Privacy Policy

This Privacy Policy explains how Revalor LLC, doing business as VisionWorkx (“VisionWorkx,” “we,” “us,” or “our”), collects, uses and shares information through our website, the VisionWorkx App Builder and VisionWorkx Modules (together, the “Service”). It covers two groups of people differently:

• Our customers: businesses and their staff who sign up for and use the Service. We decide how this information is used.
• Our customers' visitors: people who fill in a VisionWorkx form on a customer's website. Here we act as a service provider (processor) for that business, which decides how the information is used. Section 3 explains this.

• Account and signup information: your name, email address, business name, website address, the website builder you use, and the date and version of the Terms you accepted. Workspace sign-in is passwordless (by emailed link). For the App Builder, passwords are stored hashed by our authentication provider.
• Business and configuration information: branding (logo, colors, fonts), business details, form and email settings, the website domains your modules run on, and an optional webhook address.
• AI prompts: descriptions you type to generate an app or draft a form.
• Payment information: collected and processed directly by Stripe. We never see or store your full card number.
• Usage and log data: device and browser information, pages used, and service logs, collected automatically to operate and secure the Service.

To provide and operate the Service and your Workspace; to process payments and manage subscriptions (including free trials); to send service emails (sign-in links, welcome and setup emails, usage-limit warnings, billing and security notices); to provide support, including installation help you request; to secure, monitor and improve the Service; and to comply with the law. We send product news only if you opt in.

When someone submits a VisionWorkx form on a customer's website, we collect on that business's behalf:

• The information they enter, for example name, email, phone, message, and any files they upload;
• The page address the form was submitted from;
• Email delivery events for the automatic emails the business has turned on (for example delivered, bounced, or unsubscribed), so we can stop emailing people who bounce or opt out.

To protect forms from abuse we compute a one-way, salted hash of the visitor's IP address for rate limiting. We don't store the raw IP address with submissions, and rate-limit records are cleared automatically within about an hour.

We use visitor information only to provide the Service to the business: storing the submission, showing it in their Workspace, sending the automatic reply and notification emails they configured, delivering it to their webhook if they set one, and preventing abuse. We don't sell it, use it for our own marketing, or use it to train AI models. Visitor submissions are not sent to our AI provider.

The business is responsible for telling its visitors how their information is used. If you submitted a form on a business's website and want to access or delete your information, please contact that business; we'll help them respond. You can also reach us at info@revalorllc.com and we'll pass your request on. Every automatic email includes an unsubscribe link.

We share information only with service providers that process it on our behalf:

• Supabase: database, authentication and file storage (hosted in the United States);
• Vercel: application hosting and infrastructure;
• Stripe: payment processing and billing (customers only);
• Resend: email delivery (sign-in links, notifications, and automatic emails to visitors);
• Anthropic: AI model used to generate apps and draft forms from customer prompts and business details (never visitor submissions).

A customer's webhook, if configured, sends that customer's submissions to the address the customer chooses. We don't sell personal information or share it for cross-context behavioral advertising. We may disclose information if required by law, to protect rights and safety, or as part of a merger, acquisition or sale of assets under confidentiality protections.

We use essential cookies to keep customers signed in and to run the Service. We don't use advertising or cross-site tracking cookies. VisionWorkx forms embedded on customer websites don't set cookies on visitors.

• Customer account information: while your account is active, then as long as reasonably needed for legal, tax, accounting or dispute purposes.
• Visitor submissions and files: kept for the business while its subscription is active. The business can delete them. After a subscription ends, they're kept for 30 days so the business can export them, then deleted.
• Unfinished uploads (files uploaded to a form that was never submitted) are deleted automatically after 24 hours.
• Email suppression records (addresses that bounced or unsubscribed) are kept so we don't email them again.

The Service is operated from, and data is stored in, the United States. A Data Processing Addendum is available on request for customers who need one.

Depending on where you live, you may have the right to access, correct, delete or export your personal information, or to object to or limit certain processing. Customers can export their submissions from the Workspace at any time. To make a request, email info@revalorllc.com; we'll verify your identity before acting. We won't discriminate against you for exercising your rights.

The Service is for businesses and is not directed at children under 16. Customers may not use modules on sites directed at children under 13. We don't knowingly collect information from children.

We use encrypted connections, access-controlled infrastructure and isolation between customers' Workspaces (each business can see only its own data). No system is perfectly secure, and we can't guarantee absolute security. We'll notify affected customers of a security incident involving their data as required by law.

Revalor Social Manager, our internal social media management tool, connects to Facebook Pages and Instagram Business Accounts that we own and administer, to schedule and publish content on our own behalf. We access basic account information (Page/account ID, username) and use publishing permissions solely to post approved content to our own connected accounts. We do not access, store or process Meta account data belonging to any other individual or business.

A business using a VisionWorkx booking module can choose to connect its Google Calendar. With the business owner's permission we access, from their Google account:

• Their email address, to show which Google account is connected.
• Free/busy times on their primary calendar (start and end times only, never event titles, attendees or other details), so their booking page doesn't offer times they're already busy.
• Events we create on their primary calendar: one per booking made through VisionWorkx, which we update when the booking is rescheduled and remove when it's cancelled. We don't read, change or delete any other events.

We store only an encrypted Google access credential, the connected email address, and the ID of each event we created. We don't sell Google user data, use it for advertising, share it with third parties (other than the service providers that host VisionWorkx), or use it to train AI or machine-learning models, and people at Revalor don't read it except to provide support the business asks for, for security, or where the law requires it. The business can disconnect at any time from Workspace Settings (or from their Google Account's third-party access page), which revokes our access and deletes the stored token.

VisionWorkx's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We may update this Privacy Policy. For material changes we'll update the date above and notify customers by email.

Questions about this Privacy Policy? Reach us at info@revalorllc.com.