Privacy Policy
Last Updated: November 28, 2025
Nitwit AB (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.
1. Information We Collect
Personal Information You Provide
When you create an account with Revontale, we collect:
- Email address - For authentication and account security
- Name - Your display name (if you provide it)
Content You Create
- Chat conversations - Your sessions with Friday, our AI coach
- Memory profile - What Friday learns about you across sessions
- Account preferences - Your settings and configurations
Technical Information
- IP address - For security and fraud prevention
- Browser type and version - For support and compatibility
- Device information - Operating system and device type
- Session cookies - For authentication (via Logto, hosted in Europe)
- Analytics cookies - For service improvement (via PostHog, hosted in Europe and configured for privacy-safe mode)
2. How We Use Your Information
We use your information solely to provide and improve Revontale:
Service Delivery
- Authenticate your account via Logto
- Provide AI-powered coaching conversations
- Save your conversation history and memory profile
- Display personalized content
Service Improvement
- Understand how you use Revontale (privacy-safe analytics)
- Fix bugs and improve performance
- Develop new features based on usage patterns
Communication
- Send important service updates (rare, essential only)
- Respond to your support requests
We will NEVER:
- Sell your personal information
- Share your chat history with third parties
- Use your data for advertising
- Train AI models on your private content
- Use third party services that train AI models with user data
3. How We Share Your Information
We work with carefully selected service providers who help us deliver Revontale:
Sub-Processors
Your Data is Protected
We only share data with GDPR-compliant processors who are contractually obligated to protect your privacy.
Anthropic (AI Processing)
- Purpose: Powers our AI coaching conversations using Claude
- Location: United States
- Data security: All data is encrypted
- Data shared: Your chat messages (context for AI responses only)
- Privacy guarantee: Anthropic does NOT train models on customer data
- Learn more: Anthropic Privacy Policy
MongoDB Atlas (Data Storage)
- Purpose: Securely stores your account data and chat history
- Location: Stockholm, Sweden
- Data shared: All your Revontale data
- Security: Encryption at rest, restrictive role-based access control
- Learn more: MongoDB Privacy
Logto (Authentication)
- Purpose: Handles secure e-mail based authentication
- Location: EU region
- Data shared: Email address
- Learn more: Logto Privacy
PostHog (Analytics)
- Purpose: Privacy-safe analytics to improve the service
- Location: EU region
- Data shared: Page visits, feature usage (no personal content)
- Privacy mode: Input masking enabled, sensitive data excluded
- Learn more: PostHog Privacy
4. Your Rights Under GDPR
As a user in the European Economic Area, you have the following rights:
Right to Access
Export all your data in machine-readable JSON format anytime.
Right to Access - Request a copy of all your personal data
Right to Rectification - Update or correct your information (edit in your profile)
Right to Erasure (“Right to be Forgotten”) - Delete your account and all associated data
Right to Data Portability - Receive your data in a structured, machine-readable format (JSON)
Right to Restriction of Processing - Request we limit how we use your data
Right to Object - Object to certain types of data processing
Right to Lodge a Complaint - File a complaint with your local data protection authority
To exercise any of these rights, visit your account settings or contact us at privacy@revontale.com
or go to the account page:
5. Data Retention
Active Accounts
- Your data is retained as long as your account is active
- You control your data and can delete it anytime
Deleted Accounts
- 30-day grace period: After deletion, we retain your data for 30 days in case you change your mind
- Email anonymization: Your email is immediately anonymized to prevent re-registration
- Permanent deletion: After 30 days, all data is permanently deleted from our systems
- Audit trail: Token usage and credit transaction records are preserved for financial compliance
Analytics Data
- PostHog analytics data is retained for 12 months
- Anonymized usage metrics for service improvement
6. Security Measures
We take security seriously and implement industry-standard protections:
Encryption
- In transit: TLS 1.3 encryption for all data transmission
- At rest: AES-256 encryption for database storage (MongoDB Atlas)
Access Control
- Role-based access control (RBAC) for all team members
- Multi-factor authentication for administrative access
- Regular security audits and penetration testing
Data Isolation
- Your data is strictly isolated from other users
- All database queries validate ownership before returning data
Monitoring
- 24/7 security monitoring for suspicious activity
- Automated alerts for potential security incidents
- Regular backups stored securely in EU region
7. International Data Transfers
EU Data Storage
- Your primary data is stored in Stockholm, Sweden (AWS eu-north-1)
- All storage, processing, and backups occur within the EU
US Data Processing (Anthropic)
- Your chat messages are sent to Anthropic (US) for AI processing
- Transfer mechanism: Standard Contractual Clauses (SCCs)
- Anthropic’s commitment: No training on customer data, enterprise-grade security
- Data is processed in real-time and not permanently stored by Anthropic
8. Cookies and Tracking
Essential Cookies (Required for Service)
- Logto authentication: Session cookies to keep you logged in
- Duration: Until you sign out or 30 days of inactivity
Analytics Cookies (Optional, Privacy-Safe)
- PostHog analytics: Privacy-safe usage tracking
- What we track: Page visits, feature usage, error reports
- What we DON’T track: Personal content, passwords, chat messages
- Privacy mode: Input masking enabled, console logs disabled
- Opt-out: You can disable analytics in your browser settings
No Third-Party Advertising
- We do not use advertising cookies
- We do not sell your data to advertisers
- We do not participate in ad networks
9. Children’s Privacy
Revontale is not intended for users under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at privacy@revontale.com and we will delete it immediately.
10. Changes to This Policy
We may update this Privacy Policy from time to time to reflect:
- Changes in our data practices
- New features or services
- Legal or regulatory requirements
Notification of Changes:
- We will notify you via email for significant changes
- The “Last Updated” date at the top will always reflect the most recent version
- Continued use of Revontale after changes constitutes acceptance
11. Contact Us
Data Controller: Nitwit AB
Privacy Questions: privacy@revontale.com
Data Protection Officer: Mark Dixon, mark@revontale.com
Postal Address: Årstavägen 9, 112 50, Sweden
12. Legal Basis for Processing
Under GDPR, we process your personal data under the following legal bases:
- Contract: To provide the Revontale service you signed up for
- Legitimate Interest: To improve our service and prevent fraud
- Consent: For analytics cookies and optional features (where applicable)
Your Privacy is Our Priority
We built Revontale with privacy at its core. Your stories are personal, and we treat them that way.
Key Commitments:
- EU-based data storage (Stockholm)
- No training on your data
- Export your data anytime
- Delete your account with one click
- GDPR compliant
- Privacy-safe analytics