Privacy Policy

Revealu (“we”) provides a service that shows website owners which organisations visit their website. This policy explains what data we process, why, and what rights you have. It covers both our own website/app and the tracking script our customers install on their websites.

We process data in two distinct roles:

• Account data (of Revealu users): we are the data controller.
• Visitor data (of visitors to our customers' websites): the customer is the data controller and we act as processor on their behalf. Visitors with questions about tracking on a specific website should contact the owner of that website.

• name and email address (to create and secure your account);
• password — stored only as a bcrypt hash, never in plain text;
• your organisation name and the websites you configure;
• optionally: your office address, if you enable distance-based sorting.

Legal basis: performance of the agreement (providing the Service). We do not sell account data and we do not use it for advertising.

When the tracking script runs on a customer's website, it processes:

• the visitor's IP address — used server-side to look up the organisation registered for that network, then stored only as a salted hash;
• technical context: pages viewed, referrer, browser and device type, screen size, language, time zone and country;
• a short-lived, daily-rotating fingerprint used to group pageviews into a visit (cookieless mode, the default) — nothing is stored on the visitor's device;
• optionally, if the website owner uses the identify function after e.g. a form submission: the company domain derived from a business email address. Only the domain is stored, never the address itself.

The purpose is company-level identification only. The Service is not designed to identify or profile individual natural persons, and consumer ISP networks are deliberately filtered out.

We use the following subprocessors to run the Service:

• Vercel (application hosting);
• Supabase (database hosting, EU region);
• IP intelligence providers (such as ipapi.is) and public registry services (RDAP/RIPE, reverse DNS, Dutch Chamber of Commerce and geocoding services) — these receive an IP address or company name solely to perform the lookup.

Data is transmitted over encrypted connections (HTTPS/TLS).

• account data: for as long as your account exists; deleting the account deletes it;
• visitor analytics data: for as long as the customer's account and websites exist, or until the customer deletes it (leads can be deleted individually, including all underlying visits);
• IP-to-company cache entries: up to 30 days, after which they are refreshed.

You have the right to access, rectify, erase and receive the personal data we hold about you, to restrict or object to processing, and to withdraw consent where processing is based on consent. To exercise these rights, contact us (section 9). You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

For visitor data on a customer's website, direct your request to that website's owner (the controller); we will assist them where required.

We may update this policy from time to time. The current version is always available on this page; the date above shows when it was last changed.

Privacy questions or requests? Reach the Revealu team via the contact option in your dashboard, or via the website owner who operates Revealu if you are a visitor of a customer's site. See also our Terms of Service and Disclaimer.