Privacy Policy Revisual

1. Introduction

This privacy policy explains how Revisual handles your personal data. We attach great importance to the protection of your privacy and process your data exclusively in accordance with the General Data Protection Regulation (GDPR).

2. Who are we?

Revisual is the trade name under which Sam Piryns offers his services. We are the data controller for the processing described in this policy.

• Address: Palmendreef 54, 9040 Gent, Belgium
• Enterprise number: 1035.810.540
• Email: [email protected]
• Website: revisual.be

3. Who does this privacy policy apply to?

This policy applies to all visitors to our website, our professional (B2B) customers, and individuals who contact us via email or the contact form.

4. What personal data do we process?

We only collect and process the data necessary for our services. This includes:

• Contact and identification data: name, email address, telephone number.
• Company and account data: enterprise number, company name, address details.
• Billing and administrative data: payment details, invoice history.
• Content data: communication with Revisual, uploaded property photos and the visuals generated from them.
• Technical data: limited technical information (such as IP address and browser type) necessary for the website and platform to function securely and correctly.

5. Why do we process this data?

We use your personal data for the following purposes:

• Delivering our services and managing your account (performance of a contract).
• Processing payments and maintaining our accounting (legal obligation).
• Answering questions and following up on contact or demo requests (pre-contractual measures at your request or, for general business communication, our legitimate interest).
• Securing and optimizing our website and systems (legitimate interest).

Where certain personal data is necessary to create an account, deliver our services, handle a request, process payments or comply with legal obligations, we may be unable to provide the service concerned if that data is not provided. Other data you provide voluntarily.

6. When do we process data for our customers?

Within the Revisual platform, we play two different roles under the GDPR:

• As data controller: for our own customer, contact, billing and website data.
• As data processor: when you as a real estate agency process personal data via our platform (e.g. photos on which individuals are exceptionally recognizable, or data of your own employees or leads). For these processing operations, we act exclusively on your instructions. These agreements are laid down in a separate data processing agreement that is provided directly to you.

7. Who do we share data with?

Revisual does not sell your data to third parties. For certain technical services, we do rely on specialized service providers. Appropriate contractual and security agreements are made with these parties. These are currently the following suppliers:

• Supabase: database, sign-in and storage of photos and videos (EU).
• Cloudflare: R2 storage, platform hosting, CDN and image processing (worldwide).
• Vercel: hosting of this marketing website (US).
• Railway: the servers and the background jobs (EU).
• OpenAI: image generation and text (US).
• fal.ai: image and video models (US).
• Volcengine Ark (ByteDance): video generation (outside the EU).
• ElevenLabs: voice-over for videos (US).
• Meta Platforms: publishing to Facebook and Instagram (US).
• TikTok (ByteDance): publishing to TikTok (outside the EU).
• Google (YouTube): publishing to YouTube and reading the counts of those videos (US).
• Firecrawl: reading the public pages of real estate agency websites (US).
• Sentry: error reports from the software (US).
• Resend: email to users (US).
• Google: Google Fonts and, once the booking calendar is loaded, Google Calendar for available times, the appointment, and its Google Meet link (US).
• Uptime Robot: monitoring whether the service is reachable (US).

We have configured Sentry so that personal data is, as far as possible, not transmitted or is removed before sending. Before an error report is sent, we strip the request, the cookies, the headers and the query string, and from the user the email address, the username and the IP address.

Certain service providers may process personal data outside the European Economic Area (EEA). Where this happens, we ensure a valid transfer mechanism in accordance with the GDPR. Depending on the recipient, this may be based on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for participating US organizations, or on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs). Further information on the applicable safeguards can be requested via [email protected].

In addition, we may share your data with authorities or regulators when legally required to do so.

8. Instagram and Facebook

If you connect your Facebook page and the associated Instagram business profile to Revisual, we can publish posts for you. This only happens after you have logged in to Facebook yourself and granted permission.

What we receive from Meta. On connecting, we receive the name and the number of your Facebook page, the number and the username of the linked Instagram business profile, your name and profile number as Facebook passes them to the app, and an access token that allows us to post on behalf of your page.

What we do with it. We use that data for exactly one purpose: publishing the photos, videos and captions you have approved in Revisual to your own channels. The access token is stored encrypted in our database and is not used for anything else.

What we do not do. We do not read messages, comments or private conversations. We do not retrieve data about your followers. We do not request statistics. We do not post anything on anyone else's pages, and nothing that has not been prepared in Revisual.

Which permissions we ask for. public_profile, business_management, pages_show_list, pages_read_engagement, pages_manage_posts, instagram_basic and instagram_content_publish. Nothing more.

For how long. The access token is kept for as long as the connection is active. If you disconnect within Revisual, the token is deleted immediately. Meta also lets the access expire by itself if you have not logged in for ninety days; we then ask you to connect again.

Revoking it yourself. You can break the connection at any time, in Revisual under Settings and Social channels, or on Facebook itself via Settings, Business integrations. If you do it on Facebook, our token stops working immediately.

Deletion. If you want us to delete everything attached to that connection, read Data deletion.

9. TikTok

If you connect your TikTok account to Revisual, we can prepare or publish videos for you. This only happens after you have logged in to TikTok yourself and granted permission.

What we receive from TikTok. On connecting, we receive your open ID, your display name and your profile picture as TikTok passes them to the app, together with an access token and a refresh token that allow us to post on your behalf. Immediately before every publication we also ask TikTok which visibility options your account allows and whether you are still permitted to post at that moment. TikTok requires this.

What we do with it. We use that data for exactly one purpose: publishing the videos and captions you have approved in Revisual to your own TikTok account, or placing them there as a draft. You see a preview of every post, choose the visibility yourself and can edit the text and the hashtags. Without that approval nothing goes out. The tokens are stored encrypted in our database and are not used for anything else.

What we do not do. We do not read messages or comments. We do not retrieve data about your followers. We do not request statistics. We do not post anything on anyone else's account, and nothing that has not been approved in Revisual.

Which permissions we ask for. user.info.basic, video.publish and video.upload. Nothing more.

For how long. The TikTok access token expires after twenty-four hours; we automatically obtain a new one with the refresh token, so you do not have to log in again every time. That refresh token stays valid for a year. If you disconnect within Revisual, both tokens are deleted immediately.

Revoking it yourself. You can break the connection at any time, in Revisual under Settings and Social channels, or on TikTok itself via Settings and privacy, then Security and permissions, then Apps permissions. If you do it on TikTok, our token stops working immediately.

Deletion. If you want us to delete everything attached to that connection, read Data deletion.

10. YouTube

When you connect a YouTube channel, Revisual uses YouTube API Services to upload videos to that channel on your behalf, and to read your channel name and the view, like and comment counts of those videos. Google processes this data under the Google Privacy Policy. By connecting a channel, you agree to the YouTube Terms of Service.

Revisual only uploads videos you send yourself. Videos that Revisual schedules automatically are only sent to YouTube if you turn this on in advance under Social channels. That setting is off by default.

We store: an encrypted access token, your channel name, the video ID of each video posted, and the daily view, like and comment counts of the videos you posted through Revisual. The channel name is refreshed daily.

If you disconnect the channel in Revisual, under Social channels, we revoke our access at Google and immediately delete the access token, the channel name and the counts. We keep the video ID as a record of what was posted. You can also revoke access yourself in your Google Account security settings; if access stops working after that, we delete the same data within 30 days.

Revisual's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Deletion. If you want us to delete everything attached to that connection, read Data deletion.

11. How long do we keep data?

We do not keep your data longer than necessary for the purposes for which it was collected:

• Contact and prospect data: as long as reasonably necessary to follow up on your question or request.
• Customer and account data: for the duration of the agreement and a limited period thereafter for administrative processing.
• Billing and accounting data: for the applicable statutory retention period, in principle 10 years.
• Images and customer content: as long as necessary for the service provision and thereafter according to the agreements with the customer in the agreement.
• Technical and security data: for a limited period necessary for system security and error tracking.

12. How do we protect data?

We take the security of your data seriously and apply appropriate technical and organizational measures to prevent loss, misuse, unauthorized access, and unauthorized modification or disclosure. We use secure connections (HTTPS) and strict access controls on our systems.

13. What rights does the user have?

Under the GDPR, you have various rights regarding your personal data:

• Right of access: you may request to see what data we process about you.
• Right to rectification: you can have incorrect or incomplete data corrected.
• Right to erasure: in certain cases you can ask to have your data deleted ("right to be forgotten").
• Right to restriction: you can request to temporarily restrict the processing.
• Right to object: you can object to the processing, in particular for direct marketing.
• Right to data portability: you can request to receive your data in a structured, commonly used format when the processing takes place automatically based on consent or an agreement.
• Right to withdraw consent: when processing is based on your consent, you can withdraw it at any time.

Do you want to exercise one of these rights? Please send an email to [email protected]. We will respond to your request as quickly as possible and at the latest within one month. You also always have the right to lodge a complaint with the Data Protection Authority (GBA) in Belgium.

14. Cookies

Our website currently only uses strictly necessary and functional techniques (such as remembering your language preference). We do not use tracking or advertising cookies that require your consent. You can find more information about this in our separate Cookie Policy.

15. Changes

Revisual may adjust this privacy policy from time to time. We will inform our customers of significant changes. The most recent version is always available on our website.

16. Contact

Do you have any questions or comments about this privacy policy or how we handle your data? Please contact us:

• Revisual (Sam Piryns)
• Palmendreef 54, 9040 Gent, Belgium
• Email: [email protected]

Revisual • Sam Piryns • Palmendreef 54, 9040 Gent • enterprise number 1035.810.540 • [email protected]