Compliance
Subprocessors
DPA
Security Reporting
Docs under NDA
Privacy
Cookies
Rights Portal
Security Controls
Policies
Security Contact
FAQ
Trust & Security
Revmai is an AI-powered B2B sales platform. We know that trusting us with your data — and your prospects' data — is a serious decision. This Trust Centre sets out, in plain terms, how we protect that data, who we work with, and how to exercise your rights.
Operated by Revmai Ltd · Registered in England & Wales, company no. 16515498 · Last reviewed June 2026
The laws and frameworks we operate under
Revmai Ltd is the data controller for personal data we collect about our own users and website visitors, and acts as a data processor for the customer data our clients put into the platform. We are committed to handling all personal data in line with UK data protection law.
✪
GDPR Certified
Revmai holds GDPR certification issued in Jun 2026 and valid until Jun 2027. The certification covers our data processing activities as a processor of customer and prospect data.This sits alongside our existing alignment with the UK GDPR and Data Protection Act 2018 described above.
§
Data Protection Act 2018
Our processing complies with the DPA 2018, which sits alongside the UK GDPR as the UK's core data protection framework.
@
PECR
Our use of cookies and electronic marketing follows the Privacy and Electronic Communications Regulations 2003, as amended by the Data (Use and Access) Act 2025.
UK GDPR aligned
Primary hosting in the UK
ICO is our supervisory authority
GDPR Certified — Jun 2026
SOC 2 / ISO 27001 — not yet certified
Revmai is an early-stage company. We are not yet ISO 27001 or SOC 2 certified, but our technical and organisational measures are designed to align with those frameworks. Independent certification is on our roadmap.
The categories of third parties we use to deliver the platform
We engage a small number of vetted subprocessors to deliver the Revmai platform. Each is bound by a written agreement with data protection terms materially equivalent to our own, and we remain fully responsible for their performance. The categories below give an overview; the full, named subprocessor list — with locations and transfer mechanisms — is available to customers and prospects on request under NDA. Customers receive at least 30 days' notice before we add or replace a subprocessor.
☁
Cloud hosting & storage
Enterprise cloud hosting, storage and AI inference — data hosted in the United Kingdom.
🧠
AI model inference
Large-language-model providers that power Revmai's AI features.
✉
Email delivery
Transactional and outreach email delivery on customers' behalf.
🔎
Data enrichment & research
Enrichment of business-contact data and web research for prospecting features.
🗄
Vector database
Embeddings storage that supports AI search and retrieval (EU-hosted).
🔗
Auth, integrations & deployment
OAuth sign-in, calendar/document integrations, and CI/CD deployment infrastructure.
Website & marketing providers (processing website visitor data only): GoDaddy (managed WordPress hosting), Cloudflare (security / bot mitigation), CookieYes (consent management), and Google Analytics via Site Kit. These are disclosed in full in the Cookie Notice.
Our processor commitments to customers
When you use Revmai to process personal data, we act as your processor. Our Data Processing Agreement (DPA) sets out the contractual safeguards required by Article 28 UK GDPR, including:
Found a problem? Tell us — we want to hear from you
We welcome reports from security researchers and users. If you believe you've found a vulnerability or a security issue affecting Revmai, please report it to us privately so we can fix it before any details are made public.
✉
How to report
Email a security report with a description, steps to reproduce, and any proof-of-concept. Please don't disclose the issue publicly until we've resolved it.
⏱
What to expect
We aim to acknowledge reports within 3 business days and to keep you updated as we investigate and remediate.
🛡
Safe harbour
We won't pursue legal action against good-faith research that respects user privacy, avoids data destruction, and gives us reasonable time to fix the issue.
Please act in good faith: only test against your own account, avoid accessing or modifying other users' data, and never run denial-of-service or social-engineering attacks.
Detailed materials we share with customers and prospects under confidentiality
Some materials contain sensitive operational detail, so we share them on request once a mutual NDA is in place. These currently include:
Our Privacy Policy explains what personal data we collect as a controller, why, the lawful bases we rely on, how long we keep it, and the rights you have. privacy@revmai.com is our single point of contact for all privacy matters.
Read the Privacy PolicyOur Cookie Notice lists every cookie used on revmai.com — strictly necessary, functional, and analytics — with provider and duration. Non-essential cookies are set only after you consent via our cookie banner.
Read the Cookie NoticeExercise your rights under UK GDPR
You have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. Complete the form below and it will open a pre-filled email to our Privacy Lead at privacy@revmai.com. We respond within one month, as required by law.
This opens your email client with the details pre-filled, addressed to privacy@revmai.com. If a Revmai customer holds your data within their account, we act as their processor and may need to forward your request to them as the controller.
The technical and organisational measures protecting your data
🔒
Encryption
Personal data is encrypted in transit (TLS 1.2+) and at rest (AES-256) on Microsoft Azure infrastructure.
🇬🇧
UK data residency
Primary storage and production workloads are hosted in Microsoft Azure UK regions. Some processing by our subprocessors takes place outside the UK under approved safeguards (see International transfers).
👤
Access control
Role-based access, unique accounts, OAuth 2.0 for connected services, least-privilege, and admin access to production restricted to authorised personnel.
🗂
Environment segregation
Separate development, staging and production environments, with Azure platform-level redundancy.
💾
Resilience & recovery
Automated backups on a defined rotation with documented restore procedures.
⚙
Operational security
Source control and CI/CD with review controls, dependency & vulnerability monitoring, secrets management, and production logging.
🎓
People
Confidentiality obligations for all personnel, data protection training, and prompt access revocation on offboarding.
🤝
Vendor management
Written data protection agreements with every subprocessor and periodic review of their security posture.
.🚨
Incident response
Documented breach procedure: detection, escalation, containment, customer notification within 48 hours, and post-incident review.
📉
Data minimisation
In-product deletion controls and return/deletion of data within 30 days of termination.
🧠
Responsible AI use
We do not use customer data to train our AI models, except as needed to deliver features you configure, in anonymised form, or with your consent.
🌐
International transfers
Where a subprocessor is outside the UK, transfers rely on UK adequacy, the UK Extension to the EU–US DPF, or the UK IDTA/Addendum with a transfer risk assessment.
Our internal governance register — full text available to customers under NDA
We maintain a set of internal policies that govern how we run the business securely and lawfully. These are restricted-access documents; summaries or full copies are available to customers and prospects on request under NDA.
Data Protection & UK GDPR
GDPR compliance programme, records of processing, and lawful-basis governance.
Information Security Policy
The overarching controls framework for protecting systems and data.
Access Control Policy
Identity, authentication, least-privilege and joiner/mover/leaver processes.
Incident Response Policy
Detection, escalation, containment and breach notification procedures.
Business Continuity & DR
Continuity planning, backup/restore and recovery objectives.
Risk Assessment Policy
How we identify, score and treat operational and data protection risks.
Legitimate Interests & LIA
Our balancing assessments where we rely on legitimate interests.
PECR / Cookies Compliance
Governance of cookies and electronic marketing under PECR.
Data Retention & Deletion
Retention schedules and secure deletion practices.
Security & Privacy Contact
One point of contact for security reports, privacy requests, and trust questions.
Revmai Ltd — Privacy Lead
Email: privacy@revmai.com
Post: 30 The Causeway, Chatham, ME4 3SR, United Kingdom
Company no. 16515498 · Registered in England & Wales
Customer data and production workloads are hosted on Microsoft Azure in the United Kingdom (UK South region). Some subprocessors operate outside the UK; in those cases we rely on an approved transfer mechanism (see Subprocessors and Security Controls).
No. We do not use customer personal data to train AI models, except where strictly necessary to provide a feature you've configured, in aggregated/anonymised form that doesn't identify anyone, or with your prior written consent.
Not yet. As an early-stage company we have designed our controls to align with these frameworks and the Article 32 UK GDPR requirements in our DPA. Independent certification is on our roadmap.
Use the "Request a copy of the DPA" button in the Data Processing Agreement section, or email privacy@revmai.com. We can sign our standard DPA as part of your subscription.
Without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting your data, with details provided in phases as our investigation progresses.
We give at least 30 days' prior notice of adding or replacing a subprocessor. If you object on reasonable data protection grounds, we'll work with you to find an alternative.
Use the Data Subject Rights Portal above, or email privacy@revmai.com. We respond within one month. If your data sits inside a customer's account, we act as their processor and may forward your request to them as the controller.
Email privacy@revmai.com for security reports, vulnerability disclosures, and any trust or privacy question.
🗂
Full subprocessor list (under NDA)
We’ll share the complete, named subprocessor list — with locations and transfer mechanisms — under a mutual NDA.
🔔
Subprocessor change notices
We’ll email you at least 30 days before we add or replace a subprocessor. Enter the address to notify.
📄
Request a copy of the DPA
We’ll send our Data Processing Agreement for your review. Tell us where to send it.
🛡
Report a security issue
Thanks for helping keep Revmai secure. Please report privately and give us reasonable time to fix the issue before any public disclosure.
Good-faith research that respects user privacy and avoids data destruction is covered by our safe-harbour position.
🔐
Security documents (under NDA)
Select the documents you’d like. We’ll share them once a mutual NDA is in place.
📘
Request a policy (under NDA)
Choose which internal policy you’d like to review. Shared under a mutual NDA.
