Privacy Policy
Effective September 3, 2026. Raveful is operated by a sole proprietor registered in Israel. The registered name and postal address are provided on request to the email below, on every invoice, and to any supervisory authority. Contact: support@raveful.app
This policy explains what personal data Raveful collects, why, how long we keep it, and the rights you have. It is written to meet the EU and UK GDPR, the Israeli Protection of Privacy Law 5741-1981 (as amended by Amendment 13), the California Consumer Privacy Act, and similar laws. Plain language is used on purpose.
1. Who we are and our role
Raveful ("we") operates this service. Raveful is operated by a sole proprietor registered in Israel. The registered name and postal address are provided on request to the email below, on every invoice, and to any supervisory authority. Privacy questions: privacy@raveful.app.
- Account holders (our customers). We are the controller of your account and billing data.
- People who submit testimonials. The business that sent you the form is the controller. We are its processor and act on its instructions under our Data Processing Addendum. To edit or delete your testimonial, contact that business first; you can also contact us and we will pass the request on within 5 days.
- Visitors to public pages and widgets. We process minimal technical data as controller, described in section 2.
2. What we collect
| Data | Who | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Email, password hash, workspace name, settings | Account holders | Create and secure your account, provide the service | Contract (Art. 6(1)(b)) |
| Plan, invoices, payment status (card details are held by Polar, never by us) | Account holders | Billing, tax, accounting | Contract; legal obligation (Art. 6(1)(c)) |
| Name, job title, company, rating, written answers, optional video and audio, the consent you gave, submission time | Testimonial submitters | Collect, moderate, and publish the testimonial for the business you chose | Consent you give the business (Art. 6(1)(a)); we act as processor |
| Automatic captions (a transcript of your video's audio) | Testimonial submitters | Make video testimonials accessible and readable on mute | Same as above |
| IP address, browser type, pages viewed (aggregated, cookieless analytics by Vercel) | Everyone | Keep the service secure, measure usage | Legitimate interest (Art. 6(1)(f)): security and product improvement |
| Support emails you send us | Anyone | Answer you | Legitimate interest |
We do not collect special-category data on purpose, do not use facial recognition or biometric identification on videos, do not profile anyone, and do not sell or share personal data for advertising.
3. Cookies
We use only strictly necessary cookies (your login session and security tokens). Our analytics are cookieless. Because no optional cookies are set, no cookie banner is required. Details in the Cookie Policy.
4. Who we share data with
We share data only with service providers that process it for us under contract, listed below, and with authorities where the law requires it. Widgets you embed on your own site load from our servers; visitor requests to those widgets are covered by section 2.
| Provider | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, authentication, file storage | EU (Frankfurt, Germany) |
| Vercel Inc. | Hosting, CDN, privacy-friendly analytics (no cookies) | USA and EU edge |
| Polar Software Inc. | Merchant of record: checkout, subscriptions, invoices, taxes | USA |
| Groq Inc. | Speech-to-text for video captions | USA |
| Resend Inc. | Transactional email | USA |
5. International transfers
Your data is stored in the EU (Frankfurt). Some providers process data in the USA. Those transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (and the UK Addendum). Transfers from Israel rely on the Privacy Protection Regulations (Transfer of Data Abroad) 5761-2001. Copies of the safeguards are available on request.
6. How long we keep data
- Account and workspace data: while your account is active, then deleted within 30 days of deletion (backups within 90 days).
- Testimonials: until you or the business deletes them, or the account is deleted.
- Billing records: 7 years, as tax law requires.
- Security logs: 12 months.
- Support emails: 24 months.
7. Your rights
Depending on where you live you can ask us to: access your data; correct it; delete it; restrict or object to processing; receive a copy in a portable format; withdraw consent at any time (this does not affect processing already done); and not be discriminated against for exercising these rights. Email privacy@raveful.app. We answer within 30 days (45 days for California requests) and may ask you to verify your identity. You may also complain to your supervisory authority: in the EU your national data protection authority, in the UK the ICO, in Israel the Privacy Protection Authority, in California the CPPA.
Account holders can export testimonials as CSV and delete their workspace from Settings without contacting us.
8. Security
Data is encrypted in transit (TLS) and at rest. Access is limited by row-level security so one workspace can never read another's data. Passwords are hashed, never stored in plain text. Payment data is handled by our PCI-DSS compliant merchant of record. We will notify affected users and authorities of a personal data breach without undue delay, and within 72 hours where the GDPR requires it.
9. Children
Raveful is not for children under 16 and we do not knowingly collect their data. If you believe a child has submitted a testimonial, email us and we will delete it.
10. California (CCPA/CPRA) notice
In the past 12 months we collected the categories listed in section 2 (identifiers, commercial information, internet activity, audio and visual information you choose to submit). We do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes that require a right to limit. Californians have the rights in section 7 and may use an authorised agent.
11. Israel
You are not legally obliged to give us personal data; doing so is your choice and is needed to use the service. Data is stored in a database registered where required. You have the rights of inspection and correction under sections 13 to 15 of the Protection of Privacy Law.
12. Changes
We will post changes here and, for material changes, email account holders 14 days in advance.