Our application is built with data security and privacy at its core. All customer data processed through our platform is stored and processed entirely within the European Union. The infrastructure is configured as a controlled environment where no third-party provider has access to your data. Customer data is never used to train AI models.

Controller

Technocrats Oy is the controller of website inquiries, its own customer relationship data and technical diagnostics, as defined under the EU General Data Protection Regulation (GDPR). The customer company is the controller of employee and work-related data and determines its legal basis; we process this data on its behalf.

What personal data we collect

Through our website (reviful.com)

When you use our contact form, we collect:

• Name

• Email address

• Phone number (optional)

• Message content

Through our application (SaaS platform and mobile apps)

When you create an account and use our platform, we collect:

• Name and email address (account registration)

• Authentication information (Firebase Authentication)

• Business data you upload or input into the platform, including work reports and photos

• Mobile route-tracking coordinates, timestamps and location accuracy

• Technical diagnostics (errors, crashes, performance, device and app details, installation and session identifiers) and server logs (including IP addresses)

For mobile offline use, data is also stored on your phone and synchronised when a connection is available.

Technical diagnostics are collected automatically, including before sign-in. Signed-in diagnostics may be linked to your account and company.

Why we collect personal data and legal basis

We collect and process personal data for the following purposes:

• Responding to contact form inquiries (name, email, phone number, message) — Legal basis: Legitimate interest

• Providing and maintaining our service (account details, business data) — Legal basis: Performance of a contract

• Customer communication (name, email) — Legal basis: Legitimate interest

• Technical diagnostics and security — Legal basis: Legitimate interest

Mobile route tracking

Mobile route tracking records location, including in the background, to verify visits and completed work.

Who has access to the data

Your personal data is accessible to our team and is processed by the following third-party service providers, who act as data processors on our behalf:

• Google Workspace (Gmail) — email communication

• HubSpot — customer relationship management (CRM)

• Framer — website hosting and contact form submissions

• Firebase Authentication — authentication information

These services only process information related to inquiries and authentication, such as names and email addresses. No customer application data or business data uploaded to our platform is shared with these providers.

• Google Cloud — application hosting, data storage and processing

These providers process data in accordance with their own privacy policies and under data processing agreements with us.

International data transfers

All customer or business data processed through our application remains within the EU. No third-party provider has access to your business data.

Some of our communication and business tools (Google Workspace, HubSpot, Framer), as well as our authentication tool Firebase Authentication, are operated by US-based companies and may process contact information such as names and email addresses outside the EU. These transfers are protected by appropriate safeguards, including EU Standard Contractual Clauses (SCCs) and, where applicable, the EU-U.S. Data Privacy Framework.

No customer application data or business data uploaded to our platform is shared with these providers.

Data retention

Contact form submissions: Retained for up to 12 months after your last interaction with us, unless a business relationship is established.

We retain technical diagnostics for a maximum of 90 days.

Data added to the platform, including user accounts and route-tracking locations: According to the customer company's instructions. Unless the customer company instructs otherwise, raw route-tracking locations are retained for up to one year.

When the customer contract ends, we delete or return the customer company's data within 30 days, unless otherwise agreed.

Data deletion

Reviful users can request deletion of their account and personal data by emailing info@technocrats.ai. Include your Reviful account email address and company name. Do not send your password.

Your company is the controller of your data, so we forward the request to it and carry out deletion according to its instructions without undue delay. If work or visit records need to be retained for later verification of completed work, they may be anonymised at the company's instruction so that the employee can no longer be identified.

Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you

• Correct inaccurate personal data

• Request deletion of your personal data

• Restrict the processing of your data

• Object to processing based on legitimate interest

• Data portability — receive your data in a structured, machine-readable format

To exercise any of these rights, contact us at info@technocrats.ai. You may also lodge a complaint with a data protection authority.

Cookies

Our website does not use analytics, marketing, or tracking cookies. If this changes in the future, we will update this policy and implement appropriate consent mechanisms. The web application uses cookies necessary for authentication and security.

Changes to this policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated date. We encourage you to review this policy periodically.