Privacy Policy
Effective date: February 24, 2026 | Last updated: May 2, 2026
1. Introduction
This Privacy Policy explains how Revotion ("we", "us", or "our"), operated by Elie Rached, collects, uses, and protects your personal information when you use the Revotion mobile application and website (collectively, the "Service"). By using the Service, you agree to the collection and use of information as described in this policy.
2. Information We Collect
We collect the following types of information:
- Email address — used for account creation, login, and communication.
- Full name — used to personalize your experience and identify you in consultations.
- Photos — uploaded for visual product search (AI-powered similarity matching), site visit requests, and custom product requests. Photos used for visual search are processed but not stored permanently.
- Push notification tokens — used to deliver notifications about orders, messages, and bookings.
- Order history — records of products you have purchased or reserved.
- Chat messages — messages exchanged during architect consultations.
- Consultation records — details of your architect consultations including preferences, scheduled times, and status.
- Site visit details — information you provide when requesting a gallery site visit, including address, photos of your space, and preferred dates.
3. How We Collect Information
- Information you provide directly — when you sign up, complete your profile, place orders, send messages, book consultations, or submit site visit requests.
- Information generated during app usage — order history, favorites, cart contents, and consultation records are created as you use the Service.
- Automatically collected information — device identifiers for push notification delivery, error stack traces (via Sentry, no session replay), and product analytics events (via PostHog, only after you accept analytics in the cookie banner). See Section 5 for the full list of processors.
4. Purpose of Collection
We use your information to:
- Account management — create and maintain your account, authenticate your identity.
- Product discovery — power visual search and product recommendations.
- Architect consultations — connect you with architects, facilitate chat, and manage consultation workflows.
- Order processing — process your orders, manage delivery or pickup, and provide order status updates.
- Push notifications — send you timely updates about messages, orders, and bookings (you can disable these in settings).
5. Third-Party Services (Data Processors)
Revotion uses third-party service providers (data processors) to operate the platform. Each processor has signed a Data Processing Agreement (DPA) and is bound by their own privacy policies, linked below:
- Supabase — database, authentication, file storage, and Edge Functions. supabase.com/privacy
- Vercel — web hosting and edge runtime. vercel.com/legal/privacy-policy
- Stripe — payment processing. Stripe collects and processes card data directly inside their PCI-compliant environment; Revotion never sees raw card numbers (PCI SAQ-A scope). stripe.com/privacy
- Resend — transactional emails (welcome, verification, order confirmations, consultation reminders). resend.com/legal/privacy-policy
- Sentry — error monitoring on web and mobile. Only crash reports and error stack traces are captured; session replay is disabled. sentry.io/privacy
- PostHog — product analytics. Consent-gated: PostHog only fires after you click "Accept analytics" in our cookie banner. posthog.com/privacy
- OpenAI — voice transcription (Whisper), image description (gpt-4o-mini), and text embeddings (text-embedding-3-small) for the in-app AI features. openai.com/policies/privacy-policy
- Hugging Face — image classification model (Vision Transformer) used to power visual search. huggingface.co/privacy
- Expo / EAS — delivers push notifications to your device via Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM). expo.dev/privacy
We do not sell your personal data to third parties, and we do not run third-party advertising networks.
6. Data Retention
Account data is retained while your account is active. Order records are retained for at least 10 years to comply with Lebanese tax law. You can request deletion via the in-app account-deletion flow at any time; data not subject to a legal retention obligation is removed permanently from our systems.
7. Account Deletion
You can delete your account at any time from the Profile screen in the Revotion app. When you delete your account:
- Your profile information is permanently deleted.
- Your order history is removed.
- Your chat messages are deleted.
- Your consultation records are removed.
- Your favorites and cart items are cleared.
- Your push notification tokens are deleted.
- Your authentication account is permanently deleted.
This action is irreversible.
8. Your Rights
You have the right to:
- Access your personal data by viewing your profile and order history in the app.
- Correct your personal data by updating your profile information.
- Delete your personal data by using the account deletion feature in the app.
- Data portability — contact us to request a copy of your data in a portable format.
9. Your Rights Under GDPR (EEA, UK, Switzerland)
If you are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (Regulation (EU) 2016/679) and the equivalent UK GDPR apply to our processing of your personal data. Revotion is the data controller for the personal data described in this policy. You may exercise the following rights free of charge:
- Right of access (Art. 15) — request a copy of the personal data we hold about you, including the purposes of processing and the categories of recipients.
- Right to rectification (Art. 16) — have inaccurate or incomplete personal data corrected without undue delay.
- Right to erasure (Art. 17, "right to be forgotten") — have your personal data deleted where one of the legal grounds in Art. 17(1) applies.
- Right to restriction of processing (Art. 18) — restrict processing while a dispute about accuracy or lawfulness is resolved.
- Right to data portability (Art. 20) — receive the data you have provided to us in a structured, commonly-used, machine-readable format and transmit it to another controller.
- Right to object (Art. 21) — object to processing based on legitimate interests, including profiling, and object at any time to processing for direct marketing purposes.
- Right not to be subject to automated decision-making (Art. 22) — we do not make decisions that produce legal effects concerning you based solely on automated processing.
- Right to withdraw consent (Art. 7(3)) — where processing is based on consent (e.g. marketing emails, analytics cookies), you may withdraw consent at any time without affecting the lawfulness of processing performed before withdrawal.
- Right to lodge a complaint (Art. 77) — file a complaint with your local supervisory authority. A list of EEA authorities is available at edpb.europa.eu; UK residents may contact the ICO at ico.org.uk.
Lawful bases for processing (Art. 6). We process personal data on the following bases: (a) contractual necessity — account creation, order fulfilment, consultation booking; (b) legitimate interests — fraud prevention, platform security, basic product analytics aggregated at the platform level; (c) consent — analytics cookies, marketing emails, and any other processing where we ask you to opt in; (d) legal obligation — tax record retention, lawful response to authorities.
International transfers. Some of our processors (listed in Section 5) are located outside the EEA / UK. Where required, transfers rely on Standard Contractual Clauses adopted by the European Commission (Decision 2021/914/EU) and/or the UK International Data Transfer Addendum. Copies of the relevant safeguards are available on request to privacy@revotion.me.
Response time. We respond to verified rights requests within one (1) calendar month, in line with Art. 12(3) GDPR. We may extend this period by up to two further months for complex requests, in which case we will notify you within the first month.
10. Your Rights Under the CCPA / CPRA (California Residents)
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) gives you the rights described below. The categories of personal information we collect and our purposes are listed in Sections 2 and 3 of this policy. We do not sell your personal information for monetary consideration, and we do not knowingly share personal information for cross-context behavioural advertising.
- Right to know the categories and specific pieces of personal information we have collected, the sources, the business purpose, and the categories of third parties to whom we disclosed it.
- Right to delete personal information we have collected, subject to the exceptions in Cal. Civ. Code § 1798.105(d).
- Right to correct inaccurate personal information.
- Right to opt out of sale or sharing — we do not sell or share your personal information; you do not need to exercise this right with us.
- Right to limit use of sensitive personal information — we do not use sensitive PI for purposes that exceed those permitted by § 1798.121(a).
- Right to non-discrimination — we will not deny services, charge different prices, or provide a different quality of service because you exercised any of your CCPA rights.
To exercise these rights, email privacy@revotion.me with the subject line "CCPA Request". We will verify your identity using the email associated with your account before processing the request, and respond within forty-five (45) days as required by § 1798.130(a)(2).
11. Your Rights Under Lebanese Law 81/2018 (Electronic Transactions and Personal Data)
Lebanese Law No. 81 of 2018 on Electronic Transactions and Personal Data governs the protection of personal data of residents of Lebanon. Revotion processes your personal data in accordance with that law. You may exercise the rights below, which are equivalent in scope to the GDPR rights described in Section 9, by contacting privacy@revotion.me:
- Right of access to your personal data and the purposes for which it is processed.
- Right to rectification of inaccurate personal data.
- Right to erasure of personal data that is no longer necessary for the purposes for which it was collected.
- Right to object to processing for direct marketing purposes.
- Right to lodge a complaint with the competent Lebanese authority where you believe your rights have been infringed.
Lebanon does not currently operate a dedicated data-protection authority equivalent to a GDPR supervisory authority. Article 95 of Law 81/2018 designates the Ministry of Economy and Trade as the licensing authority for entities that process personal data; complaints about unlawful processing may also be brought before the competent civil court. Disputes concerning the Service are governed by Lebanese law and subject to the jurisdiction of the courts of Beirut, as set out in Section 11 of our Terms of Service.
12. Children's Privacy
The Service is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete that information.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. We encourage you to review this policy periodically.
14. Contact Us
If you have any questions about this Privacy Policy or your personal data, please contact us at:
- Email: privacy@revotion.me
- Contact: Elie Rached