Privacy Policy

1. Information We Collect

a) Information you provide directly:

• Account/business registration details (business name, EIN if provided, contact name, email, phone)
• Billing information
• Communications with our support team

b) Information from connected payment processors (via your authorization):

• Transaction and charge data (amounts, dates, authorization/AVS/CVV results, fraud-risk signals)
• Dispute and chargeback records and deadlines
• Payout and account status information, as needed to operate the Service

c) Information from other connected data sources:

• Device fingerprinting and session signals (via Fingerprint Pro)
• Shipping/delivery confirmation data (via EasyPost)

d) Automatically collected Site data:

• IP address, browser type, pages visited, referring URLs, and similar analytics data (via tools such as Google Analytics/GTM)
• Cookies and similar technologies — see Part C (Cookie Policy) below for details on what we use and how to control it

2. How We Use Information

We use the information described above to:

• Provide, operate, and improve the Service, including compiling and submitting chargeback representment packages;
• Authenticate accounts and secure the Service;
• Communicate with you about your account, disputes in progress, and deadlines;
• Analyze and improve Site performance and marketing effectiveness; and
• Comply with legal obligations and enforce our agreements.

We do not use Consumer Transaction Data for any purpose other than providing the Service to the merchant from whom it was received (i.e., we do not use it for our own marketing, do not aggregate it for resale, and do not use it to build profiles independent of the specific dispute it relates to), except as required by law.

3. AI-Assisted Processing

RevivFlow uses third-party AI models (currently, OpenAI’s API) as part of the Service to: (a) draft narrative text for representment evidence; (b) assist in classifying and extracting information from submitted documents; and (c) assist in scoring the relative strength of a Dispute’s evidence.

Data minimization. Before any data is sent to an AI model provider, RevivFlow redacts or anonymizes personally identifying fields. Full, unredacted cardholder personal data is not transmitted to the AI model provider.

No training on your data. RevivFlow’s agreement with its AI model provider is under an API/business-tier arrangement, under which submitted data is not used to train the provider’s models, consistent with the provider’s standard API data-usage terms then in effect.

Human review. A human review step is available to Merchant before AI-assisted evidence is submitted to a Payment Processor. Whether that review is required or optional, and who is responsible for content that is submitted without review, is governed by Section 6A of the Merchant Agreement.

Deterministic vs. AI-assisted components. Some evidence-assembly steps (e.g., aggregating documents a Merchant uploads into a single package) are performed by deterministic, non-AI logic. The Merchant Agreement describes which parts of the process are deterministic and which are AI-assisted.

The AI model provider is one of the subprocessors RevivFlow engages to support the Service, as described in Part B, Section B4 below.

4. How We Share Information

We share information with:

• Payment processors and card networks, as necessary to submit dispute evidence on your behalf;
• AI model providers, as described in Section 3, on a redacted/anonymized basis;
• Service providers/subprocessors who support our infrastructure (e.g., cloud hosting, Fingerprint Pro, EasyPost, analytics providers), under confidentiality and data-protection obligations;
• Professional advisors (legal, accounting) as needed;
• Law enforcement or regulators, where required by law or to protect our rights; and
• A successor entity, in connection with a merger, acquisition, or sale of assets.

We do not sell personal information.

5. Data Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect information from unauthorized access, use, or disclosure, including redaction of personal data prior to AI processing as described in Section 3. No system is completely secure, and we cannot guarantee absolute security.

6. Data Retention

We retain Consumer Transaction Data for as long as necessary to complete the applicable dispute representment process and for the period required to comply with card network evidentiary and audit requirements (typically up to 24 months, consistent with major card network rules), after which it is deleted or de-identified, unless a longer period is required by law or agreed with the merchant.

7. Your Rights

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, request deletion, and opt out of any “sale” or “sharing” of personal information (note: we do not sell personal information). To exercise these rights, contact privacy@revivflow.com.

If you are a merchant’s customer whose data was submitted to RevivFlow as part of a dispute, and you have questions about that data, please contact the merchant directly, as they are the party with the direct relationship to you; RevivFlow will support the merchant in responding to verified requests as required by law.

Automated processing. If you are a merchant and believe an AI-assisted output submitted on your behalf materially affected a dispute outcome, you may enable manual review of each chargeback before it is submitted, as described in Section 3.

8. Children’s Privacy

The Service is not directed to individuals under 18, and we do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be posted on the Site with an updated effective date and version number.

10. Contact Us

RevivFlow Corp, 1541 Larkwood Ct, Milpitas, CA 95035; email: privacy@revivflow.com

B1. Roles of the Parties

For purposes of this Part B and applicable data protection law (including the CCPA), Merchant is the business/controller with respect to Consumer Transaction Data, and RevivFlow acts as a service provider/processor, processing such data solely on Merchant’s documented instructions as set out in the Merchant Agreement and this Part B.

B2. Scope and Purpose of Processing

RevivFlow processes Consumer Transaction Data solely to: (a) compile and submit chargeback Representment packages; (b) operate AI-assisted drafting, classification, and evidence-scoring features described in Section 6A of the Merchant Agreement; and (c) comply with card network evidentiary retention requirements. RevivFlow will not process Consumer Transaction Data for any other purpose, including its own marketing or cross-merchant model training, without Merchant’s prior written consent.

B3. Categories of Data

Consumer Transaction Data processed under this Part B may include: cardholder name, billing/shipping address, IP address, device/fraud signals, order and delivery details, and payment authorization metadata (excluding full card numbers, which RevivFlow does not receive or store).

B4. Subprocessors

Merchant consents to RevivFlow’s use of subprocessors, each engaged to support the Service. RevivFlow does not publish its list of subprocessors on the Site.

B4.1 Flow-down obligations. RevivFlow will bind each subprocessor to confidentiality and data-protection obligations materially equivalent to those in this Part B, to the extent available under the subprocessor’s standard commercial terms.

B4.2 Changes to subprocessors. RevivFlow will provide notice before adding a new subprocessor that will process Consumer Transaction Data, and Merchant may object on reasonable data-protection grounds within 15 days of notice.

B5. Data Minimization for AI Processing

Before any Consumer Transaction Data is transmitted to an AI model subprocessor, RevivFlow redacts or anonymizes personally identifying fields, as described in Section 3 and Merchant Agreement Section 6A. This is a technical safeguard RevivFlow applies specifically because AI model subprocessors are treated as a higher-sensitivity category of subprocessor.

B6. Security Measures

RevivFlow will maintain administrative, technical, and physical safeguards designed to protect Consumer Transaction Data against unauthorized access, use, or disclosure, including access controls, encryption in transit and at rest, and redaction prior to AI processing.

B7. Breach Notification

RevivFlow will notify Merchant without undue delay, and in any event within 72 hours of becoming aware, of any confirmed unauthorized access to or disclosure of Consumer Transaction Data. Notice will include what is known at the time about the nature and scope of the incident and the steps RevivFlow is taking in response, with updates as more information becomes available.

B8. Audit Rights

No more than once per 12-month period (or following a confirmed security incident), Merchant may request reasonable evidence of RevivFlow’s compliance with this Part B, which RevivFlow will provide in the form of a completed security questionnaire or summary documentation, at RevivFlow’s discretion.

B9. Data Subject Requests

RevivFlow will provide reasonable assistance to Merchant in responding to verified requests from consumers regarding their Consumer Transaction Data (access, correction, deletion), consistent with Merchant’s obligations as the responsible business under applicable law. Consumers should be directed to contact Merchant directly in the first instance, per Section 7 above.

B10. Data Return and Deletion

Upon termination of the Merchant Agreement, RevivFlow will, at Merchant’s election, delete or return Consumer Transaction Data within 30 days, except to the extent retention is required for card network evidentiary/audit purposes (per Section 6 above) or by law.

B11. International Transfers

RevivFlow’s processing of Consumer Transaction Data under this Part B is currently limited to the United States. RevivFlow will notify Merchant before any Consumer Transaction Data is transferred, processed, or stored outside the United States.

B12. Relationship to the Merchant Agreement

This Part B is governed by the Merchant Agreement’s general terms (governing law, limitation of liability, indemnification) except where this Part B expressly states otherwise. In the event of a conflict between this Part B and the Merchant Agreement regarding the processing of Consumer Transaction Data, this Part B controls.

C1. What Cookies We Use

We currently use cookies and similar technologies solely for site analytics, via:

• Google Tag Manager (GTM) — container ID GTM-MK8BFLSP, used to manage the tags below
• Google Analytics 4 (GA4) — measurement ID G-4ER1VSY57J, used to understand how visitors use the Site (pages viewed, referring source, general usage patterns)

We do not currently use advertising, remarketing, or ad-personalization cookies (e.g., Google Signals is not enabled), and we do not use any other third-party tracking pixels, chat widgets, or similar tools on the Site as of this policy’s effective date.

C2. Why We Use These Cookies

GA4 data helps us understand which pages are useful, how visitors find the Site, and where to improve it. This is for analytics use only — we do not use this data to build advertising profiles or to personalize ads to you.

C3. Your Choices

Because our current use is limited to analytics (not advertising, and not a “sale” or “sharing” of personal information under the CCPA), a blocking consent banner is not required. You can still control cookies by:

• Using your browser’s cookie settings to block or delete cookies (see your browser’s help documentation);
• Installing the Google Analytics Opt-out Browser Add-on to prevent GA4 from collecting your data on any site; or
• Contact us at privacy@revivflow.com with questions or requests.

If you are a California resident, see Section 7 (Your Rights) above.

C4. Changes to Our Cookie Use

If we add advertising, remarketing, or other higher-sensitivity tracking technologies in the future, we will update this policy and, where required by law, implement an opt-in consent mechanism before those cookies are set.