Privacy Policy

Last updated: August 11, 2026

This policy explains what personal data we collect when you use Revizo (revizo.studio and app.revizo.studio), why we collect it, and the choices you have. The data controller is the operator identified below.

1. Data we collect

• Account data — email address, display name, and, if you sign in with Google, the identifiers Google shares with us. Passwords are stored only as salted hashes.
• Content you upload — floor plans, PDF drawings, 3D/IFC models, reference images and annotations, and the visualizations generated from them.
• Transaction data — credit balance, credit ledger, purchased packages and payment status. We do not receive or store your full card number or Kaspi credentials; payments are handled by the payment providers listed below.
• Usage data — product analytics events (pages, features used, device and browser type) and server logs (IP address, timestamps) kept for security and debugging.

2. Why we process it

• to provide the Service: generate renders, store your projects and history (contract);
• to process purchases and credit your balance (contract);
• to secure the Service and prevent abuse (legitimate interest);
• to understand product usage and improve the Service (legitimate interest / consent where required);
• to comply with accounting and tax obligations (legal obligation).

Your uploaded content is processed to fulfil your generation requests. We do not use your content to train our own AI models.

3. Processors and recipients

We share data only with the service providers needed to run Revizo:

• fal.ai (USA) — AI inference: uploaded images and generation prompts are transmitted for rendering, and generated images are stored on fal.ai storage;
• Google — optional sign-in (OAuth);
• Railway (USA/EU) — application hosting and databases;
• Kaspi Pay / ApiPay (Kazakhstan) — payment processing for KZT payments;
• Paddle (UK/USA) — merchant of record for international card payments; Paddle acts as an independent controller for checkout data under its own privacy policy;
• PostHog (USA/EU) — product analytics.

Some providers are located outside the Republic of Kazakhstan; by using the Service you consent to this cross-border transfer, which we protect through contractual safeguards with each provider.

We never sell personal data.

4. Retention

• Account data and projects — for the life of the account; deleted upon account deletion, except records we must keep by law.
• Transaction records — as long as required by accounting and tax legislation.
• Server logs — up to 90 days.

5. Your rights

Subject to applicable law (including the Law of the Republic of Kazakhstan "On Personal Data and its Protection" and, where it applies, the GDPR), you may request access to, correction of, or deletion of your personal data; object to or restrict certain processing; and receive a copy of data you provided. Write to ceo@revizo.studio — we respond within 30 days. You may also lodge a complaint with your local supervisory authority.

6. Cookies and local storage

We use strictly necessary cookies for authentication sessions and local storage for preferences (such as interface language), plus analytics identifiers to measure product usage. We do not use third-party advertising cookies.

7. Security

Data is transmitted over TLS and stored in access-controlled databases. Access to personal data is limited to personnel who need it to operate the Service.

8. Children

The Service is not directed at children under 18, and we do not knowingly collect their data.

9. Changes

We may update this policy; material changes are announced in the app or by email. The "Last updated" date above reflects the current version.