Privacy Policy

Revyso is operated by Gianluca Cavalieri Clerigo, an individual based in Brazil, who is the controller of the personal data processed here — under Brazil's LGPD (Law 13.709/2018) and, for anyone in Europe or the United Kingdom, under the GDPR and UK GDPR.

Any request, question or complaint about privacy goes to gian31110@gmail.com. It is the same address for everything, and a person reads it.

We collect what the service needs to work. Every item below exists because some screen stops working without it.

• Account: email and password. Without them there is no way back to your materials. The password is never stored as text — Supabase Auth keeps only a hash, and not even we can read it.
• Profile: name, photo (if you sign in with Google), school year, daily study goal and language. These let the interface and the AI match the level of the explanation and the language of the answer.
• Study data: subjects, exams and assignments on the calendar, flashcards, questions and your answers, study plans, study sessions and presentations. This is your content — the reason the account exists.
• RevysAI conversations: what you write and what the AI answers, so the conversation picks up where it left off and you can find what you asked for.
• Gamification: XP, level, day streak and achievements, computed from your use.
• Subscription: plan, status, renewal date and your subscription identifiers at Paddle. We never receive or store card numbers.
• Usage: counters of how many times you used each feature this month, to apply your plan's limits.

We do not ask for your address, phone number, ID document or payment details. We do not buy lists and we do not enrich your record with third-party data.

We do not collect sensitive data (health, religion, political opinion, biometrics) and Revyso is not the place for it. If you write that kind of information into an AI conversation or a flashcard, it will be treated as your content — but the better move is not to write it.

• Performance of the contract: account, profile, study content, AI conversations and subscription. Without processing these there is no service to deliver.
• Legal obligation: billing records, which must be kept for tax and consumer-protection periods.
• Legitimate interest: security, abuse prevention and the minimum technical records needed to keep the service up and intact.
• Consent: marketing messages, if you opt in. It is asked for separately, never bundled into accepting the Terms, and can be withdrawn at any time.

To deliver the service: store your materials, apply your plan's limits, charge the subscription, send account and billing email, and give the AI the context it needs to answer.

To keep the service running and safe: find defects, contain abuse and respond to incidents.

We do not use your study content for advertising, we do not sell it, and we do not hand it to anyone outside the list of processors below.

Your content is not used to train artificial-intelligence models — not by us, and not by our AI providers. See the AI Use Policy.

Nobody, except the processors that run parts of the service on our behalf, each limited to what it needs:

• Supabase — database and authentication: stores your account and all your content.
• Lovable — application hosting: serves the pages and runs the server.
• Anthropic — artificial intelligence: receives the text of your conversations to generate the answer. See the AI Use Policy for exactly what is sent.
• Paddle — reseller and Merchant of Record: receives data needed for the sale and subscription management, processes payments and card data directly, handles tax compliance and issues invoices. We never receive or store card numbers. Privacy notice: https://www.paddle.com/legal/privacy.
• Resend — email delivery: sends account and billing messages.

We may also disclose data where the law requires it, on a valid order from a competent authority, or to defend rights in legal proceedings.

The processors above are outside Brazil — mainly in the United States and the European Union. That means your data is transferred internationally.

Those transfers rely on standard contractual clauses and on each provider's data-protection commitments, under art. 33 of the LGPD and Chapter V of the GDPR.

• Account and study content: as long as the account exists. When you delete the account, all of it is erased immediately and permanently.
• AI conversations: as long as the account exists, or until you delete the conversation.
• Billing records: for the period tax law and consumer-protection law require, even after the account is closed — the only category that survives deletion.
• Technical security records: for a short period, enough to investigate an incident.

At any time, and without having to justify yourself, you can:

• Know what data we hold about you and get a copy of it.
• Correct data that is wrong or out of date — which you can do yourself on the profile screen.
• Delete your account and everything attached to it.
• Receive your data in a machine-readable format, to take elsewhere (portability).
• Withdraw marketing consent, without affecting the rest of the account.
• Object to processing carried out on the basis of legitimate interest.
• Complain to the ANPD in Brazil, or to your country's data-protection authority.

The first two and deletion are buttons inside the app, on the account screen: you do not have to ask anyone or wait. For the rest, write to the contact address and we will answer within 15 days (LGPD) or 30 days (GDPR).

If you are in California: we do not sell or share personal data for behavioural advertising, in the senses the CCPA/CPRA gives those terms, and you are not discriminated against for exercising any right.

Revyso is built for middle- and high-school students. The minimum age to hold an account is 13.

Anyone under 18 needs permission from whoever is legally responsible for them. In the European Union and the United Kingdom that permission is required up to age 16, following each country's digital age of consent.

We do not offer the service to anyone under 13 and do not knowingly collect their data. If we learn an account was created below that age, it is deleted. A guardian who finds such an account can write to gian31110@gmail.com and it will be removed.

Minors' accounts receive no marketing messages and their data is not used for advertising profiling.

All traffic is encrypted (HTTPS/TLS). Passwords are stored only as hashes. Database access is restricted by row-level security, so an account can only reach its own rows. API keys exist on the server only and never reach the browser.

No system is perfect. If there is a security incident posing meaningful risk to your data, we will notify you and the competent authority with what is known and what is being done.

When the text changes materially, the date at the top changes and we notify you inside the app. Continuing to use the service after that means agreeing to the new version.