Privacy Policy
Last Updated: October 27, 2026
Nitwit AB (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.
1. Information We Collect
Personal Information You Provide
When you create an account with Revontale, we collect:
- Email address - For authentication and account security
- Name - The name you give us when you start, or the one from your sign-in provider
- Profile picture - From your sign-in provider (Google, Microsoft or GitHub), if it has one
Content You Create
- Chat conversations - Your sessions with Friday, our AI coach
- Memory profile - What Friday learns about you across sessions
- Projects - Project names and the briefs you and Friday write together
- Texts you share - Chapters, scenes and stories you attach, or ask Friday to keep from the chat, with every version you add. Friday also keeps a short map of each text and its readings of it.
- Voice - If you use Walk & Talk or dictation, the audio of what you say while the microphone is on
- Feedback - Anything you send us through the feedback option
- Account preferences - Your settings and configurations
Payment Information
- Billing details - If you subscribe or buy credits, you enter your card details and billing address on Stripe’s payment page. We never see or store your card number. We keep your Stripe customer ID and the state of your subscription and credits.
Technical Information
- IP address and browser - Recorded when you sign up, sign in or sign out, and when you delete your account, for security and fraud prevention. Trial chats on our website store the visitor’s IP address to limit abuse.
- Approximate location - Country, city and time zone, derived from your IP address by our hosting provider. Friday uses your country and time zone to get dates and context right.
- Device information - Operating system and device type
- Email activity - Whether the emails we send you were delivered, opened or clicked
- Session cookies - For authentication (via Logto, hosted in Europe)
- Analytics cookies - For service improvement (via PostHog, hosted in Europe)
2. How We Use Your Information
We use your information solely to provide and improve Revontale:
Service Delivery
- Authenticate your account via Logto
- Provide AI-powered coaching conversations
- Save your conversation history and memory profile
- Let Friday search your past conversations and memories
- Keep the texts you share and read them when you ask
- Display personalized content
Service Improvement
- Understand how you use Revontale (analytics and session recordings, with the text of your conversations, memories and projects masked)
- Fix bugs and improve performance
- Develop new features based on usage patterns
- Evaluate alternative AI models with a small number of accounts (see Mistral AI below)
Communication
- Send important service updates (rare, essential only)
- Send the emails you ask Friday for, and the coaching emails you can switch off in your settings
- Respond to your support requests
We will NEVER:
- Sell your personal information
- Share your chat history with anyone beyond the service providers listed below, who need it to run Revontale
- Use your data for advertising
- Train AI models on your private content
- Use third party services that train AI models with user data
3. How We Share Your Information
We work with carefully selected service providers who help us deliver Revontale. Each one gets only the data it needs for its job.
Sub-Processors
Your Data is Protected
We only share data with GDPR-compliant processors who are contractually obligated to protect your privacy.
Anthropic (AI Processing)
- Purpose: Powers our AI coaching conversations using Claude. Also writes session titles and the summaries that let Friday keep long conversations in view, and reads the texts you share.
- Location: United States
- Data shared: Your chat messages and what Friday needs to answer them: your memory profile, relevant memories, project briefs, your name, country, language and local date and time. The texts you share: once when you add a text or a new version, to make a short map of it, and again whenever you ask Friday to read it. Also the trial chat on our website.
- Privacy guarantee: Anthropic does NOT train models on customer data
- Learn more: Anthropic Privacy Policy
OpenAI (Search Indexing)
- Purpose: Turns your messages, memories and searches into embeddings, number patterns that let Friday find related conversations and memories. OpenAI does not write any of Friday’s replies.
- Location: United States
- Data shared: The text of your chat messages, your memories and your search queries, and coaching resources your team writes. The texts you attach or keep are never indexed, but a text you paste into a message is indexed with the rest of that message.
- Privacy guarantee: OpenAI does not train models on this data
- Learn more: OpenAI Privacy Policy
Mistral AI (Model Evaluation)
- Purpose: We test alternative AI models with a small number of accounts. If your account is part of a test, Mistral AI answers your conversations instead of Anthropic.
- Location: France (EU)
- Data shared: The same data Anthropic would receive, for accounts in a test, except the texts you share: Anthropic always reads those
- Privacy guarantee: Mistral AI does not train models on this data
- Learn more: Mistral AI Privacy Policy
Vercel (Hosting and AI Routing)
- Purpose: Runs the Revontale app, and routes our requests to the AI providers above
- Location: App servers in Stockholm, Sweden. Vercel is a US company.
- Data shared: Everything you send to and receive from the app passes through Vercel, including your IP address. Requests to Anthropic, OpenAI and Mistral AI pass through Vercel’s AI Gateway, which does not keep them after the request completes.
- Learn more: Vercel Privacy Policy
ElevenLabs (Voice)
- Purpose: Speech-to-text and text-to-speech for Walk & Talk and dictation
- Location: United States
- Data shared: Your voice audio while the microphone is on, and the text of Friday’s replies when they are read aloud. Only if you use these features. Voice goes to ElevenLabs directly, from your browser or from our servers.
- Privacy guarantee: ElevenLabs does not train models on this data
- Learn more: ElevenLabs Privacy Policy
Resend (Email)
- Purpose: Delivers the emails we send you
- Location: EU region (Ireland). Resend is a US company.
- Data shared: Your email address and the content of each email. Emails you ask Friday for, and coaching emails such as Friday Wrapped, are written from your conversations and memories. Feedback you send us reaches our team inbox through Resend, with your name and email. Resend tells us whether each email was delivered, opened or clicked.
- Learn more: Resend Privacy Policy
Stripe (Payments)
- Purpose: Handles subscriptions, credit purchases and team billing
- Location: EU (Stripe Payments Europe, Ireland), with processing in the United States
- Data shared: Your email address, our ID for your account, your card details and billing address when Stripe asks for it (entered directly with Stripe), and for team billing the team name
- Learn more: Stripe Privacy Policy
MongoDB Atlas (Data Storage)
- Purpose: Securely stores your account data, chat history and the texts you share
- Location: Stockholm, Sweden
- Data shared: All your Revontale data
- Security: Encryption at rest, restrictive role-based access control
- Learn more: MongoDB Privacy
Logto (Authentication)
- Purpose: Handles secure e-mail based authentication, and sign-in with Google, Microsoft or GitHub
- Location: EU region
- Data shared: Email address, and your name and profile picture if you sign in through Google, Microsoft or GitHub
- Learn more: Logto Privacy
PostHog (Analytics)
- Purpose: Analytics, session recordings and error reports, to improve the service
- Location: EU region
- Data shared: Page visits, feature usage, errors and performance. When you’re signed in, we link this to your account ID, email address, name, profile picture and subscription status. For AI usage we record token counts and costs, never the text.
- Session recordings: Everything you type is masked, and so is the text of your conversations, memories, projects and notifications. Network requests in recordings keep only the address and timing, never the content, and requests to our chat, account and sign-in services are left out entirely.
- Learn more: PostHog Privacy
4. Your Rights Under GDPR
As a user in the European Economic Area, you have the following rights:
Right to Access
Export all your data in machine-readable JSON format anytime.
Right to Access - Request a copy of all your personal data
Right to Rectification - Update or correct your information (edit in your profile)
Right to Erasure (“Right to be Forgotten”) - Delete your account and all associated data
Right to Data Portability - Receive your data in a structured, machine-readable format (JSON)
Right to Restriction of Processing - Request we limit how we use your data
Right to Object - Object to certain types of data processing
Right to Lodge a Complaint - File a complaint with your local data protection authority
To exercise any of these rights, visit your account settings or contact us at privacy@revontale.com
or go to the account page:
5. Data Retention
Active Accounts
- Your data is retained as long as your account is active
- You control your data and can delete it anytime
- Sign-in records (IP address and browser) are deleted after 90 days
- In-app notifications are deleted after 90 days
- Texts you share stay until you delete them. Deleting a text removes every version and Friday’s readings of it. Notes Friday saved about the text are memories, and stay in your memory profile until you delete them
- Trial chats on our website that never become an account, and the IP address stored with them, are deleted after 24 hours
Deleted Accounts
- 30-day grace period: After deletion, we keep your account and conversations for 30 days in case you change your mind. Your memories and scheduled sessions are deleted straight away.
- Email anonymization: Your email is immediately anonymized to prevent re-registration
- Permanent deletion: After 30 days, we permanently delete your account and everything in it, including the texts you shared. If you own a team, we keep your account until the team is handed over or closed.
- Audit trail: Token usage and credit transaction records are preserved for financial compliance, with your account ID replaced by a random one
- Records held by our providers: Stripe keeps its own records of your payments and invoices, as bookkeeping law requires. PostHog analytics data expires after 12 months.
Analytics Data
- PostHog analytics data is retained for 12 months
- Anonymized usage metrics for service improvement
6. Security Measures
We take security seriously and implement industry-standard protections:
Encryption
- In transit: TLS 1.3 encryption for all data transmission
- At rest: AES-256 encryption for database storage (MongoDB Atlas)
Access Control
- Role-based access control (RBAC) for all team members
- Multi-factor authentication for administrative access
- Regular security audits and penetration testing
Data Isolation
- Your data is strictly isolated from other users
- All database queries validate ownership before returning data
Monitoring
- 24/7 security monitoring for suspicious activity
- Automated alerts for potential security incidents
- Regular backups stored securely in EU region
7. International Data Transfers
EU Data Storage
- Your primary data is stored in Stockholm, Sweden (AWS eu-north-1), and the Revontale app runs there too
- Backups stay in the EU
Processing Outside the EU
To answer you, some of your data is processed by providers in the United States:
- Anthropic: your chat messages and the context Friday needs to answer them, and the texts you share
- OpenAI: the text of your messages, memories and searches, for search indexing
- ElevenLabs: your voice audio and the replies read back to you, if you use voice features
- Vercel: requests to Anthropic, OpenAI and Mistral AI, routed through its AI Gateway
- Stripe: payment details, which Stripe may process in the United States
Resend, PostHog and Stripe’s EU entity keep your data in the EU, but they are US companies or part of US groups.
Transfer mechanism: Standard Contractual Clauses (SCCs), or the EU–US Data Privacy Framework where the provider is certified under it.
How long providers keep it: The AI providers process your data in real time to answer you. They do not train on it or keep it permanently.
8. Cookies and Tracking
Essential Cookies (Required for Service)
- Logto authentication: Session cookies to keep you logged in
- Duration: Until you sign out or 30 days of inactivity
Analytics Cookies (Optional)
- PostHog analytics: Usage tracking and session recordings
- What we track: Page visits, feature usage, error reports
- What we DON’T track: Passwords, anything you type, the text of your conversations and memories
- Privacy mode: Inputs, and the text of your conversations, memories and projects, masked. Console logs disabled
- Opt-out: You can disable analytics in your browser settings
No Third-Party Advertising
- We do not use advertising cookies
- We do not sell your data to advertisers
- We do not participate in ad networks
9. Children’s Privacy
Revontale is not intended for users under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at privacy@revontale.com and we will delete it immediately.
10. Changes to This Policy
We may update this Privacy Policy from time to time to reflect:
- Changes in our data practices
- New features or services
- Legal or regulatory requirements
Notification of Changes:
- We will notify you via email for significant changes
- The “Last Updated” date at the top will always reflect the most recent version
- Continued use of Revontale after changes constitutes acceptance
11. Contact Us
Data Controller: Nitwit AB
Privacy Questions: privacy@revontale.com
Data Protection Officer: Mark Dixon, mark@revontale.com
Postal Address: Årstavägen 9, 112 50, Sweden
12. Legal Basis for Processing
Under GDPR, we process your personal data under the following legal bases:
- Contract: To provide the Revontale service you signed up for
- Legitimate Interest: To improve our service and prevent fraud
- Consent: For analytics cookies and optional features (where applicable)
Your Privacy is Our Priority
We built Revontale with privacy at its core. Your stories are personal, and we treat them that way.
Key Commitments:
- EU-based data storage (Stockholm)
- No training on your data
- Export your data anytime
- Delete your account with one click
- GDPR compliant
- Analytics that mask your conversations
- Every service that touches your data, named above