Legal
Data Processing Addendum
Last updated September 2026
A plain-language summary of the processing relationship. The signed DPA is the operative document and takes precedence over everything on this page.
Roles
The customer is the controller for the visitor data collected on its sites and for the commercial data it connects. Reveliqo is the processor, acting on documented instructions.
What we process
Edge request records for sites the customer connects; browser events where Smart Beacon is deployed; server-side business events the customer sends; commercial and financial outcome data from connected systems; derived aggregates; search and analysis indexes; and AI analysis traces.
Sub-processors
Infrastructure, storage, streaming and AI providers, listed on the subprocessors page, with advance notice of additions and a mechanism to object.
AI providers as sub-processors
AI providers process aggregates and context to plan and explain analyses. They are named sub-processors, their retention and training terms are stated, and enterprise customers can restrict which may be used.
Security measures
Encryption in transit and at rest, tenant and site scoping across events, aggregates, indexes and AI context, least-privilege access, encrypted credential storage and audit logging.
International transfers
Where personal data leaves its region, standard contractual clauses and supplementary measures apply. Data residency options are available on enterprise plans.
Incident notification
Notification without undue delay and within the window stated in the signed DPA, with the information a controller needs to meet its own obligations.
Deletion and return
Export throughout the term, and deletion of events, aggregates, indexes and analysis traces within the stated window after termination.
This is placeholder legal copy for the marketing site. Replace it with your reviewed Terms & Privacy before launch.