product offering with its own privacy notice and terms of service, which will be presented to you at sign-in. This Privacy Policy does not govern the App.

Browsers vary in their handling of the Do Not Track (DNT) signal and there is no consensus among industry participants as to what DNT means. We do not currently respond to DNT signals as a standalone signal.

RevAStack honors the browser Global Privacy Control (GPC) signal. When your browser exposes `navigator.globalPrivacyControl === true`, we treat the signal as an automatic denial of analytics and marketing consent. You can still affirmatively grant consent via the cookie banner — the GPC spec recognizes the signal as a universal opt-out, not a binding floor, so an explicit Accept on the banner overrides GPC. We remember the explicit Accept on this device (in browser local storage and a first-party cookie) until you withdraw it via the banner; that means the override persists across subsequent page loads, not only the current session. You can also email us at the address above to make a formal opt-out request. We also honor the `Sec-GPC: 1` request header server-side for our server-to-server export jobs (the Meta Conversions API lead share): a form submitted from a GPC-enabled browser is treated as a marketing-tracking denial server-side, so your lead details are not exported even if the client-side signal did not reach our analytics layer.

We may update this Privacy Policy from time to time. The 'Last updated' date at the top of the page reflects the most recent change. When a change is material, we will notify you by email (if we have your email on file and the change is relevant to your relationship with us) or by a prominent banner on the Site for at least 30 days before the change takes effect.

Your continued use of the Service after a material change becomes effective constitutes your acceptance of the updated Policy, except where we have asked for fresh consent under applicable law.

For any privacy-related question, rights request, or complaint, email us at alex@revastack.ai.

Postal address — AI Code that Works, LLC dba RevAStack, 2303 Ranch Road 620 S., Suite 160-240, Lakeway, TX 78734, United States.

Effective date: 2026-06-16.