Last updated 7 November 2026
This Privacy Policy explains what personal data Renvoire collects, why, who we share it with, how long we keep it and what you can do about it. It covers renvoire.com, app.renvoire.com, our emails (including outreach from our sending domains), calls, WhatsApp and the services we provide to brands and agencies.
We sell to businesses. Most of the personal data we handle is business contact data: names, work emails and roles of people at companies we work with or would like to work with.
1. Who we are
“Renvoire”, “we”, “us” and “our” mean Abhishek Pal, an individual carrying on business under the name Renvoire, of Rudrapur, Uttarakhand, India. We decide how and why your personal data is used, which makes us the “Data Fiduciary” under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the “controller” under the EU and UK GDPR where those laws apply.
When Renvoire’s company is formed, it will take over this role. We will update this policy and tell active clients when that happens (see section 13).
Questions or requests: avik@renvoire.com. Our Grievance Officer is named in section 14.
2. The short version
- We collect what you give us, what our systems record when you use them, and public business contact details for outreach.
- We use it to talk to you, deliver and bill our services, keep our systems secure and meet legal duties.
- We do not sell personal data. We don’t use advertising cookies or tracking pixels.
- Service providers (hosting, email, scheduling, payments) process data for us under contract.
- You can ask to see, correct or delete your data, or opt out of outreach, at any time.
3. What we collect
3.1 What you give us
| Situation | What we collect |
|---|---|
| Booking a call | Name, work email, company website and your answer to “What should AI say about you?”. Our booking form builds a Calendly link in your browser; nothing is sent to us until you complete the booking on Calendly |
| Emailing, messaging or calling us | Your name, contact details, the content of your messages and any notes we take on a call. We do not record calls unless we ask you first and you agree |
| Creating an account on app.renvoire.com | Name, email, password (stored only as a hash), organisation name and website, your role in the organisation, invite code |
| Accepting our terms | The terms version you accepted, when, and the IP address you accepted from |
| Brand onboarding | Information about your company: websites, competitors, buyer roles, approved claims and evidence, voice preferences, Do-Not-Say list, subreddit exclusions, disclosure wording and files you upload. This is mainly business information, but it can include names of your staff or customers. Please don’t upload personal data we don’t need |
| Analytics access you grant | If you give us read access to Google Analytics 4 or Google Search Console, we read the reports we need for your campaign. We don’t change your settings, and you can revoke access at any time |
| Orders and briefs (agency clients) | Target threads, briefs or finished copy, links and instructions |
| Billing | Billing name, company, billing address, tax ID where relevant, invoices and payment records. Card details go directly to our payment processor; we never see or store full card numbers. For crypto top-ups we receive the payment status, amount settled and transaction reference from our payment provider |
| In-app messages | Messages you send in account, order and campaign rooms |
3.2 What our systems record
- Server and security logs: IP address, browser and device type, pages or endpoints requested, timestamps and errors. On app.renvoire.com we also log sign-in attempts and invite-code attempts to stop abuse.
- Cookies and similar storage: app.renvoire.com uses strictly necessary cookies to keep you signed in and protect your session. renvoire.com stores your pricing-term choice (1, 3 or 6 months) in your browser’s local storage so the page remembers it. Neither is used to track you.
- Email engagement: our outreach tool records whether an email was delivered, opened, replied to or bounced, so we don’t email people who replied, bounced or opted out.
We do not use website analytics tools, advertising cookies, retargeting pixels or cross-site tracking.
3.3 What we get from other sources
- Public business information for outreach: names, roles, work email addresses and company details from company websites, public professional profiles, startup directories and similar public sources, and from data tools we use to find and verify them.
- Scheduling and payment providers: booking details from Calendly; payment confirmations from our payment providers.
- Measurement data: to measure how AI engines describe a brand, we collect answers from Google AI Overviews and Gemini for agreed prompts, and public Reddit post data such as view counts and whether a post is still live. These answers sometimes mention people. We use personal data that appears in collected answers only for that measurement.
4. Why we use it, and on what basis
| Purpose | Data used | Basis |
|---|---|---|
| Replying to you and running calls | Contact details, messages, call notes | Your request and consent; GDPR: steps before a contract or legitimate interests |
| Delivering services (audits, plans, orders, reports) | Account, onboarding, order and measurement data | Performing our contract with your organisation; DPDP: data you provided for that purpose |
| Billing, accounting and tax | Billing and payment records | Contract and legal obligation |
| Security, fraud prevention and abuse prevention | Logs, sign-in and invite-code attempts | Legitimate interests; legal obligation (including Indian cyber-security reporting rules) |
| Business outreach to companies we think we can help | Public business contact details, email engagement | DPDP: personal data made publicly available; GDPR: legitimate interests, with an opt-out in every email |
| Improving the website and services | Aggregated usage, feedback | Legitimate interests |
| Showing your name, logo or testimonial | Only what you approve | Your written consent, which you can withdraw for future use |
| Meeting legal requests and enforcing our terms | Whatever is relevant | Legal obligation; legitimate interests |
Where we rely on consent, you can withdraw it at any time by emailing us. Withdrawing doesn’t affect what we did before, and it may mean we can’t continue a service that needs that data.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
5. Who we share it with
We share personal data only as needed, with:
Service providers who process data for us, under contracts that limit their use of it:
| Provider | What for | Where |
|---|---|---|
| DigitalOcean | Hosting, database and file storage | United States |
| Cloudflare | Network security and delivery | Global |
| Google Workspace | Email, documents, calendar and video calls | Global |
| Google (Gemini API) | Classifying collected AI answers and supporting analysis | United States |
| Search-results data provider | Collecting search and AI Overview results | United States / global |
| Calendly | Booking calls | United States |
| Resend | Account and service emails | United States |
| Instantly | Sending outreach emails and managing opt-outs | United States |
| NOWPayments | Crypto wallet top-ups (agency clients only) | Global |
| Mercury, Wise | Receiving bank payments | United States / global |
| WhatsApp (Meta) | Messages you choose to send us on WhatsApp | Global |
People who carry out the work. Campaign work is done by vetted independent consultants through our fulfilment platform. They receive only what a task needs (for example, the brand, the brief and the target community), never your billing details. Consultant identities are not shared with clients, and client contact details are not shared with consultants.
Professional advisers such as accountants and lawyers, under confidentiality.
Authorities, where the law requires it or to protect rights, safety and security.
A successor business. If our business is transferred to a company we form, or is merged, sold or reorganised, personal data may transfer with it under this policy.
We do not sell personal data, rent lists, or share personal data for targeted advertising.
6. International transfers
We are based in India and many of our providers are in the United States and elsewhere, so your data may be processed outside your country. Where the law requires safeguards for those transfers (for example the EU Standard Contractual Clauses for data from the EU or UK), we rely on them, usually through our providers’ data processing terms. We will not transfer personal data to any country the Government of India restricts transfers to.
7. How long we keep it
| Data | Kept for |
|---|---|
| Outreach contact data | Until you opt out or object, or 24 months after our last contact with no reply. After an opt-out we keep only your email address on a suppression list so we never contact you again |
| Call booking details and call notes for people who don’t become clients | 24 months from the last contact |
| Account data | For the life of the account, then deleted or anonymised within 90 days of closure, except as below |
| Orders, tasks, invoices, payment and ledger records | 7 years, for accounting and tax |
| Brand onboarding files | Deleted 90 days after the engagement ends, or sooner if you ask |
| In-app messages | Life of the organisation’s account plus 1 year |
| Unsubmitted order drafts | 30 days |
| Raw AI answers collected for measurement | 90 days, unless used in a published report or audit, in which case kept for the life of the account |
| Security and audit logs | Up to 7 years for audit logs; 90 days for routine server logs |
| Terms acceptance records | Life of the account plus 7 years |
Where a deletion isn’t yet automatic, we carry it out by scheduled review. We may keep data longer where the law requires it or to resolve a dispute.
8. How we protect it
We use encryption in transit (HTTPS), hashed passwords, database-level access rules so each organisation sees only its own data, private file storage with short-lived links, role-based access for staff and regular security testing. Staff and consultants are bound by confidentiality obligations.
No system is perfectly secure. If a personal data breach happens, we will notify affected people and the relevant authorities as the law requires.
9. Your rights
Depending on where you are, you can ask us to:
- tell you what personal data we hold about you and how we use it, and who we’ve shared it with;
- correct, complete or update it;
- delete it (unless we must keep it, for example invoices);
- withdraw consent you gave;
- stop using it for outreach or other purposes you object to;
- give you a copy in a portable format, or restrict how we use it (GDPR);
- nominate someone to exercise your rights if you die or become incapacitated (DPDP Act).
Email avik@renvoire.com from the address we hold, or tell us how to verify you. We’ll reply within 30 days. There’s no charge.
If you’re not satisfied, you can complain to our Grievance Officer (section 14). In India, after using our grievance process, you can complain to the Data Protection Board of India. In the EU or UK you can complain to your local data protection authority.
If your organisation is our client and you’re one of its staff, some requests about data in your organisation’s account may be passed to your organisation’s account owner.
10. Opting out of our emails
Every outreach email has an unsubscribe link and you can reply “unsubscribe” at any time. We’ll stop within 2 business days. Service emails about your account, orders and invoices continue while you have an account.
11. Content on Reddit and other platforms
Work we deliver is posted publicly on third-party platforms such as Reddit and is governed by those platforms’ terms and privacy policies. Every paid deliverable carries a disclosure. If you believe content we posted is about you, breaks a community’s rules or isn’t properly disclosed, email us with the link and we’ll investigate. We can’t remove content other people posted.
12. Children
Our website and services are for businesses and are not directed at anyone under 18. We don’t knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we’ll delete it.
13. Changes to this policy
We’ll post any changes here and update the date at the top. If a change materially affects how we use personal data we already hold, we’ll tell active clients and account holders by email before it takes effect.
14. Contact and Grievance Officer
- Grievance Officer: Abhishek Pal (Avik P), Founder
- Email: avik@renvoire.com
- Address: Rudrapur, Uttarakhand, India
We acknowledge grievances within 2 business days and resolve them within 30 days.
See also our Terms of Service and Legal Notice.