Privacy Policy

Effective Date: January 6, 2026

Last Updated: February 5, 2026

1. Introduction

Ravando ("Ravando," "we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect your personal information when you visit our website or use our services. We aim to inform you about your privacy rights and how the law protects you.

We operate in the Netherlands and comply with the General Data Protection Regulation (GDPR/AVG), the Dutch Telecommunications Act (for cookies and tracking), Dutch consumer protection laws, and international data protection standards where applicable.

This website is not intended for children and we do not knowingly collect data relating to children.

2. Data Controller Information

Full name of legal entity: Ravando
KvK: 99651270
Email: support@ravando.com

For privacy-related inquiries, contact us at: support@ravando.com

We are registered with the Dutch Chamber of Commerce (KvK) under number 99651270. You have the right to make a complaint at any time to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). We would, however, appreciate the chance to deal with your concerns before you approach the Dutch Data Protection Authority, so please contact us in the first instance.

3. We collect the following

3.1 Information you provide directly

When you fill out our contact form, we collect your full name, email address, company name, phone number (optional), project description or inquiry details, primary business challenge, and how you heard about us.

A. Contact Forms & Inquiries

B. Discovery Calls & Appointments

When you book a call via Cal.com, we collect your name, email, selected time slot, timezone, pre-call questionnaire responses, and calendar metadata.

C. When You Become a Client

We collect billing information (company details, address, VAT number), payment details (via Stripe), project requirements/documentation, communication history, and encrypted access credentials for third-party platforms.

D. When You Communicate With Us

This includes email correspondence, chat messages, support requests, and technical inquiries.

3.2 Information we collect automatically

Any use of Ravandos website and/or software may result in the collection of technical information such as your computers IP address, mobile device identifier, metadata, operating system, browser name/version, the referring web page, and requested page. This information is used to help us understand overall usage patterns of our website and software.

We also use third-party analytics tools to help us measure how you use our website. These tools collect information sent by your device or our service, including usage information, which helps us improve our service.

Ravando may also invite you to provide information through feedback requests, surveys, or product/service support. Your response to these communications may require you to submit personal information and opinions.

A. Website Usage Data

Includes anonymized IP address, browser type/version, device type, pages visited, referral source, geographic location (city level), and access timestamps.

B. Cookies and Tracking Technologies

We use Google Analytics (anonymized visitor behavior), session cookies for functionality, and preference/analytics cookies (with your consent).

4. Legal basis for processing your data

4.1 Performance of Contract

Delivering AI automation services, project management, invoicing, and support.

4.2 Legitimate Interest

Website optimization, fraud prevention, security monitoring, and business development.

4.3 Consent

Marketing communications, optional cookies, and newsletter subscriptions.

4.4 Legal Obligation

Maintaining financial records for tax authorities (7-year retention) and Dutch accounting compliance.

5. How we use your information

We may use information that we receive to:

Help you efficiently access your information after you become a client and/or contact us.
Provide personalized content and information to you and others, which may include online ads or other forms of marketing.
Provide, improve, test, and monitor the effectiveness of our service.
Develop and test new products and features.
Monitor metrics such as visitor numbers, traffic, and demographics.
Diagnose or fix technology problems.

A. Service Delivery: Building systems, integrating with your tools, providing technical support, and team training.

B. Communication: Responding to inquiries, project updates, scheduling calls, and sending invoices.

C. Business Operations: Processing payments, improving services, and internal analytics.

D. Marketing (With Consent): Newsletters, case studies, and webinar invitations.

5.1 Purposes/Activities and Lawful Bases

We have set out below a description of all the ways we plan to use your personal data, the lawful bases we rely on, and where applicable, our legitimate interests:

Registering you as a new customer performance of a contract.
Processing and delivering your order (including managing payments, fees, and charges, and recovering money owed) performance of a contract; legitimate interests (recovering debts).
Managing our relationship with you (notifying you of changes to terms or policies, requesting reviews/surveys) compliance with legal obligations; legitimate interests (keeping records updated, studying service usage).
Enabling prize draws, competitions, or surveys performance of a contract; legitimate interests (customer engagement).
Administering and protecting our business and website (troubleshooting, data analysis, testing, maintenance, reporting, hosting) legitimate interests (running business operations, preventing fraud, IT security).
Delivering relevant content and ads and measuring effectiveness legitimate interests (developing services, growing business, informing marketing strategy).
Using analytics to improve services and customer experience legitimate interests (development and growth).
Making recommendations about goods or services that may interest you legitimate interests (developing offerings, growing business).

6. Marketing

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.

6.1 Promotional offers from us:

We may use your identity, contact, technical, usage, and profile data to form a view on what we think you may want or need, or what may interest you. You will receive marketing communications from us if you have requested information or purchased goods/services and have not opted out.

6.2 Third-party marketing:

We will get your express opt-in consent before sharing your data with third parties for marketing purposes.

6.3 Opting out:

You can stop marketing messages at any time by using the unsubscribe link in emails or by contacting us at support@ravando.com. Opting out does not affect service-related communications (e.g., order confirmations).

8. Cookies and Tracking Technologies

We use strictly necessary cookies for security and session integrity. Optional analytics cookies (Google Analytics) are only used if you provide consent via our cookie banner.

You can set your browser to refuse cookies or alert you when websites set cookies. If you disable cookies, parts of our website may not function properly.

9. Change of Purpose

We will only use your personal data for the purposes for which it was collected unless we reasonably consider another use compatible with the original purpose. If we need to use your data for an unrelated purpose, we will notify you and explain the legal basis.

10. Sharing Your Information

We do not rent or sell your information to third parties without your consent.

We may share anonymized or aggregated data with partners under confidentiality terms, or disclose information as required by law (e.g., to comply with legal processes, protect rights/property, prevent fraud or harm).

11. How We Store Your Information

We use commercially reasonable precautions to keep your personal data safe. However, no transmission or storage system is 100% secure.

You are responsible for maintaining the confidentiality of your account credentials. Following account termination, we may retain certain data for backup, audit, or legal purposes for a commercially reasonable period.

12. Children's Privacy

Services are not directed to individuals under 16. We do not knowingly collect personal data from children or allow them to register. If we learn we have collected such data without parental consent, we will delete it promptly. Please contact support@ravando.com if you believe we may have data about a child under 16.

13. Other Websites and Services

Our Privacy Policy does not apply to third-party websites or services linked to or from ours. Your interactions with those services are governed by their own privacy policies.

14. Your Data Protection Rights (EEA & UK)

If you are a resident of the EEA or UK, you have rights to: access, correct, update, or request deletion of your personal data; object to processing; request restriction of processing; request data portability; and withdraw consent at any time.

To exercise your rights, email support@ravando.com.

You also have the right to complain to your local data protection authority.

15. Your Rights Under GDPR

Access & Rectification

Request confirmation of data held and correct inaccuracies.

Erasure & Portability

Request data deletion or machine-readable copies.

Object & Restriction

Object to marketing or stop processing during disputes.

Withdraw Consent

Withdraw permission for marketing at any time.

To exercise rights, email support@ravando.com with "Data Subject Request". We respond within 30 days.

16. Client Data Processing (B2B Services)

When providing services, Ravando acts as a Data Processor. The client is the Data Controller and is responsible for obtaining consent and establishing the lawful basis for processing. All terms regarding data handling, third-party tool authorizations, and liability are covered in our signed client proposal.

17. Data Retention Periods

Data Type	Retention Period	Legal Basis
Contact form inquiries (non-clients)	1 year	Legitimate interest
Client project data	7 years	Dutch tax law obligation
Financial records (invoices)	7 years	Dutch accounting law
Google Analytics data	14 months	GDPR best practice
Marketing consent records	Withdrawal + 3 years	Legal obligation

18. Questions

If you have any questions about this Privacy Policy or our services, please contact us at support@ravando.com.

19. Changes to this Privacy Policy

Ravando may update this Privacy Policy from time to time. Changes will be posted on this page, and where appropriate, we may notify you by email or through the website. Continued use of our services after changes means you accept the updated Privacy Policy.

20. Reputation Shield (RavShield): Google Business Profile review management

Reputation Shield, also referred to as RavShield and operating at ravshield.com, is a service operated by Ravando that drafts and publishes replies to Google reviews on behalf of subscribing businesses. Because it processes data belonging both to our customers and to people who reviewed them, this section describes it specifically. Where it differs from the rest of this policy, this section applies.

20.1 Two groups of people, treated differently

Subscribers: the businesses that pay for the service and grant us access to their Google Business Profile.
Reviewers: members of the public who left a review on a subscriber's Google listing. They are not our customers and have no relationship with us. Everything we hold about them, they published themselves, on Google, in public.

20.2 What we store

About a subscriber: business name and contact email address; Stripe customer and subscription identifiers; Google Business Profile account and location identifiers; their tone of voice preference, free-text voice notes, and any words they have asked us never to use; and operational state such as account status, timestamps and error counts.

About reviews: for each Google listing a subscriber asks us to manage, the review identifier, star rating, review text, the reviewer's public display name as shown by Google, the publication date, and the reply we drafted or posted. All of this is already public on the listing. We keep a copy so a review is never replied to twice, and so subscribers have a record of what was published in their name.

20.3 What we never store

Google account passwords. We never ask for them. Access is granted through Google's own manager invitation and OAuth.
Payment card details. Payments are handled entirely by Stripe and card data never reaches our systems.
Contact details for reviewers. We do not hold their email address or phone number and do not attempt to obtain either.

20.4 Google account access

Subscribers grant access by inviting our Google account as a Manager on their Business Profile, which is Google's standard flow. We request a single OAuth scope, https://www.googleapis.com/auth/business.manage, and use it for exactly four operations: listing the accounts and locations we have been given access to, reading reviews, and posting a reply to a review.

The long-lived credential is held in an encrypted secret store, separate from our database. A subscriber can revoke it at any moment by removing our account as a Manager, without telling us first, and access ends immediately.

20.5 Who else sees this data

We do not sell this data, do not share it for advertising, and do not use it to train any model of our own. It reaches the following processors only so the service can function:

Google: the reply text we post to a review, on the subscriber's behalf.
OpenRouter, and the model provider it routes a request to: the star rating and text of a review, plus the subscriber's tone of voice configuration, in order to draft a reply. The reviewer's name is not sent.
Stripe: subscriber billing details, handled directly by Stripe.
Resend: a subscriber's email address, to deliver service email.
Neon and Modal: database hosting and compute for the service itself.

20.6 Automated replies

Replies are generated by a language model using the subscriber's configured tone of voice, then checked automatically before anything is published. Replies to reviews of three stars or fewer are sent to the subscriber for approval before they can be posted. Nothing we publish disputes a reviewer's account of what happened, names any individual, or promises a specific remedy.

20.7 Retention, and your rights

While a subscription is active, we retain this data for as long as it remains active. After cancellation, processing stops immediately and account and review data is deleted within 90 days, except billing records we are required to retain for tax purposes. Sooner on request.

Subscribers, and any reviewer whose review appears in our records, may ask us for a copy of what we hold, ask us to correct it, or ask us to delete it. We do not require a reason and do not charge. Requests are completed within 30 days and usually the same week. Write to support@ravando.com.

Deleting a review from our records does not remove it from Google. Only Google, or the person who wrote it, can do that.

20.8 Lawful basis

Performance of contract for the subscriber relationship, and legitimate interest for operating the service on a subscriber's behalf on their own public listing.