Privacy Policy

1. Introduction

Revado ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our recruitment management platform ("the Service").

We process personal data in accordance with the Protection of Personal Information Act (POPIA) of South Africa and other applicable data protection laws. By using the Service, you consent to the data practices described in this policy.

2. Information We Collect

2.1 Information You Provide

We collect information you provide directly, including:

• Account Information: Name, email address, password, company name, and contact details
• Client Data: Information about your client companies, including company names, contact persons, and business details
• Candidate Data: Names, contact information, employment history, education, skills, resumes, and other professional information
• Communication Data: Feedback, comments, and notes related to candidates and hiring processes
• Payment Information: Billing address and payment method details (processed securely by our payment provider)

2.2 Information Collected Automatically

When you use the Service, we automatically collect:

• Usage Data: Pages visited, features used, actions taken, and time spent on the Service
• Device Information: Browser type, operating system, device identifiers, and IP address
• Log Data: Access times, error logs, and referring URLs
• Cookies and Tracking: Information collected through cookies and similar technologies

2.3 Information from Third Parties

We may receive information from:

• LinkedIn (Chrome extension): The Revado for LinkedIn extension only acts on profile and company pages you are viewing, and only when you take an action. When you write a note, we store the profile URL, name and headline with it. When you add a profile to a position, we capture the profile's name, headline, location, photo URL, summary, experience, education and skills from that page into your workspace. Nothing is captured from pages you merely visit, and the extension does not access LinkedIn messages, connections or your LinkedIn account.
• Authentication Providers: If you sign in using Google, Microsoft, or other providers, we receive basic profile information
• Connected Mailboxes (Gmail / Outlook): If you choose to connect your Google or Microsoft mailbox, we receive the email data described in Section 6
• Your Clients: Client users may provide feedback and information about candidates

3. How We Use Your Information

We use the collected information to:

• Provide, maintain, and improve the Service
• Process transactions and manage your subscription
• Enable collaboration between recruiters and their clients
• Show your team the email conversations with candidates and client contacts held in mailboxes you choose to connect (see Section 6)
• Send service-related communications and notifications
• Respond to your inquiries and provide customer support
• Analyze usage patterns to improve user experience
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations and enforce our terms

4. Data Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

4.1 With Your Consent

We share information when you direct us to, such as when you grant client users access to view candidates.

4.2 Service Providers

We share information with third-party vendors who perform services on our behalf, including:

• Cloud hosting and infrastructure providers (Railway)
• Google (Gmail API and Cloud Pub/Sub) and Microsoft (Graph API), only when you connect a mailbox (see Section 6)
• Payment processors
• Email service providers
• Analytics providers
• Customer support tools

These providers are contractually obligated to protect your information and use it only for the services they provide to us.

4.3 Legal Requirements

We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Revado, our users, or others.

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

5. Candidate Data Processing

As a recruitment platform, we process candidate personal data on behalf of our users (recruitment agencies). In this context:

• Data Controller: The recruitment agency using Revado is the data controller for candidate data
• Data Processor: Revado acts as a data processor, processing candidate data on behalf of the recruitment agency
• Recruiter Responsibilities: Recruiters are responsible for obtaining appropriate consent from candidates and complying with applicable employment and data protection laws
• Data Retention: Candidate data is retained according to the recruiter's settings and applicable legal requirements

6. Connected Mailboxes (Gmail and Outlook)

Recruiters and other internal users of an organization may choose to connect their own Google (Gmail) or Microsoft (Outlook / Microsoft 365) mailbox to Revado. This is optional, requires your explicit consent on the Google or Microsoft permission screen, and can be switched off at any time. Client users and external recruiters cannot connect a mailbox.

6.1 What We Access

When you connect a mailbox we request the following permissions:

• Google: your email address, read-only access to your Gmail messages (gmail.readonly) and permission to send email as you (gmail.send)
• Microsoft: your email address and basic profile (User.Read), read access to your mail (Mail.Read), permission to send mail as you (Mail.Send) and offline access so the connection keeps working when you are not signed in

To find relevant conversations, Revado reads only the sender and recipient addresses of messages in your mailbox (Gmail: your mailbox excluding chats and drafts; Outlook: your Inbox and Sent Items) going back 90 days, and afterwards as new mail arrives. It does not read the subject or body of a message at this stage.

6.2 What We Store

Revado keeps a conversation only when one of its participants (other than you and your colleagues) matches a candidate profile or client contact that already exists in your organization's workspace, or when it is a reply in a conversation we already keep. For those messages only, we store:

• Sender and recipient names and addresses, subject, date and threading headers
• The message body (HTML and plain text) and a short preview
• Attachment names, types and sizes. Attachment files themselves are not stored; they are fetched from your mailbox only when someone opens them, and are no longer available once the mailbox is disconnected
• A link between the conversation and the matching candidate or client record

Every other message is discarded immediately and is never stored. When a candidate or client contact is added to your workspace, Revado searches the previous 90 days of your mailbox for conversations with that address in the same way. Your Google or Microsoft access tokens are stored encrypted (AES-256-GCM) and are never shown in the app.

6.3 How We Use It

• To show the stored conversations on the candidate and client records in your organization's workspace, so your team has one history of contact
• To update a client's "last contacted" date when a synced email involves one of that client's contacts
• To let you send emails and replies from Revado through your own mailbox, optionally attaching a candidate's CV already held in your workspace. Emails you send appear in your provider's Sent folder as normal
• To receive change notifications from Google Cloud Pub/Sub and Microsoft Graph so that new mail is picked up promptly. These notifications tell us only that your mailbox changed; they do not contain message content

Conversations synced from your mailbox are visible to the internal users of your organization by default. You can mark any conversation as private, in which case only you can see it. Synced emails are not made available through the client portal.

We do not use mailbox data for advertising, do not sell it, and do not use it to train generalized artificial intelligence or machine learning models. Mailbox data is not sent to any AI provider. Our staff do not read your email data except with your consent, where necessary for security or abuse investigation, to comply with law, or in aggregated or anonymized form for internal operations.

Revado's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We apply the same restrictions to data received from Microsoft. Mailbox data is used only to provide and improve the user-facing features described in this section and is not transferred to others except as needed to provide those features, for security purposes, to comply with applicable law, or as part of a merger, acquisition or sale of assets, in which case we will notify you.

6.4 Email Data About Other People

Synced conversations contain the personal data of the candidates and client contacts you correspond with. As with other candidate and client data (Section 5), your organization is the data controller for this information and Revado processes it on your organization's behalf. Only connect a mailbox if you are authorized to share that correspondence with your organization, and use the private setting where a conversation should not be shared.

6.5 Disconnecting and Deleting

You can stop the sync at any time:

• In Revado, go to Settings → Email and choose Disconnect. You can choose to delete the conversations already synced from that mailbox or to keep them in your workspace. Deleting removes the stored threads, messages and their links to candidate and client records
• You can also revoke Revado's access from your Google Account permissions or your Microsoft account (personal accounts / work or school accounts). Revado will stop syncing and ask you to reconnect or disconnect
• Connecting a different mailbox replaces the previous connection and deletes everything synced from it
• Deleting your user account, or your organization, deletes the connection and all conversations synced from it
• To have synced email data deleted at any other time, contact privacy@revado.io

Stored access tokens are deleted as soon as you disconnect. Conversations you choose to keep remain in your organization's workspace until deleted as described above.

7. Data Security

We implement appropriate technical and organizational measures to protect your information, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Secure authentication mechanisms
• Regular security assessments and monitoring
• Access controls and role-based permissions
• Secure data centers with physical security measures
• Employee training on data protection

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

8. Data Retention

We retain your information for as long as necessary to provide the Service and fulfill the purposes described in this policy. Specifically:

• Account Data: Retained while your account is active and for a reasonable period thereafter
• Candidate Data: Retained according to your settings and applicable legal requirements
• Synced Email: Retained while the mailbox is connected and, if you choose to keep it on disconnecting, until deleted as described in Section 6.5. Access tokens are deleted on disconnect
• Usage Data: Retained for analytics purposes, typically for 24 months
• Legal Compliance: Some data may be retained longer to comply with legal obligations

Upon account termination, you have 30 days to export your data. After this period, your data will be permanently deleted, except where retention is required by law.

9. Your Rights

Under POPIA and other applicable laws, you have the following rights:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information, subject to legal requirements
• Objection: Object to processing of your information in certain circumstances
• Data Portability: Request your data in a structured, commonly used format
• Withdraw Consent: Withdraw consent where processing is based on consent, including by disconnecting a connected mailbox at any time (Section 6.5)

To exercise these rights, please contact us at privacy@revado.io. We will respond to your request within 30 days.

10. Cookies and Tracking

We use cookies and similar tracking technologies to:

• Essential Cookies: Required for the Service to function properly (authentication, security)
• Analytics Cookies: Help us understand how users interact with the Service
• Preference Cookies: Remember your settings and preferences

You can control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Service.

11. International Data Transfers

Your information may be transferred to and processed in countries other than South Africa. When we transfer data internationally, we ensure appropriate safeguards are in place, including standard contractual clauses and compliance with applicable data protection laws.

12. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete such information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

14. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Regulator of South Africa.