Privacy Policy

Last Updated: October 13, 2026 Data Protection Officer/Contact: Jone Korpi

Overview

Spinder Company Oy (Revial) commits to protecting customer and user privacy, handling personal data per GDPR, applicable legislation, and data protection best practices. This document outlines what information is collected, its purposes, processing basis, and individual rights. It covers the Revial web service, the Revial notetaker and the Revial mobile application for iOS and Android (together “the Service”).

1. Data Subject Categories

The organization processes information from:

• Representatives of customer and prospective companies (sales, marketing, management)
• Business partners
• Service users (SaaS tool and mobile application users)
• Participants in meetings recorded or analysed with the Service, including our customers’ own customers and partners
• Website visitors
• Event, training, and webinar participants

2. Data Categories Collected

Basic Information

• Names, contact details (email, phone, address)
• Employer information (company name, registration number, industry)
• Job titles and positions

Service Usage and Customer Data

• User credentials and passwords
• Login and usage history
• Customer relationships: subscriptions, licenses, billing, payment information
• Support contacts and requests
• Marketing and communication preferences

Meeting Data

• Audio and video recordings of meetings recorded with the Revial notetaker or the Revial mobile application
• Transcripts, speaker identification and meeting metadata (title, time, participants)
• AI-generated content derived from meetings: summaries, action items, sales insights and meeting briefings
• Records of the user’s consent to third-party AI processing in the mobile application, with timestamps

Website, Application and Service Usage Data

• Technical information via cookies: IP address, browser type, operating system, device identifiers
• Mobile application technical data: device model, operating system version, app version, crash and error logs
• Behavioral data: page views, clicks, form interactions
• Approximate location data (city/IP-based)

Voluntary Information

• Event registration details
• Feedback and survey responses
• Specially provided data categories (handled only with consent)

3. Data Sources

• Direct provision (registration, forms, inquiries)
• Employer or organization (service implementation)
• Recordings that a user starts in the Revial notetaker or the mobile application. The mobile application uses the device microphone only while the user is actively recording, and only after the user has granted microphone permission.
• Automatic collection during service use (cookies and logs)
• Public sources and business registries

4. Processing Purposes

Service Delivery

• Tool and feature provision
• Recording, transcription and AI analysis of meetings to produce summaries, sales insights and meeting briefings, and to link meetings to the relevant customers and deals in the customer’s Revial workspace and, where enabled, its CRM
• User account and access management
• Support and customer service

Customer Relationship Management

• Billing and payment processing
• Relationship-related communications
• Contract administration

Service Improvement and Analytics

• Usage monitoring and analysis for enhancement
• Interface and content personalization

Marketing and Communications

• Electronic direct marketing (consent-based or legally permitted)
• Customer communication and newsletters
• Event and training promotion

Security and Fraud Prevention

• Usage log monitoring for abuse detection
• Access control and technical protection

Meeting data is not sold, not used for advertising and not used to train AI models.

5. Legal Basis for Processing

• Contract: Service delivery and agreement fulfillment
• Legitimate Interest: Customer relationship management, service development, existing customer marketing
• Consent: Electronic direct marketing to new contacts, certain cookies, and the sharing of mobile application recordings with third-party AI services (see section 13)
• Legal Obligation: Accounting, regulatory requests

When meeting data is processed under a customer organisation’s Revial subscription, the customer organisation is the data controller and Revial acts as its processor under a data processing agreement. The customer organisation determines the legal basis for recording and analysing its meetings.

6. Cookies and Tracking Technologies

Used for:

• Essential: Core service functionality
• Analytics: Usage analysis and improvement
• Marketing: Content and advertising targeting (consent-required)

Users can manage cookies through browser settings or service preferences.

7. Data Sharing and Transfers

• Subcontractors and service providers (cloud services, payment processors)
• Third-party AI service providers acting as Revial’s processors for transcription and analysis of meeting data (see section 13)
• Business partners when necessary for service delivery
• Authorities when legally required
• Transfers outside the EU/EEA only with GDPR safeguards (Standard Contractual Clauses)
• Personal data is not sold

All service providers that process personal data on Revial’s behalf are bound by data processing agreements requiring them to protect the data to the same or an equivalent standard as described in this policy.

8. Retention Periods

• Customer data: during relationship + max 48 months after termination
• Meeting data: according to the customer organisation’s agreement with Revial, and deleted when the user account or customer organisation is removed
• Marketing lists: while consent active or until withdrawal
• Cookies: typically 24 months
• Legal requirements may mandate longer retention (accounting: 6–10 years)

9. Individual Rights

The right to:

• Access personal information
• Correction or deletion
• Processing objection (certain circumstances)
• Processing restriction
• Consent withdrawal
• Data portability (specific cases)
• File complaints with supervisory authority

Where Revial processes meeting data as a processor, requests are forwarded to the customer organisation acting as controller.

10. Data Security

Protection includes:

• Firewalls, encryption, access controls
• Role-based access (need-to-know principle)
• Security policies and staff training
• ISO/IEC 27001-certified information security management

11. Joint Data Controller Arrangements

In certain cases (joint events, marketing campaigns), joint controller status exists. Separate notices provided when applicable.

12. Google user data

Revial integrates with Google Workspace services so that users can connect their own Google account to the service. This section describes what Google user data Revial accesses, for what purpose, and how that data is handled. It applies in addition to the rest of this policy.

No Google user data is accessed until a user explicitly connects their Google account from within the Revial application, and that connection can be withdrawn at any time from the same screen.

Google Calendar

Scope requested: https://www.googleapis.com/auth/calendar.events.readonly — read-only access to calendar events.

Data accessed: event title, start and end time, event description, organiser and attendee list, and the conferencing link stored on the event.

Purpose: to identify the user’s upcoming customer meetings; to generate a preparation briefing for each meeting; to allow the Revial notetaker to join a meeting using the conferencing link recorded on the event; and to determine when a meeting has ended so that post-meeting materials can be produced.

Revial’s access is read-only. Revial does not create, modify or delete calendar events.

Revial’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

13. Meeting recordings and third-party AI processing

What is sent and to whom. Meeting recordings and transcripts are processed by two third-party AI services acting as Revial’s data processors:

• AssemblyAI converts meeting audio into transcripts with speaker identification. The audio recording is sent to AssemblyAI.
• Google (Gemini, via Google Cloud Vertex AI) produces summaries, action items, sales insights and meeting briefings. The transcript and meeting metadata are sent to Google.

Both services process the data in the EU.

Protection. Both providers are bound by data processing agreements that require them to process the data only on Revial’s instructions, to protect it to the same or an equivalent standard as described in this policy, and not to use it to train their AI models.

Permission in the mobile application. Before the first recording, the Revial mobile application explains what data is sent, to whom and for what purpose, and asks for the user’s permission. No recording is shared with a third-party AI service without this permission. If the user declines, the recording feature is disabled. Users can withdraw or grant permission at any time in the application under Settings → Privacy. Withdrawal stops future sharing and does not affect processing carried out before withdrawal.

Meeting participants. Recordings may contain personal data of other meeting participants. The user starting a recording is responsible for informing participants in accordance with their organisation’s policies and applicable law.

Storage. Meeting data is stored on Revial’s servers in the EU (Amazon Web Services, Stockholm).

14. Policy Updates

Updates occur due to service development, legislative changes, or regulatory guidance. Update dates appear at document top.

15. Contact Information

Data protection inquiries: Jone Korpi, jone@revial.ai, Spinder Company Oy (Revial)