This Privacy Policy explains how TREVEN MEDIA, radijska dejavnost, d.o.o. ("Treven Media", "we", "us") processes personal data when you use RevAIved — our mobile app, the backend service behind it, and our websites revaived.com and revaived.ai (together, the Service). RevAIved is a service of Treven Media d.o.o. It lets you describe someone you have lost and chat with an AI persona inspired by them. You are always talking to an AI, never to the real person. RevAIved is not therapy, medical care or a crisis service. Please also read our Terms of Service.
We process personal data in line with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Slovenian Personal Data Protection Act (ZVOP-2).
1. Summary
- We store your account, the personas you create, your chats (including images you send) and short "memories" extracted from chats, because the Service can't work without them.
- To generate replies, we send the persona profile, recent messages, memories and attached images to OpenAI in the USA. Chats are encrypted in transit and at rest, but they are not end-to-end encrypted: our servers and OpenAI process them in readable form.
- We never sell your data and never use it to train AI models. Under OpenAI's API terms, API data is not used to train OpenAI's models by default.
- No one on our team routinely reads your conversations. Access happens only where needed for security, legal obligations, or support you ask for.
- You can delete your account and its content from inside the app at any time.
- RevAIved is for adults (18+) only.
2. Who is responsible for your data
The data controller is:
- TREVEN MEDIA, radijska dejavnost, d.o.o. (short name: Treven Media d.o.o.)
- Obrtna cona Logatec 22, 1370 Logatec, Slovenia
- Registration number (matična številka): 7579799000
- Tax number (davčna številka): 64090701 (not registered for VAT)
- Privacy requests: privacy@revaived.com
- General support: support@revaived.com · Legal notices: legal@revaived.com
We have not appointed a data protection officer, as we are not required to. Please send all privacy questions to privacy@revaived.com.
3. What we collect
- Account data. Your email address and login credentials (passwords are stored only in hashed form by our authentication provider). If you sign in with Google or Apple, we receive an account identifier and your email address; Apple may also share your name.
- Persona details. What you enter about the person a persona is based on: name, nickname, relationship to you, language, year of birth, age at death, origin, personality, speaking style, catchphrases, hobbies, and an optional avatar photo.
- Chat content. Messages you send, images you attach, and the AI's replies.
- Memories. Short facts that the system extracts automatically from your chats (for example "hated coriander") so the persona can remember them later. They are stored with the persona and deleted with it.
- Subscription status. If you subscribe, Apple or Google handles the payment. We receive purchase and renewal events through RevenueCat (product, status, dates and a transaction reference). We never see your card details.
- Security and audit logs. For each API request: IP address, user agent, request path, timestamps, and whether the safety check flagged the message. These logs never contain message text.
- Server logs. Technical logs from our servers and websites (IP address, time, requested URL, errors).
- Messages to us. Emails you send to our support, privacy or legal addresses, and our replies.
- Website analytics — only if you accept analytics cookies (see §14).
4. How the AI uses your data
Each time you send a message, our server sends OpenAI's API the following to generate the reply:
- the persona's profile;
- about the last 50 messages of that conversation;
- the memories stored for that persona; and
- any image you attached.
We also use OpenAI to extract new memories from your conversation, and we run the text of your messages through OpenAI's moderation service to detect signs of self-harm or other serious risk. If such signs are detected, the persona steps out of character and points you to findahelpline.com. This is an automated safety measure, not a clinical assessment, and no one is alerted.
Under OpenAI's API terms, data sent through the API is not used to train OpenAI's models by default. OpenAI may keep API data for up to 30 days to monitor for abuse and then deletes it, unless the law requires it to keep the data longer.
5. Purposes & legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating and running your account, storing personas, chats and memories, generating AI replies | Account data, persona details, chat content, memories | Contract (Art. 6(1)(b)); for sensitive information in chats, your explicit consent (Art. 9(2)(a)) — see §6 |
| Safety moderation and crisis signposting | Text of your messages, safety flag | Legitimate interest in protecting users and the Service (Art. 6(1)(f)); explicit consent for sensitive information (Art. 9(2)(a)) |
| Managing subscriptions and access to paid features | Subscription status, transaction reference | Contract (Art. 6(1)(b)) |
| Security, abuse prevention, troubleshooting | Audit logs, server logs | Legitimate interest in keeping the Service secure (Art. 6(1)(f)) |
| Answering your emails and requests | Your messages, contact details | Contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)); legal obligation for data-subject requests (Art. 6(1)(c)) |
| Accounting and tax records | Billing records | Legal obligation (Art. 6(1)(c)) |
| Website analytics on revaived.com | Cookie IDs, usage events, device and browser data | Consent (Art. 6(1)(a) GDPR and Art. 225 of the Slovenian Electronic Communications Act, ZEKOM-2) |
| Establishing, exercising or defending legal claims | Data relevant to the claim | Legitimate interest (Art. 6(1)(f)); Art. 9(2)(f) for sensitive data |
Where we rely on legitimate interest, you can object at any time (§11). Where we rely on consent, you can withdraw it at any time; this does not affect processing that already took place.
6. Sensitive information
Conversations about grief can reveal information about your health, including your mental health, and sometimes your beliefs or family life. Because of this, we treat chat content as potentially special-category data under Art. 9 GDPR and process it only with your explicit consent, which we ask for in the app before you start chatting. You can withdraw that consent at any time by deleting your chats, personas or account. Without it, we cannot provide the chat feature. Please share only what you are comfortable sharing.
7. Data about deceased persons & other people
The GDPR does not apply to the data of deceased persons (Recital 27), but Slovenian law does. Under Article 9 of ZVOP-2, personal data of deceased persons may only be processed in accordance with the law. Close family members — a spouse, partner, child, parent or heir — have a recognised position regarding that data, unless the deceased person prohibited it. This protection lasts for 20 years after death.
By creating a persona you confirm that you are such a close relative, or otherwise have a legitimate right to use the information you provide, and that, to your knowledge, the person did not object. You use this information for your own private remembrance, and we process it only on your behalf to provide the Service.
Your chats and photos may also mention living people, such as family members. Please share only what you have a right to share, and don't upload other people's private information or photos without a good reason. Relatives or estate representatives who believe a persona was created without the right to do so can contact legal@revaived.com. We will review the request and act on it if it is well founded.
8. Who we share data with
We use the following providers. Where they process data on our behalf (as processors), they do so under data processing terms and only on our instructions. Apple, Google and Telegram also act as independent controllers for their own services.
| Provider | What for | Data | Location |
|---|---|---|---|
| DigitalOcean, LLC | Server hosting for our websites and API | All data passing through our servers; server logs | Frankfurt, Germany (US-based company) |
| Supabase, Inc. | Database, sign-in and file storage | Account data, personas, chats, memories, images, audit logs | EU (Frankfurt) (US-based company) |
| OpenAI, L.L.C. / OpenAI Ireland Ltd | Generating replies, extracting memories, safety moderation | Persona profile, recent messages, memories, attached images | USA |
| RevenueCat, Inc. | Managing subscription status | App user ID, purchase and renewal events | USA |
| Apple Inc. / Apple Distribution International | Sign in with Apple, App Store payments | Sign-in identifier, purchase data | Under Apple's own privacy policy |
| Google LLC / Google Ireland Ltd | Sign in with Google, Google Play payments, Google Analytics on our websites (only with consent) | Sign-in identifier, purchase data, website analytics | Under Google's own privacy policy; may include the USA |
On our campaign site revaived.ai we also use Microsoft Clarity, Meta (Pixel and Conversions API), Upstash and Telegram, but only for that website and, apart from Telegram, only with consent. The revaived.ai privacy notice explains this. We may also disclose data to authorities where the law requires it, or to professional advisers who are bound by confidentiality. We never sell personal data.
9. Transfers outside the EU
Our servers and database are in the EU. Some providers are based in the United States or may access data from there, most importantly OpenAI, which generates the AI replies in the USA. For these transfers we rely on the EU–US Data Privacy Framework (Commission adequacy decision of 10 July 2023) where the provider is certified, and/or the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) included in the provider's data processing terms (for OpenAI: OpenAI's Data Processing Addendum). You can ask for more information at privacy@revaived.com.
10. How long we keep data
| Data | How long |
|---|---|
| Account, personas, chats, images, memories | Until you delete them or your account |
| Security and audit logs | Up to 12 months, then deleted |
| Server logs | 30 days |
| Provider backups | Deleted data disappears from our providers' backups as they roll over, within up to 30 days |
| Data at OpenAI | Up to 30 days for abuse monitoring, under OpenAI's API terms |
| Billing and tax records | As long as Slovenian law requires (up to 10 years under the Tax Procedure Act, ZDavP-2, and the Companies Act, ZGD-1) |
| Emails with us | As long as needed to handle your request, then up to the end of the legal limitation period |
| Website analytics (with consent) | See §14 |
Deleting your account. When you use "Delete account" in the app, we delete your account, personas, chats, memories and images from our live systems. This cannot be undone. Copies in provider backups expire as described above, and records we must keep by law are kept separately.
11. Your rights
Under the GDPR you have the right to:
- access your personal data and receive a copy (Art. 15);
- rectify inaccurate data (Art. 16) — you can edit personas in the app;
- erasure (Art. 17) — you can delete personas and your account in the app;
- restrict processing (Art. 18);
- data portability — receive the data you gave us in a structured, machine-readable format (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw consent at any time, without affecting earlier processing;
- lodge a complaint with a supervisory authority (§18).
There is currently no in-app export. To request a copy or export of your data, or to exercise any other right, email privacy@revaived.com from the email address on your account. We may ask you to confirm your identity. We reply within one month. For complex requests this can be extended by two more months, in which case we will tell you why.
12. Security
- Data is encrypted in transit (TLS) and encrypted at rest by our hosting and database providers.
- Chats are not end-to-end encrypted. Our server and OpenAI must process the text to generate replies.
- Database access rules keep each user's data separate. Privileged keys stay on our servers and are never shipped in the app.
- Our policy is that no one on our team reads conversations, except where necessary for security, to comply with the law, or to handle a support request you make. Access to production systems is limited to the few people who need it.
No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify the Information Commissioner within 72 hours (Art. 33 GDPR). If the risk to you is high, we will also tell you without undue delay (Art. 34 GDPR).
13. Age limit
RevAIved is only for people aged 18 or over. We do not knowingly collect data from anyone younger. If you believe a minor is using the Service, contact privacy@revaived.com and we will delete the account.
14. Cookies & analytics on revaived.com
revaived.com uses Google Analytics 4 (Google Ireland Limited / Google LLC), but only if you click Accept analytics in the cookie banner. Until you do, the Google Analytics script is not loaded at all and no analytics cookies are set. If you accept, Google Analytics runs with IP-address truncation and Google Consent Mode, with advertising features switched off. Google may process the data in the USA (see §9). Google Analytics data is pseudonymous, not anonymous.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| revaived_cookie_consent_v1 | Local storage (first party, strictly necessary) | Remembers your cookie choice | Until you clear your browser storage or change your choice |
| _ga | Cookie (Google Analytics, only after consent) | Distinguishes visitors | Up to 2 years |
| _ga_<ID> | Cookie (Google Analytics, only after consent) | Keeps session state | Up to 2 years |
Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 225 ZEKOM-2). You can change or withdraw your choice at any time with the Cookie settings link in the footer. The site works the same whether or not you accept. The mobile app contains no advertising or analytics trackers.
15. Automated processing & AI transparency
In line with Article 50 of the EU AI Act, we make clear that you are interacting with an AI system, not with the deceased person or any other human. Replies are generated automatically and may be inaccurate or unlike what the real person would have said. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing (Art. 22 GDPR).
The Service currently does not use voice. If we ever add voice features (for example, using recordings of a person's voice), we will explain how they work and ask for your separate consent before we process any recordings.
16. What we don't do
- We don't sell your personal data or use it for advertising.
- We don't use your chats, personas or memories to train AI models, and we don't allow our providers to do so.
- We don't put advertising or analytics trackers in the mobile app.
17. Changes to this Policy
We will update this Policy when our processing changes. The date at the top shows the latest version. If we make significant changes, we will tell you in the app or by email before they take effect. If a change requires your consent, we will ask for it.
18. Contact & complaints
Contact us first at privacy@revaived.com and we will try to resolve your concern. You also have the right to lodge a complaint with the Slovenian supervisory authority:
- Informacijski pooblaščenec Republike Slovenije (Information Commissioner), Dunajska cesta 22, 1000 Ljubljana, Slovenia — ip-rs.si
You can also complain to the supervisory authority in the EU country where you live or work, or where you believe the infringement took place.