Privacy Policy & AI Governance
Statutory privacy notice of MyRevue Technologies Ltd (trading as "Denvora") under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the EU GDPR, and the EU AI Act. Last Updated: October 2026.
Transcripts and audio are never used to train public LLMs or foundational AI models.
Raw meeting audio recordings are permanently purged upon transcript synthesis completion (UK GDPR Art. 17).
Bot operations run in Frankfurt (eu-central-1) and database/email in Ireland & London (eu-west-1).
1. Identity of Controller & Processor
Denvora is operated by MyRevue Technologies Ltd, registered in England and Wales with registered office at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.
- When we act as Data Controller: For Workspace Subscriber account registration, billing administration, security audit logs, and support communications.
- When we act as Data Processor: For meeting audio streams, candidate interview transcripts, evaluation templates, and synthesized debrief dossiers processed on instructions of the Customer Workspace (the Data Controller) pursuant to our Article 28 Data Processing Addendum (/dpa).
To contact our Data Protection Officer (DPO), email privacy@my-revue.co.uk.
2. Categories of Personal Data Processed
- Workspace & Account Data: Full name, work email address, company name, workspace role (`OWNER`, `ADMIN`, `MEMBER`, `REVIEWER`), and encrypted OAuth credentials (`AES-256-GCM`).
- Ephemeral Meeting Audio Streams: Real-time audio received from Zoom, Google Meet, or Microsoft Teams strictly for transient speech-to-text transcription and immediately purged upon call completion.
- Transcripts & Synthesized Dossiers: Time-stamped text utterances, speaker labels, template criteria scores, evidence quotes, and human hiring decisions.
- Security & Operational Telemetry: Request correlation IDs (`x-request-id`), rate-limit counters, and PII-scrubbed error diagnostics.
3. Lawful Bases for Processing (UK GDPR Art. 6 & Art. 9)
- Performance of a Contract (Art. 6(1)(b)): Delivering workspace authentication, calendar sync, meeting transcription, and dossier synthesis.
- Explicit Consent (Art. 6(1)(a)): Obtained by the meeting host from all call attendees prior to bot recording.
- Compliance with Legal Obligations (Art. 6(1)(c)): Statutory UK VAT / HMRC accounting and tax record retention.
- Legitimate Interests (Art. 6(1)(f)): Preventing credential stuffing, enforcing multi-tenant isolation, and maintaining service reliability.
4. AI Governance, UK Equality Act 2010 & EU AI Act Disclosures
5. Authorized Subprocessors & International Transfers
We engage the following enterprise subprocessors under binding Article 28 Data Processing Addendums, the UK International Data Transfer Addendum (IDTA), and EU Standard Contractual Clauses (SCCs):
| Subprocessor | Processing Activity | Primary Region | Security & Transfer Safeguards |
|---|---|---|---|
| Recall.ai Inc. | Meeting bot dispatch & real-time speech-to-text | Frankfurt, Germany (eu-central-1) | EU Residency, Immediate Art. 17 Audio Purge, SOC 2 Type II |
| Google Cloud (Gemini API) | Template classification & post-call dossier synthesis | EU / UK Enterprise Cloud | Zero Data Retention, No Model Training, ISO 27001 / SOC 2 |
| Supabase Inc. | PostgreSQL multi-tenant database & authentication | EU West (eu-west-1) | AES-256 at rest, TLS 1.3, Row-Level Security, SOC 2 Type II |
| Stripe Payments Europe Ltd | Subscription checkout, UK VAT calculation & invoicing | Dublin, Ireland (EU) | PCI-DSS Level 1 Service Provider, UK/EU Adequacy |
| Resend Inc. | Transactional verification, invite & dossier emails | Dublin, Ireland (eu-west-1) | SPF/DKIM/TLS enforcement, EU Region, UK IDTA / SCCs |
| Vercel Inc. | Edge network & serverless application hosting | Frankfurt / London (fra1 / lhr1) | ISO 27001, SOC 2 Type II, UK IDTA / EU SCCs |
6. Data Retention Schedule
| Data Category | Retention Period | Disposal Mechanism |
|---|---|---|
| Raw Meeting Audio | 0 seconds post-synthesis (Ephemeral) | Immediate cryptographic purge via Recall.ai `DELETE /bot` & webhook |
| Transcripts, Reports & Templates | Active subscription duration | Immediate cascade deletion upon Workspace/Account erasure (`DELETE /api/account/privacy`) |
| OAuth Integration Tokens | Until integration disconnect | Immediate provider revocation & DB deletion (`DELETE /api/integrations/[provider]/config`) |
| Operational & Security Logs | 90 days | Automated ring-buffer & retention pruning with PII redaction |
| VAT & Billing Invoices | 7 years | Statutory UK HMRC tax record retention mandate |
7. Data Subject Rights & Self-Service GDPR Controls (Articles 15–22)
Under the UK GDPR and EU GDPR, you have the right of access (Art. 15), rectification (Art. 16), erasure / "right to be forgotten" (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21).
- Self-Service Data Portability Export (Art. 15 & 20): Authenticated users can download a complete JSON archive of their profile, workspace, meetings, reports, and templates at any time via Settings → Data & Privacy → Export Data (`GET /api/account/privacy`).
- Self-Service Account & Workspace Erasure (Art. 17): Users can permanently erase their account and cascade-delete all associated data via Settings → Data & Privacy → Delete Account (`DELETE /api/account/privacy`), receiving a signed Erasure Certificate.
- Supervisory Authority Complaints: You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk (Tel: 0303 123 1113) or your local EU Data Protection Authority.
8. Cookie Policy (PECR Compliance)
In accordance with the UK Privacy and Electronic Communications Regulations (PECR), Denvora uses only strictly necessary first-party `HttpOnly` session cookies (Supabase Auth tokens, `debrief_admin_session`, and OAuth PKCE state cookies) and local UI preference storage (`debrief_cookie_consent`, theme settings). We do not use third-party advertising or cross-site tracking cookies.