Privacy Policy

Effective 23 October 2026

What we collect, why, who else sees it, and when we delete it. If something here is unclear, email harsh@revbound.io and a person will answer.

1. Who we are

Revbound is a trading name of Scalix KlientsGrowth LLP, a limited liability partnership registered in India ("Revbound", "we", "us"). We run the website at revbound.io and the Revbound application at app.revbound.io (together, the "Service"). Revbound helps cold email agencies manage the replies to their campaigns: it brings replies from their sending tools into one inbox, sorts them with AI, drafts answers and books meetings.

2. Our two roles

We handle two different kinds of personal data, and our responsibility is different for each.

• Account data. Information about you as a visitor or customer: your name, email, login, billing and support history. For this data we are the controller (a "data fiduciary" under India's Digital Personal Data Protection Act, 2023). This policy covers it in full.
• Workspace data. Everything a customer brings into their workspace: the leads they email, the replies those leads send, campaign and mailbox details, notes and meetings. For this data our customer is the controller and we are their processor. We use it only to provide the Service to that customer and on their instructions. The customer is responsible for having a lawful basis to collect and use it, and their own privacy notice applies to it.

3. What we collect

Information you give us

• Account details: your name, work email, password (stored only as a salted hash), workspace name, and the people you invite to your team.
• Business context you enter so the AI can write in your voice, such as your offer, your clients and your goals.
• Messages you send us for support or sales.

Information from tools you connect

• API keys for your sending tools (for example Instantly, Smartlead, Email Bison, PlusVibe, SendKit or ArcSend), your calendar (Cal.com or Google Calendar), and, if you choose, your own AI, email verification, enrichment or Apify accounts. Keys are stored in your workspace's own database, shown masked in the app, and used only to run the features you switched on.
• Through those connections: campaigns, mailboxes and their health statistics, lead names, work emails, company and job details, the full text of replies and the emails you send, and calendar availability and bookings.

Payment information

Payments are handled by Dodo Payments, which acts as merchant of record. Dodo collects your card or payment details directly. We receive only the plan you bought, the amount, a customer and subscription reference, your billing country and the payment status. We never see or store your full card number.

Information collected automatically

• Technical data such as IP address, browser type and the pages or API routes requested, kept in server logs for security and troubleshooting.
• Usage records inside the app, such as how many replies the AI processed in a month, which we need to apply plan limits.
• The revbound.io website uses Google Tag Manager to load analytics and measurement tags, which record things like the pages you visit, how you arrived and roughly where you are. We use this to understand which pages help people and to measure sign-ups. The app at app.revbound.io does not load these tags.

4. How we use it

Where the EU or UK GDPR applies, the legal basis for each use is shown in brackets.

• To create your account, run the Service and provide the features on your plan (performance of a contract).
• To process workspace data on your instructions: syncing replies, sorting them, drafting and sending answers, running cadences and booking meetings (performance of a contract, and as your processor).
• To bill you, apply plan limits and send service emails such as verification, password reset, usage warnings, payment problems and deletion notices (performance of a contract).
• To answer support requests and, when needed to fix a problem, to open your workspace as a hidden support user. Every such session is recorded in an audit log (performance of a contract and legitimate interests).
• To keep the Service secure, prevent abuse and fix bugs (legitimate interests).
• To meet legal, tax and accounting duties and to defend legal claims (legal obligation and legitimate interests).

We do not sell personal data. We do not use workspace data for advertising, we do not contact your leads ourselves, and we do not use one customer's workspace data to serve another customer.

5. AI processing

Revbound sends the text of a reply, the earlier messages in that thread and the business context you entered to a large language model so it can classify the reply and draft an answer. On monthly plans we choose the AI provider. On lifetime plans, or if you add your own key on any plan, the request goes to the provider you chose (Anthropic, OpenAI, Google Gemini, Microsoft Azure OpenAI or OpenRouter) under your own agreement with them.

We use the providers' business API terms, under which they do not train their models on API inputs. We do not train any model on your workspace data. Results are cached in your workspace so the same thread is not sent again until a new reply arrives. AI output can be wrong, and you decide which features may send messages without your review.

6. Who we share it with

We share personal data only with the following, and only as much as each needs to do its job:

Tools you connect yourself (your sequencers, calendar, AI key, verifier, enrichment or Apify account) receive data under your own agreement with them, not ours. We also share data with authorities when the law requires it, and with a buyer or successor if our business is reorganised or sold, who would be bound by this policy. We will keep a current list of these providers on this page and update it before adding a new one that handles workspace data.

7. International transfers

We are based in India and our application servers are in Germany. Some providers above process data in the United States or elsewhere. When personal data leaves the EU, the UK or another region with transfer rules, we rely on the safeguards those rules require, such as the European Commission's Standard Contractual Clauses or the provider's approved transfer mechanism.

8. How long we keep it

• Active workspaces: for as long as your trial or plan is active. Lifetime plans stay active for the life of the Service.
• Lapsed workspaces: when a trial ends without a purchase, a payment fails, or a cancelled plan reaches the end of its paid period, the workspace becomes read-only. We keep it for 14 days, email the owners 7 days and 1 day before, and then permanently delete the workspace database and everything in it. Deleted workspaces cannot be recovered.
• Deleting your own workspace: an owner can delete the workspace from Settings at any time. This cancels the subscription and permanently deletes the workspace right away.
• Billing records: as long as Indian tax and accounting law requires, generally up to 8 years.
• Support emails and server logs: support correspondence for up to 24 months after the last message; server logs only as long as we need them to run and secure the Service.

We do not keep separate backups of customer workspaces, so deletion is final. Export anything you want to keep before a workspace lapses.

9. Security

Data travels over encrypted connections (HTTPS). Each customer workspace lives in its own separate database, so one customer's data is never stored alongside another's. Passwords are hashed, access to production systems is limited to the people who run the Service, and support sign-ins are logged. No system is perfectly secure. If a breach affects your personal data, we will tell you without undue delay and notify authorities where the law requires.

10. Your rights

Depending on where you live, you may have the right to:

• ask what personal data we hold about you and get a copy;
• have inaccurate data corrected;
• have your data deleted;
• object to or restrict how we use it;
• withdraw consent where we rely on it;
• receive your data in a portable format;
• nominate someone to exercise your rights on your behalf (India);
• complain to a data protection authority, such as your EU supervisory authority, the UK Information Commissioner's Office or the Data Protection Board of India.

California residents can also ask to know, delete and correct personal information. We do not sell or share personal information for cross-context behavioural advertising, and we will not treat you differently for using these rights.

Email harsh@revbound.io to use any of these rights. We reply within 30 days and may need to confirm your identity first.

11. If you are a lead in a customer's workspace

If you received a cold email from one of our customers and replied, your reply may be stored in that customer's Revbound workspace. The customer, not Revbound, decided to contact you and controls that data. Please send requests to the company that emailed you. If you cannot reach them, write to us and we will pass your request on and help where we can as their processor.

12. Cookies

The revbound.io website uses Google Tag Manager, which can set analytics and measurement cookies (for example Google Analytics) to count visits and sign-ups. You can block or delete these in your browser settings, or use Google's opt-out add-on at tools.google.com/dlpage/gaoptout. The app at app.revbound.io uses only strictly necessary cookies to keep you signed in and to remember which workspace you are in. Cloudflare may set a security cookie to detect bots.

13. Children

The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect data from children. If you think we have, contact us and we will delete it.

14. Changes to this policy

We will update this policy when our practices change, and the date at the top will show the latest version. If a change materially affects how we use data we already hold, we will email workspace owners before it takes effect.

15. Contact and grievance officer

For any privacy question, request or complaint, contact our grievance officer:

Harsh Shah, Partner, Scalix KlientsGrowth LLP (trading as Revbound)
Email: harsh@revbound.io

We aim to acknowledge every message within 3 working days and resolve it within 30 days.