Privacy policy
Updated 4 September 2026
Revydo processes as little data as possible, only to protect a practice's public reputation. This page explains what we read, why, where it lives, and your rights.
Who is responsible
The controller for revydo.com, the free audit and user accounts is the publisher of the Revydo service. Questions: privacy@revydo.com.
When you connect your Google Business Profile, you remain controller of the reviews and replies on that listing. Revydo then acts as processor, as described in the DPA.
Data we process
Site visitors: pages viewed, language, a technical session id, and audience measurement via PostHog (hosted in the EU).
Free audit: the name or practice you type, and information already public on Google (rating, review excerpts, whether replies exist). We do not access any medical record.
Account and subscription: email, practice identity, rule settings, automation logs, billing.
After Google is connected: public reviews, metadata (rating, date, reply status) and draft replies. If a review incidentally contains health data, we do not enrich it, do not cross-reference it, and we block any automatic publication.
Purposes and legal bases
Providing the contracted service (performance of the contract): monitoring, drafting, publishing under your rules, alerts, billing.
Free audit and demo (pre-contractual steps and legitimate interest): showing you what patients already see in public.
Security, fraud prevention and accounting duties (legal obligation and legitimate interest).
Audience measurement and product improvement (legitimate interest): PostHog, hosted in the EU, with no third-party ads.
What we do not do
We do not build a medical record. We do not sell data. We do not use your reviews to train a public model. We do not transfer health data outside the European Union.
Recipients and processors
Hosting and infrastructure: Vercel and a database in the European Union.
Transactional email: Resend. Payments: Stripe. Analytics: PostHog (EU). Google listing: Google, through your own OAuth connection.
These providers act only on instruction, to run the service.
Retention
Audience cookies: 13 months maximum.
Account and action logs: duration of the contract, then limited archiving for legal duties (billing in particular).
Prospect audit data: long enough to send the result, then deletion or aggregation.
After cancellation, the Google connection is cut. Replies already published on Google remain yours.
Your rights
You may request access, rectification, erasure, restriction, portability, and object to certain processing. Write to privacy@revydo.com. We reply within 30 days.
You may also lodge a complaint with the CNIL (cnil.fr) or your local supervisory authority.
Transfers outside the EU
We prefer processing hosted in the EU. If a provider involves a transfer, standard contractual clauses and additional safeguards apply.