Privacy Policy

Revu is published by Naja Studio, France.
Contact: hello@getrevu.co

We only collect the data necessary for the service to function:

• Editor account — email address, studio name, password (hashed by Supabase).
• Projects — title, status, delivered video, client brief, timestamped comments, attached files.
• Clients — name and email address of the end client (provided by the editor).
• Messages — text exchanges within the project portal.
• Payment — processed by Stripe. Revu never stores your card details.
• Audit logs — key actions (login, approval, plan change) along with IP address and User-Agent.
• Waitlist — email address voluntarily provided.

• Performance of the contract — processing of data necessary to provide the service (projects, comments, notifications).
• Legitimate interest — security logs, fraud detection, billing integrity.
• Consent — waitlist (you may unsubscribe at any time).

All transfers outside the EU (Stripe) are governed by the European Commission's Standard Contractual Clauses (SCC).

• Account data — retained until the account is deleted.
• Projects and files — retained until the account is deleted or manually archived. Files your clients uploaded are deleted 60 days after a project is completed, after a warning email to you; the final video and the project record are kept.
• Audit logs — rolling 12 months (older entries are deleted automatically every day).
• Billing data (Stripe) — 10 years (French legal requirement).
• Waitlist — until you unsubscribe.

Revu sets cookies that are strictly necessary for the service to function. On the public marketing pages only, and only if you accept, we also use Google Analytics and the Meta Pixel to measure traffic and advertising. They are never loaded in the app, client portals or review links.

Cookies: apart from the strictly necessary cookies above, the third-party services that may set cookies are the Calendly booking calendar and, with your consent, Google Analytics (_ga, up to 13 months) and the Meta Pixel (_fbp, 3 months). You can change your choice at any time with “Cookie settings” on the home page footer. It is not loaded until you explicitly ask for it, and you can decline by simply not clicking. The strictly necessary cookies do not require prior consent under the ePrivacy Directive; analytics and advertising cookies do, and stay off until you accept.

You have the following rights over your personal data:

• Access — obtain a copy of your data.
• Rectification — correct inaccurate data.
• Erasure — delete your account and all associated data (see below).
• Portability — receive your data in a machine-readable format.
• Objection — object to certain processing based on legitimate interest.
• Complaint — file a complaint with the CNIL.

To exercise your rights or ask a question: hello@getrevu.co. We respond within 30 days.

You can delete your account at any time from Dashboard → Settings → Danger zone → Delete workspace.

Deletion permanently and immediately erases: your organization, all your projects, clients, comments, files, and your authentication account. Stripe billing data is retained for 10 years in accordance with French law.

Data is encrypted in transit (TLS) and at rest. Authentication uses JWTs signed by Supabase. Sessions are protected by httpOnly, secure, and sameSite=lax cookies, signed with HMAC-SHA256.

In the event of a material change, we will notify editors by email at least 30 days before the changes take effect.