Privacy Policy

1. Privacy at a Glance

General Notes

The following notes provide a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you. For detailed information on data protection, please refer to our privacy policy listed below this text.

Data Collection on This Website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find its contact details in the “Controller” section of this privacy policy.

How do we collect your data?

Your data is collected when you provide it to us. This may be data you enter in a contact form, for example. Other data is automatically collected or collected with your consent when you visit the website through our IT systems. This is primarily technical data (e.g., internet browser, operating system, or time of page access). This data is collected automatically as soon as you enter this website.

What do we use your data for?

Some of the data is collected to ensure the proper functioning of the website. Other data may be used to analyze your user behavior. If you have given your consent or are already a revitalyze customer, we send you electronic messages about updates, new features and offers from revitalyze. For this purpose, we process in particular your email address and name. You can object to receiving such messages at any time, for example by emailing info@revitalyze.io.

What rights do you have regarding your data?

You have the right at any time to receive free information about the origin, recipient, and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can withdraw this consent at any time with effect for the future. You also have the right to request the restriction of the processing of your personal data under certain circumstances. Furthermore, you have the right to lodge a complaint with the competent supervisory authority. You can contact us at any time regarding this and other questions on data protection.

Analysis Tools and Third-Party Tools

When visiting this website, your surfing behavior may be statistically analyzed with your consent. This is mainly done with so-called analysis programs. Detailed information on these analysis programs can be found in the following privacy policy.

2. Hosting

We run this website on Microsoft Azure in a data centre in Germany (Frankfurt am Main). The provider is Microsoft Ireland Operations Ltd. (Ireland), acting as our processor. When you access the website, Microsoft processes technically necessary access data on our behalf, such as your IP address, the page requested and your browser identifier (user agent). These access data are deleted after seven days at the latest. Our server also logs technical events such as submitted forms and errors, without names, contact details, IP addresses, file names or message contents. The legal basis is our legitimate interest in providing the website securely and reliably (Art. 6(1)(f) GDPR). For transfers to the USA, see “Recipients in third countries at a glance”.

3. General Notes and Mandatory Information

Data Protection

We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy. When you use this website, various personal data is collected. Personal data is data that can be used to personally identify you. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this happens. We point out that data transmission over the Internet (e.g., when communicating via email) may have security gaps. Complete protection of data against access by third parties is not possible.

Controller

The controller for data processing on this website is:
revitalyze FlexCo
Mühltal 43
6341 Ebbs
Austria
Phone: +43 650 4152149
Email: info@revitalyze.io

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data (e.g. names, email addresses).

Storage Period

Unless a more specific storage period has been stated within this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. If you assert a legitimate request for deletion or withdraw consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data.

Storage periods at a glance

• Your cookie choice: 180 days, in your browser and in the “revitalyze_consent” cookie.
• Google Analytics cookies: 180 days. Event data in Google Analytics: at most 14 months.
• Marketing cookies: lifetimes as set by the providers. If you withdraw your consent, we delete the marketing cookies stored under our domain.
• Enquiries through the contact form, the practical guide, the free analysis or the licence request: as long as we need them to handle the enquiry and any resulting business relationship. If a contract results, we keep the records needed for accounting for seven years (section 132 BAO).
• Files uploaded for the free analysis or a licence request: until they are no longer needed for your request; you can request deletion at any time.
• Requests for the free PlanReader trial: a rejected request 90 days after our decision, an approved request twelve months after approval or, if the company account is deleted earlier, together with that account. Proof of acceptance of the trial terms: three years after the trial ends. User account and other trial data: after the trial ends, in accordance with clause 15 of our terms, unless a contract for PlanReader is concluded. Contact details in our CRM system: for as long as we need them for the trial and any resulting business relationship.
• Newsletter: until you unsubscribe.
• Bookings through Calendly: as long as we need them for the appointment and any resulting request.
• Tenderhub and PlanReader applications: see section 6.

Provision of your data

You are not legally or contractually obliged to provide us with personal data. Without the details marked as required, however, we cannot process a request or set up a user account.

Recipients in third countries at a glance

Some of the providers we use may also process data in the USA. These transfers are based on the following:

• Microsoft (website hosting, storage for uploaded files, our applications Tenderhub and PlanReader with their user accounts, our CRM system and email delivery via Microsoft 365): the provider is Microsoft Ireland Operations Ltd. (Ireland). Microsoft Corporation (USA) is certified under the EU-U.S. Data Privacy Framework; Microsoft’s data protection terms also include the EU standard contractual clauses.
• Anthropic (AI features in Tenderhub): Anthropic Ireland, Limited (Ireland). Transfers to the USA are based on EU standard contractual clauses (Art. 46(2)(c) GDPR).
• Google Analytics and Google Ads: Google Ireland Limited (Ireland). Google LLC (USA) is certified under the EU-U.S. Data Privacy Framework.
• Meta Pixel: Meta Platforms Ireland Limited (Ireland). Meta Platforms, Inc. (USA) is certified under the EU-U.S. Data Privacy Framework.
• LinkedIn Insight Tag: LinkedIn Ireland Unlimited Company (Ireland). LinkedIn Corporation (USA) is certified under the EU-U.S. Data Privacy Framework.
• OpenAI Pixel and Conversions API: the recipient is OpenAI Ireland Limited (Ireland) as an independent controller. OpenAI is not certified under the EU-U.S. Data Privacy Framework; according to OpenAI, transfers to the USA are based on the EU standard contractual clauses (Art. 46(2)(c) GDPR).
• HubSpot (newsletter): under HubSpot's terms, the contracting party for companies based in Austria is HubSpot Germany GmbH (Germany). According to HubSpot, HubSpot, Inc. (USA) is certified under the EU-U.S. Data Privacy Framework; HubSpot's data processing agreement also includes the EU standard contractual clauses.
• Calendly (appointment booking): Calendly LLC (USA), certified under the EU-U.S. Data Privacy Framework.
• Resend (email delivery): Plus Five Five, Inc. (USA), certified under the EU-U.S. Data Privacy Framework; Resend's data processing agreement also includes the EU standard contractual clauses.

These details are as of 24 October 2026. You can check whether a US company is certified at www.dataprivacyframework.gov.

Withdrawal of Your Consent to Data Processing

Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. The lawfulness of the processing carried out before the withdrawal is not affected.

Right to Object to Data Collection in Special Cases and Direct Marketing (Art. 21 GDPR)

Right to Lodge a Complaint with the Competent Supervisory Authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, particularly in the Member State of their habitual residence, their place of work, or the place of the alleged violation. The right to lodge a complaint exists without prejudice to other administrative or judicial remedies. In Austria, the competent authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

Right to Data Portability

You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done to the extent that it is technically feasible.

No Automated Decision-Making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

SSL or TLS Encryption

This website uses TLS encryption to protect the transmission of confidential content, such as inquiries you send to us.

4. Data Collection on This Website

Cookies

We store your cookie choice in your browser and in a technically necessary first-party cookie for 180 days (Section 165(3) Austrian TKG 2021, Section 25(2) no. 2 German TDDDG). Analytics and marketing cookies are set only after you have explicitly consented to the respective category (Section 165(3) TKG 2021, Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time through “Cookie Settings” in the footer.

Google Analytics 4

With your explicit consent under Art. 6(1)(a) GDPR, we use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to measure page views, visitor sources and selected interactions such as demo, contact or analysis requests. We do not send names, email addresses, messages, file names or document contents entered into our forms to Google Analytics. Advertising personalization and Google Signals remain disabled; we enable advertising storage only if you have also consented to marketing cookies. According to Google, IP addresses from EU visitors are discarded before storage; processing by Google companies outside the EU nevertheless cannot be completely excluded. Consent is voluntary and may be withdrawn at any time with effect for the future.

Meta Pixel, LinkedIn Insight Tag, Google Ads and OpenAI Pixel

To measure our advertising campaigns, we use the Meta Pixel from Meta Platforms Ireland Limited and the LinkedIn Insight Tag from LinkedIn Ireland Unlimited Company once you have given your explicit consent (Art. 6(1)(a) GDPR). We measure page views and selected interactions such as starting a demo booking. We do not transmit content entered in form fields to these providers. With the same consent, Google Analytics also sets advertising cookies that we use to measure the success of our Google ads. We ourselves use the data of all providers named in this section only to measure the success of our ads; we do not build audiences for advertising (e.g. remarketing) from it.

If you reach us through one of our ads (e.g. on Google, LinkedIn or in ChatGPT), we store the ad’s click ID together with your enquiry. This shows us which ads lead to enquiries. With the same consent, we may use this click ID to report your enquiry back to the respective advertising network (Google or LinkedIn) so that it is counted there as a result of the ad; we transmit the click ID, the time and the type of event, but no content of your enquiry.

We and Meta are joint controllers for collecting the data on our website and transmitting it to Meta (Art. 26 GDPR); the agreement is available at https://www.facebook.com/legal/controller_addendum. For the LinkedIn Insight Tag, LinkedIn’s terms make us and LinkedIn each an independent controller. After transmission, Meta and LinkedIn process the data as controllers for their own purposes, such as delivering ads and improving their services; they may link the data to an account you hold with Facebook, Instagram or LinkedIn. For details see https://www.facebook.com/privacy/policy and https://www.linkedin.com/legal/privacy-policy.

With the same consent, the OpenAI Pixel of OpenAI Ireland Limited, Dublin (Ireland), measures page views (only the page path), the start of a demo booking, and enquiries and bookings. This shows us whether ads in ChatGPT lead to visits, enquiries or bookings. For this, the pixel stores cookies containing the ad’s click ID (30 days), a browser ID (365 days) and your consent (30 days). It can also transmit contact details you enter into forms on our website (e.g. name, email address or phone number) to OpenAI in hashed form from your browser (automatic advanced matching).

With the same consent, our server also reports page views and enquiries completed through our forms directly to OpenAI (Conversions API), so they are counted even if your browser blocks the pixel. It transmits the page path, the ad’s click ID and the pixel’s browser ID (where present), your IP address and your browser identifier (user agent), and for enquiries also your email address in hashed form (SHA-256).

OpenAI Ireland Limited is an independent controller for this data and not our processor. According to OpenAI, it also uses the data for its own purposes, such as developing and improving its services, measuring the effectiveness of advertising and showing ChatGPT users more relevant ads; in doing so, OpenAI may link the data to an account you hold with OpenAI. OpenAI is not certified under the EU-U.S. Data Privacy Framework; according to OpenAI, transfers to the USA are based on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). All of these providers may also process data outside the EU (see “Recipients in third countries at a glance”). You can withdraw your consent at any time through “Cookie Settings” in the footer.

Contact Form and Inquiry via Email, Phone, or Fax

If you contact us via the contact form, by email, phone, or fax, your inquiry including all resulting personal data (name, email address, inquiry) will be stored and processed by us for the purpose of processing your request. The legal basis is Art. 6(1)(b) GDPR if your inquiry relates to a contract or pre-contractual measures, otherwise our legitimate interest in answering inquiries (Art. 6(1)(f) GDPR). We forward enquiries from the contact form to our mailbox through our email service provider Resend, which acts on our behalf (see “Email Delivery via Resend”). To follow up, we record enquiries in our CRM system, which we run ourselves on Microsoft Azure in Germany. Beyond that, we only pass on your data if we are legally obliged to or you have consented.

Practical guide download

When you request our practical guide, we process your name and email address together with any company and phone details you provide voluntarily to make the download available and process your request. The legal basis is Art. 6(1)(b) GDPR. As with the contact form, we forward your details to our mailbox through Resend.

Free Analysis and Licence Request

If you send us documents or plans for a free analysis or with a licence request, we process the uploaded files and the details you enter in the form (e.g. name, email address, company and message) to handle your request and to prepare the analysis or an offer. The legal basis is Art. 6(1)(b) GDPR. We store the files and your details with our processor Microsoft (Microsoft Ireland Operations Ltd.) in a data centre in Germany. We forward the details you enter in the form to our mailbox through Resend (see “Email Delivery via Resend”). If we analyse your files, we do so in our applications Tenderhub (tender and contract documents) or PlanReader (plans); for the AI services used there and for processing outside the EU, see section 6. We delete the files as soon as they are no longer needed for your request; you can request deletion at any time.

Free PlanReader Trial

If you request a free trial of our PlanReader application through our website, we process your first and last name, your business email address, your company, your phone number (optional), the language of your request, and the version and time of your acceptance of the trial terms. We process these data to review and decide on your request, to set up the trial access, to communicate with you in connection with the trial and to offer your company further use of PlanReader. We use your phone number only for queries about your request and the trial.

Once your request has been approved, we set up an account for your company and a user account for you and invite you to PlanReader. If you sign in with your organisation’s Microsoft account, Microsoft, as the provider of that account, transmits to us your name, your email address and the identifiers of your account and your organisation. During the trial, we process your account, sign-in and usage data, including the extent to which your company has used the trial allowance, in order to provide the application to you, to enforce the limits of the trial, to notify you by email about your analyses, to support your company and to discuss further use with it.

The legal basis for reviewing your request, setting up access and running the trial is Art. 6(1)(b) GDPR insofar as you request the trial as an entrepreneur for yourself, for example as a sole trader. If you act for a company, for example as one of its employees, the legal basis is our legitimate interest in initiating and running the trial with that company (Art. 6(1)(f) GDPR). Insofar as we offer you or your company further use of PlanReader, the legal basis is our legitimate interest in direct marketing to business customers (Art. 6(1)(f) GDPR); you may object to this at any time.

Our processor is Microsoft Ireland Operations Ltd. (Ireland): we run the application, the user accounts and our CRM system, into which we transfer your contact details, on Microsoft Azure in data centres in the EU, send emails to you through Microsoft 365 and use Microsoft Entra for sign-in. We forward your request to our mailbox through our processor Resend (see “Email Delivery via Resend”). If you arrange a call with us from within the application, we transmit your name and email address to Calendly so that the booking form is pre-filled; in all other respects, the “Calendly” section applies. For transfers to the USA, see “Recipients in third countries at a glance”. Beyond that, we pass on your data only if we are legally obliged to do so or you have consented.

We process the plans you upload during the trial, your messages to the plan assistant and the results on behalf of your company under the data processing agreement (DPA, available at revitalyze.io/terms); in this respect, your company is the controller. Annex ./2 of the DPA lists the sub-processors. These data are not used to train AI models.

We delete a rejected request 90 days after our decision and an approved request twelve months after approval or, if your company’s account is deleted earlier, together with that account. As proof of your acceptance of the trial terms, we keep your name, your email address, your company and the version and time of acceptance until three years after the end of the trial (legitimate interest in being able to prove and defend legal claims, Art. 6(1)(f) GDPR). We delete your user account and the other data of the trial after it ends (clause 5 of the trial terms) in accordance with clause 15 of our terms, unless your company concludes a contract for PlanReader. We keep your contact details in our CRM system for as long as we need them for the trial and any resulting business relationship.

Email Delivery via Resend

We forward requests from our forms (contact form, practical guide, free analysis, licence request and the request for the free PlanReader trial) to our mailbox by email. For this we use the Resend service of Plus Five Five, Inc. (USA) as our processor. The emails contain the details you enter in the form and, for uploaded files, the file names and time-limited download links. Resend is certified under the EU-U.S. Data Privacy Framework; Resend's data processing agreement also includes the EU standard contractual clauses.

Question "How did you hear about us?"

After an enquiry or a demo booking, you can optionally tell us how you heard about us. We link your answer to your enquiry or booking to understand how prospective customers find us. The legal basis is our legitimate interest in targeting our marketing (Art. 6(1)(f) GDPR).

Data from publicly available sources

To handle your enquiry, we supplement your details with information about your company (e.g. industry, size and registered office) from publicly available sources such as company websites and public registers. The legal basis is our legitimate interest in handling enquiries efficiently (Art. 6(1)(f) GDPR).

HubSpot

We use HubSpot to manage our newsletter sign-ups. When you sign up for the newsletter, our server sends your email address and the address of our website to HubSpot. HubSpot processes the data on our behalf. Under HubSpot's terms, the contracting party for companies based in Austria is HubSpot Germany GmbH; the data may also be processed by HubSpot, Inc. in the USA (see “Recipients in third countries at a glance”).

Calendly

We use Calendly from Calendly LLC, 271 17th St NW, Ste 1000, Atlanta, Georgia, 30363, USA, for booking appointments. Only when you start an appointment booking does your browser load Calendly's booking calendar from Calendly's servers, embedded in our website or as Calendly's own booking page. In doing so, Calendly receives technical data such as your IP address. We pass campaign details from the page address (UTM parameters) to Calendly so that we can attribute the booking to a campaign. The booking calendar contains Calendly's own cookie notice. Without your consent in that notice, Calendly loads only services it uses to run and secure the booking calendar: Cloudflare (protection against automated access; cookies for the session or 30 minutes), Stripe (payment processing and fraud prevention; cookie of up to 400 days), Google reCAPTCHA, Google sign-in and an error-monitoring service; to our knowledge, Calendly also processes device characteristics for fraud prevention. Calendly loads analytics and marketing services (e.g. Google Analytics, Meta Pixel, session recording) only if you consent in Calendly's cookie notice; you give that consent to Calendly, and we do not receive this data. Loading the booking calendar after your click is necessary for the appointment booking you requested (Section 165(3) Austrian TKG 2021, Section 25(2) no. 2 German TDDDG). The legal basis is Art. 6(1)(b) GDPR (scheduling an appointment at your request) and, for the security functions, Art. 6(1)(f) GDPR (protecting the booking function against abuse). When you book an appointment, Calendly processes the details you enter in the booking form (e.g. name, email address and appointment) as our processor and makes them available to us so that we can hold the appointment. Calendly is itself the controller for processing for its own purposes (security, fraud prevention, optional services); see https://calendly.com/legal/privacy-notice. Calendly is certified under the EU-U.S. Data Privacy Framework.

5. Newsletter

If you subscribe to our newsletter, we use your email address to send you news about Tenderhub and PlanReader, new features and offers from revitalyze, and industry insights. We only send the newsletter with your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time via the unsubscribe link in the newsletter or by emailing info@revitalyze.io; this does not affect the lawfulness of processing before the withdrawal. To sign you up, we send your email address to HubSpot (see “HubSpot”). We use your email address for the newsletter until you unsubscribe. We send customers information about similar products of our own without separate consent (section 174(4) TKG 2021, Art. 6(1)(f) GDPR); you can object to this at any time free of charge.

6. Our Applications Tenderhub and PlanReader

This section applies to our applications Tenderhub at tenderhub.revitalyze.io and PlanReader at planreader.revitalyze.io (each the “platform”). Both applications are operated separately; the following information applies to the application you use. We are the controller for user account data and for the use of the platform. The customer concerned is the controller for the content that customers upload to or create in the platform (e.g. tender documents, plans, chats and results); we process it only on the customer's behalf under the data processing agreement (DPA) that we conclude with every customer (available at revitalyze.io/terms). The customer provides information about this, for example in your company's privacy notice.

What data we process

• Account data: your email address, the link to your company, account status and permissions, the times of registration and last activity, and, if you sign in with a password, your password, which we store only as a hash. If you sign in with your organisation's Microsoft account (Microsoft Entra ID), Microsoft confirms the sign-in to us with your email address and your organisation's identifier.
• Usage data: information about which features of the platform you use and when.
• Log and telemetry data: technical data on requests to the platform, errors and performance values.
• Emails and support: platform emails, for example to confirm an account, to reset a password or about analyses, and support requests and feedback you send us through the platform.
• Contract and billing data: for example, names and contact details of contact persons, billing details and your company's usage.

Purposes and legal bases

We process this data to provide the platform to you, sign you in, control access to projects, notify you and provide support. The legal basis is the contract with you (Art. 6(1)(b) GDPR). If you use Tenderhub or PlanReader as an employee of a customer, the legal basis is our legitimate interest in performing the contract with your company (Art. 6(1)(f) GDPR). We use log and telemetry data to operate the platform securely, detect misuse and fix errors (legitimate interest, Art. 6(1)(f) GDPR). During a free trial or pilot project, we also evaluate usage data to support your company and to discuss further use with it (legitimate interest, Art. 6(1)(f) GDPR). We process contract and billing data to perform the contract and to meet our legal obligations (Art. 6(1)(b) and (c) GDPR). We name paying customers as references with their company name and logo unless they object (clause 13.4 of our terms; legitimate interest, Art. 6(1)(f) GDPR).

Recipients and processing locations

We run Tenderhub and PlanReader on Microsoft Azure; the provider and processor is Microsoft Ireland Operations Ltd. (Ireland). We store the platform's data in data centres in the EU (Germany and Sweden). For signing in with Microsoft we use Microsoft Entra ID, and for platform emails Microsoft 365. For the AI features, we use AI services of Microsoft (Tenderhub and PlanReader) and of Anthropic Ireland, Limited (Ireland) (Tenderhub only) as processors; inputs and results may also be processed outside the EU, in particular in the USA. Your data is not used to train AI models. If you switch on web search in the Tenderhub chat, we send only your search queries to Microsoft's “Grounding with Bing Search” service, no files and no chat history; Microsoft processes the search queries as an independent controller under the Microsoft Privacy Statement, including outside the EU. Transfers to the USA are based, for Microsoft, on the EU-U.S. Data Privacy Framework, under which Microsoft is certified, and on the EU standard contractual clauses, and for Anthropic on the EU standard contractual clauses (Art. 46(2)(c) GDPR).

Storage period

We keep account data for as long as your account exists. After the contract with your company ends, we delete the data under clause 15 of our terms (data export, switching and deletion); backups are deleted no later than 60 days after that deletion. Log and telemetry data are deleted automatically after 90 days. We keep accounting records for seven years (section 132 BAO).