Last Updated: 19 May, 2026
Version 2.0
This Privacy Policy explains how Revmai Ltd collects, uses, shares, and protects personal data when you visit our website, use our Services, or otherwise interact with us. It is written to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).
This Privacy Policy should be read together with our Terms of Service, our Data Processing Addendum, our Sub-Processor list, and our Cookies Notice — all available at revmai.com/legal.
We take your privacy seriously
If you have any questions about this policy or how we handle your data, we’re here to help.
Contact Us ➔The data controller for personal data processed under this Privacy Policy is:
Revmai Ltd
A company registered in England and Wales with company number 16515498.
Registered Office
30 The Causeway, Chatham, ME4 3SR, United Kingdom.
ICO Registration:
ZC009882
Privacy and Data Protection Officer:
General Privacy Enquiries:
Security and Breach Reports:
Postal Address:
as above, marked "FAO Data Protection"
Revmai processes personal data in two different roles depending on the activity:
We are the controller for personal data we collect directly when you visit our website, register for an account, contact us, attend our events, or receive our marketing communications. We are also the controller for personal data we collect from third parties to enrich our marketing database for our own outreach. This Privacy Policy describes that processing.
When our customers use the Services to manage their own commercial activities — including uploading contact lists, sending outreach, recording or transcribing meetings, building proposals, and generating AI Output — Revmai processes the personal data in those activities as a processor on behalf of the customer. The customer is the controller. The processing is governed by our Data Processing Addendum at revmai.com/legal/dpa and is not the subject of this Privacy Policy. If you are an employee, contact, or other data subject of a Revmai customer, please contact the customer directly to exercise your rights; we will support the customer in responding to you.
We collect the following categories of personal data when we act as controller. Some categories apply only to certain types of data subject (e.g., account holders only).
We process your personal data for the following purposes and on the following lawful bases under UK GDPR Article 6:
Providing the Services to customers (account access, support, billing)
Lawful basis: Performance of a contract (Article 6(1)(b)) — between Revmai and the customer; for Authorised Users, performance of the customer’s contract; necessary to take steps prior to entering a contract for account holders during onboarding.
Service security, abuse prevention, fraud detection, audit logging
Lawful basis: Legitimate interests (Article 6(1)(f)) — our interest in maintaining a secure and reliable platform for all customers; this interest is not overridden by your rights or freedoms.
Product analytics, usage analysis, service improvement
Lawful basis: Legitimate interests (Article 6(1)(f)) — our interest in improving the Services. We aggregate and anonymise data wherever possible so that no individual is identifiable.
Direct marketing to website visitors and prospects who have not previously been our customer
Lawful basis: Consent (Article 6(1)(a)) — collected via our cookie banner or marketing signup form. You may withdraw consent at any time.
Direct marketing to existing customers about similar Revmai products and services
Lawful basis: Legitimate interests (Article 6(1)(f)) and the PECR soft opt-in — our interest in informing existing customers about relevant services, with an unsubscribe option in every message.
Responding to enquiries and providing customer support
Lawful basis: Legitimate interests (Article 6(1)(f)) — our interest in responding to people who contact us; performance of a contract where the enquiry relates to an existing contract.
Complying with legal obligations (tax, accounting, regulatory, court orders)
Lawful basis: Legal obligation (Article 6(1)©).
Establishing, exercising, or defending legal claims
Lawful basis: Legitimate interests (Article 6(1)(f)) — our interest in protecting our legal position.
Corporate transactions (due diligence on a merger, acquisition, or sale)
Lawful basis: Legitimate interests (Article 6(1)(f)) — our interest in undertaking and protecting the value of corporate transactions; we use suitable safeguards (NDAs, anonymisation) where personal data is shared with advisers and bidders.
Where we rely on legitimate interests, you have the right to object to the processing — see clause 12 (Your rights). We have undertaken a balancing assessment for each legitimate interest relied on; a summary is available on request at dpo@revmai.com.
We share personal data only as set out in this clause.
Some of our sub-processors are located outside the United Kingdom. Where personal data is transferred to a third country (other than to a country covered by UK Adequacy Regulations), we put in place one of the transfer mechanisms recognised under UK GDPR Chapter V:
Where required, we have undertaken a transfer risk assessment in line with ICO guidance. You can request a copy of the relevant transfer mechanism or transfer risk assessment by contacting dpo@revmai.com.
We retain personal data only for as long as necessary for the purposes for which it was collected, as required by law, or as necessary to establish, exercise, or defend legal claims. The following retention periods apply (where multiple bases apply, the longer period applies):
No method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security but we work continuously to improve our controls.
We use appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage, having regard to the state of the art and the nature, scope, and purposes of processing (UK GDPR Article 32).
Our measures include:
Where required, we have undertaken a transfer risk assessment in line with ICO guidance. You can request a copy of the relevant transfer mechanism or transfer risk assessment by contacting dpo@revmai.com.
Several features of our Services use artificial intelligence to assist commercial decision-making — including the ROSIE AI Co-Pilot, the AI SDR, prospect scoring, and meeting summarisation. These features involve profiling within the meaning of UK GDPR Article 4(4).
We do not make solely automated decisions that produce legal effects, or similarly significant effects, on any data subject within the meaning of UK GDPR Article 22. Where the Services suggest a prospect score, generate an outreach draft, or summarise a meeting, the final commercial decision (whom to contact, what to send, how to act) is taken by a human at the customer organisation.
If you believe that an automated decision has been made about you through our Services, please contact dpo@revmai.com. You have the right to express your point of view, contest the decision, and obtain human review.
Our Services rely on third-party large language models, including services provided by Anthropic, Azure OpenAI, and Google. We have configured our agreements and processing settings so that:
AI outputs may contain errors. Please review AI outputs before relying on them, particularly for any decision that affects an individual's legal rights, employment, credit, insurance, or other significant matter.
Under UK GDPR, you have the following rights in relation to your personal data:
To exercise any of these rights, please contact dpo@revmai.com. We will respond within one month, or where we extend the period under UK GDPR Article 12(3), we will tell you within that month and explain why.
Right to complain to the Information Commissioner’s Office.
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority. The ICO can be contacted at:
We would, however, appreciate the chance to address your concerns first — please contact us at dpo@revmai.com.
We send marketing communications about Revmai's products and services on one of three bases: (a) your consent (where you have opted in through our website or signup forms); (b) the soft opt-in under regulation 22(3) of PECR (where you are an existing customer, the communication is about similar products and services, and you were given a simple way to opt out when your data was first collected); or (c) for B2B contacts (corporate subscribers under PECR), the rules permit communications without consent provided we offer an opt-out in each communication.
You can opt out of marketing at any time by using the unsubscribe link in any of our marketing emails, by emailing privacy@revmai.com, or by updating your communication preferences in your Revmai account.
We use cookies and similar technologies on our website to make the website work, to remember your preferences, to measure how the website is used, and (where you consent) to deliver advertising. Detailed information about the cookies we use, their purposes, the parties who set them, and how you can manage your preferences is set out in our Cookies Notice at revmai.com/legal/cookies. You can also manage cookies directly through your browser settings.
Strictly necessary cookies are set without consent because they are required to deliver the website to you (for example, to remember items in a form). All other categories — analytics, functional, marketing — are set only where you have consented through our cookie banner. You may change or withdraw your cookie consent at any time by clicking the "Cookie preferences" link in the website footer.
Our Services and website are intended for use by businesses and their employees. We do not knowingly collect personal data from children under the age of 16. If you are under 16, please do not provide personal data to us. If we become aware that we have collected personal data from a child under 16 without verifiable parental consent, we will take steps to delete that data promptly.
If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:
Our breach notification will describe (where the information is available) the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address the breach and to mitigate its effects.
We may update this Privacy Policy from time to time. For material changes (changes that significantly affect how we process your personal data, the recipients we share it with, or your rights), we will give you at least 30 days' prior notice by email (where we have your email address) or by a prominent notice on our website. For non-material changes (clarifications, typographical corrections, updates required by law), we will update the "Last Updated" date at the top of this Privacy Policy.
Older versions of this Privacy Policy are available on request at dpo@revmai.com.
End of Privacy Policy
Revmai Ltd | Company number 16515498 | 30 The Causeway, Chatham, ME4 3SR | dpo@revmai.com
Ready to Accelerate?
From first contact to signed contract — with less friction, more intelligence, and real human support.
