Privacy Policy

1. Who we are

Lorászkó Dániel e.v. is the data controller for the personal data described in this policy. The product is offered under the brand name Revan.

The controller operates from the European Union, in Hungary.

Operator

Lorászkó Dániel e.v.

Legal form

Registered sole proprietor (egyéni vállalkozó)

Registered seat

2118 Dány, Valkói utca 22., Hungary

Tax ID

92302761-1-33

Registration number

62705123

Registering authority

Nemzeti Adó- és Vámhivatal (NAV)

Privacy contact

contact@revan.app

2. What data we collect

We collect the following categories of personal data:

• Waitlist data. The email address you submit on the waitlist form, and the time of submission.
• Account data. Your name, email address, password hash, and the authentication method you use. If you sign in with Google, we receive your basic Google profile (name, email, profile picture, and Google account ID).
• Portfolio data. The holdings, transactions, watchlists, notes, and tags you add to the product. We treat this as confidential.
• Subscription and billing data. If you buy a paid subscription, we receive: the plan you bought, the price, the billing period, the start and renewal dates, your billing country, your tax status (consumer or business), and a transaction reference from our payment processor. The payment processor handles your card or bank details directly; we do not store full card numbers on our servers.
• Device and log data. IP address, user agent, request timestamps, referrer, and error traces. We need these to run the service and to detect abuse.
• Communications. Messages you send to support, and the email or in-app responses we send back.
• Optional analytics data. Page or route identifiers, filtered query parameters, coarse location, device type, and Core Web Vitals. We only collect this when you turn analytics on in Settings, Account.

3. Why we use it and the legal basis

We process personal data for the following purposes, on the following legal bases under GDPR:

• To run the waitlist. We use your email to confirm your place on the list and to tell you when access opens. Legal basis: consent (Art. 6(1)(a)). You can withdraw consent at any time by writing to contact@revan.app; we will then erase your waitlist entry.
• To provide the free product. We use account data and portfolio data to run features you ask for. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
• To provide and bill paid subscriptions. We use account data and subscription and billing data to take payment, manage renewals and cancellations, and give you access to paid features. Legal basis: performance of a contract (Art. 6(1)(b)).
• To keep the product safe. We use log data to block fraud, abuse, and brute-force attempts. Legal basis: legitimate interests (Art. 6(1)(f)) in protecting our users and our service.
• To meet legal duties. We keep certain records (in particular, invoices and tax records for paid subscriptions) to comply with tax, accounting, and consumer-protection law. Legal basis: legal obligation (Art. 6(1)(c)).
• To send service messages. We email you about security events, billing, subscription changes, and material changes to this policy. Legal basis: contract and legitimate interests.
• To measure usage and performance. We load first-party telemetry and performance measurement scripts only after you opt in. Legal basis: consent (Art. 6(1)(a)). You can withdraw consent at any time in Settings, Account.

Provision of personal data: Providing your account data (such as email address and credentials) is a contractual requirement under Article 6(1)(b) to create and maintain an account on Revan. Providing subscription and billing details is a contractual and statutory requirement under Article 6(1)(c) to purchase paid features and receive tax-compliant receipts. If you do not provide this information, we cannot create your account or activate paid features.

We do not use personal data for advertising. We do not build advertising profiles.

4. Who we share it with

We share personal data only with service providers that help us run the product, and only as needed for them to do that work. Each provider is bound by a written data-processing agreement.

• Cloud hosting and infrastructure. Cloud hosting, serverless compute, database, and caching providers that host and run the service and securely store your account and portfolio data.
• Sign-in and identity. Federated identity and authentication providers when you choose external single sign-on (such as OAuth).
• Email delivery. Transactional email service providers for delivery of waitlist confirmation, password resets, verification codes, security alerts, and service notices.
• Payments and billing. Authorized payment service providers for processing subscription payments, recurring billing, and invoices. The payment processor is the independent controller for your card or bank details and the joint controller with us for the transaction record.
• Analytics and performance (opt-in only). First-party privacy-oriented web analytics and real-user performance monitoring providers, loaded only when you explicitly enable telemetry.
• AI and technical analysis. Machine-learning and automated data retrieval services used to process market instrument summaries and corporate action analysis (processing technical queries without exposing personal portfolio records).

We may also share data when we are legally required to do so, for example in response to a valid court order, or to protect the rights, property, or safety of users or the public.

5. International transfers

We store and process personal data inside the European Economic Area whenever we can.

Some of our service providers operate outside the EEA, mainly in the United States. When we transfer personal data outside the EEA we rely on a transfer mechanism approved under Chapter V of GDPR. Where the European Commission has issued an adequacy decision for the destination country (including the EU-US Data Privacy Framework for certified recipients in the United States), we rely on that adequacy decision. In other cases, we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914).

We carry out a transfer impact assessment for each provider and apply additional safeguards such as encryption in transit and at rest, pseudonymisation where practical, and contractual access controls.

You can ask us for a copy of the safeguards we use by writing to contact@revan.app.

6. How long we keep it

We keep personal data only as long as we need it for the purposes set out above:

• Waitlist data. Until you ask us to remove it, or until we have sent the access-open notice and a short follow-up, whichever comes first. If we discontinue the waitlist, we erase the list.
• Account and portfolio data. While your account is active. After you delete your account, we erase personal data within 30 days.
• Subscription and billing records. Invoices and tax records are kept for the period required by EU and member-state tax and accounting law (typically 7 to 10 years), even after you delete your account.
• Backups. Encrypted backups roll off on a fixed schedule. Deleted data is purged from backups within 90 days.
• Log data. Up to 12 months, then deleted or aggregated.

7. How we keep it safe

We encrypt personal data in transit (TLS) and at rest. Passwords are hashed with a slow, salted algorithm. Access to production systems is limited to the operator and is logged.

We test our systems and update our dependencies on a regular cadence. We will tell you and the relevant supervisory authority about a personal-data breach when the law requires it.

No system is perfectly secure. Use a strong, unique password and turn on multi-factor authentication if it is available to you.

8. Your rights

Under GDPR and similar laws you can ask us to:

• Access the personal data we hold about you.
• Correct data that is wrong or out of date.
• Delete your data (the right to erasure). Records we must keep by law, such as invoices for paid subscriptions, are excluded from erasure for the period the law requires.
• Restrict or object to certain processing.
• Port your data to another service in a structured, machine-readable format.
• Withdraw consent at any time, where processing is based on consent. Withdrawing consent does not affect processing done before you withdrew it.

You can download a JSON export of your data in Settings, Account, Data export. For other requests, email contact@revan.app. We respond within one month, as required by Art. 12(3) GDPR. We may extend this by two further months for complex requests and will tell you if we do.

If you think we have not handled your data correctly, you can lodge a complaint with a supervisory authority under Art. 77 GDPR. Our lead supervisory authority is the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság - NAIH, seat: 1055 Budapest, Falk Miksa utca 9-11., mailing address: 1363 Budapest, Pf. 9., email: ugyfelszolgalat@naih.hu, website: https://naih.hu). You can also complain to the authority in the EU member state where you live, work, or where the alleged breach took place.

9. Cookies and similar technologies

We use strictly necessary cookies to keep you signed in, store your language preference (`revan_locale`), and protect accounts. These cannot be turned off without breaking the product.

Inside the logged-in app, we load privacy-focused web analytics and performance measurement scripts only after you opt in under Settings, Account. The marketing site and the documentation do not load these scripts.

Your choice is stored locally in your browser under the key `revan_telemetry_consent`. Turn the control off to withdraw consent. Read the full Cookie Policy for the details.

10. Automated decisions and profiling

We do not make decisions about you that have legal or similarly significant effects through automated means alone. The platform shows you data and analytics you can act on; you remain the decision-maker.

11. Children

The product is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has given us data, contact us and we will delete it.

12. Changes to this policy

We will update this policy when our practices change or the law requires it. If the change is material, we will email you or show a notice in the product before it takes effect. The date at the top of this page shows when it was last updated.

13. Contact

Privacy and general contact: contact@revan.app.