Privacy Policy

This Privacy Policy explains how Reva ("Reva", "we", "us" or "our") collects, uses, discloses and protects personal data when you visit revaagent.com (the "Website"), book a demo or contact us, and when a real estate agency or broker (a "Client") uses Reva to respond to enquiries on its WhatsApp Business number (the "Service"). It also explains the choices and rights available to you.

Reva is a text-based conversational AI agent for real estate agencies and brokers in the United Arab Emirates. It operates exclusively through Meta's official WhatsApp Business Platform and is designed to process only the personal data needed to qualify property enquiries and hand them over to a human broker.

Key points

• Official API only. Reva connects to WhatsApp exclusively through Meta's official WhatsApp Business Platform (Cloud API). We never automate personal WhatsApp accounts or WhatsApp Web sessions, and we never ask for WhatsApp login credentials.
• Coexistence, with the broker in control. Through Meta's coexistence model, a Client keeps using the WhatsApp Business app on the same number. Up to 180 days of prior chat history is shared with Reva only after verification and only if the broker chooses to share it.
• Qualification, not decisions. Reva qualifies buyers and tenants and hands them over to the broker. It does not set prices, generate its own rate quotations, negotiate or make any decision with legal or similarly significant effect.
• Security by design. Data is protected with encryption in transit and at rest, role-based access control, per-Client data isolation and continuous monitoring.
• No sale of personal data. We do not sell personal data, and we do not use WhatsApp conversations for advertising.

1. Who we are and our role

Reva acts in two capacities, depending on the data concerned:

• Data controller for personal data collected through the Website, demo bookings and direct enquiries to us, and for Client account data.
• Data processor (service provider) for the WhatsApp conversations between a Client and the buyers, tenants and other people who contact that Client ("End Users"). The Client is the data controller for these conversations, and we process End User data only on the Client's documented instructions and for the purpose of providing the Service.

If you are an End User, the privacy notice of the agency you messaged also applies to you, and requests about your personal data should be directed to that agency first. We will assist the agency in responding.

2. Personal data we collect

2.1 Website visitors

• Usage data. We use Vercel Web Analytics to understand how the Website is used: pages viewed, referring website, approximate country derived from the request, device and browser type, and interactions such as clicks on "Get Free Demo" or WhatsApp buttons. Vercel Web Analytics does not use cookies; visits are counted using a short-lived, anonymised identifier that does not identify you personally.
• Technical logs. Our hosting provider records standard server logs (such as IP address, user agent and timestamps) for security, abuse prevention and reliability.

2.2 Demo bookings and enquiries

• When you book a demo through our Calendly scheduler: your name, email address, the time you select and any information you choose to add.
• When you contact us by WhatsApp or email: your name, phone number or email address, and the content of your message.

2.3 Clients (agencies and brokers)

• Business and contact details of the agency and its authorised users.
• WhatsApp Business account identifiers provided through Meta's onboarding flow (such as the WhatsApp Business Account ID, phone number ID and display name), and the access tokens Meta issues for the Cloud API.
• Property inventory, brochures and other listing materials the Client provides.
• Calendar connection details where the Client chooses to connect Google Calendar or Microsoft Outlook, limited to the permissions needed to create and manage viewing appointments.
• Dashboard activity (such as conversation takeovers and hand-backs) and service metrics (such as lead funnel figures and estimated broker hours saved).

2.4 End Users (buyers, tenants and other enquirers)

When an End User messages a Client's WhatsApp Business number, Reva processes, on the Client's behalf:

• the End User's WhatsApp profile name and phone number;
• the text content of messages exchanged with the Client's number, and message metadata (timestamps and delivery and read status);
• qualification details shared in the conversation, such as intent (buy or rent), budget range, preferred areas, property type, ready or off-plan preference and timeline;
• property listing links or reference numbers the End User shares, for example from Bayut or Property Finder;
• viewing appointments booked, the language of the conversation and the lead score assigned to the enquiry.

Reva is not designed to request special category data (such as health, religious or biometric data), government identification numbers or payment card details, and Clients must not configure it to do so.

3. WhatsApp Business Platform and Meta coexistence

Official Cloud API. Reva connects to WhatsApp exclusively through Meta's official WhatsApp Business Platform (Cloud API), using the Client's own WhatsApp Business number and access credentials issued by Meta through its official onboarding flow (Embedded Signup). Messages are transmitted through Meta's infrastructure and are also subject to the WhatsApp Business Terms of Service and Meta's privacy policies.

Coexistence. Reva supports Meta's coexistence model, which lets a Client keep using the WhatsApp Business app on its phone while the same number is connected to the Cloud API. Messages the broker sends from the app are synchronised so that the conversation record stays complete, and the broker can reply personally at any time.

Optional 180-day chat history. During coexistence onboarding, Meta allows a business to share up to 180 days (six months) of existing WhatsApp Business app chat history with its connected solution provider. Reva receives this history only when both of the following apply:

1. the Client's business and phone number have been verified through Meta's onboarding flow; and
2. the Client expressly chooses to share the history during onboarding.

Sharing chat history is entirely at the broker's discretion and can be declined without affecting the core Service. Where it is shared, the history is used solely to give Reva context for that Client's existing conversations (for example, so a buyer is not asked again for details they have already provided), is isolated to that Client's account and is deleted in accordance with Section 8.

Opt-in and messaging rules. Clients are responsible for having a lawful basis, and any opt-in required by the WhatsApp Business Messaging Policy, to message their End Users. Reva primarily responds to conversations initiated by End Users.

No personal account access. Reva never accesses personal WhatsApp accounts, WhatsApp Web sessions or a broker's mobile device, and never requests WhatsApp login credentials.

4. How Reva's AI works, and its limits

Reva is a text-based conversational AI agent. It reads and writes text messages on a Client's WhatsApp Business number; it does not place or receive voice calls.

What Reva does

• Replies to enquiries and asks qualifying questions, one at a time, in the End User's language.
• Matches enquiries to properties in the Client's own inventory and shares the Client's brochures.
• Proposes and books viewings in the Client's connected calendar.
• Summarises and scores each enquiry, and hands the conversation over to a human broker.

What Reva does not do

• It does not set, change or negotiate prices, rents, fees or commissions.
• It does not generate self-determined rate quotations, valuations or offers. Any price or availability Reva shares is taken from the inventory the Client provides.
• It does not approve or reject buyers or tenants, assess creditworthiness, or make any decision that produces legal or similarly significant effects for an End User.
• It does not sign, accept or conclude contracts, and it does not collect payments.

Human oversight. Every conversation is visible to the Client in real time. A broker can take over any conversation at any moment, and all decisions on pricing, negotiation, offers, contracts and sale or tenancy terms are made by the Client's human brokers. End Users can ask to speak to a person at any time. Lead scores are indicative prioritisation aids for brokers and are never used to refuse service to anyone.

AI service providers. To generate replies, relevant message text is processed by AI model providers acting as our sub-processors under contractual confidentiality and data protection terms. We do not permit these providers to use Client or End User data to train their general-purpose models, and we do not use End User conversations to train general-purpose AI models.

5. How we use personal data, and our legal bases

We do not sell personal data, and we do not use WhatsApp conversation content for advertising or for profiling unrelated to the Service.

6. How we share personal data

• With the Client. End User data belongs to the Client and is available to the Client's authorised users in the Reva dashboard.
• With sub-processors and service providers, each bound by confidentiality and data protection obligations and permitted to process data only on our instructions:
  • Meta Platforms, for the WhatsApp Business Platform;
  • cloud hosting and infrastructure providers;
  • AI model providers, to generate replies from message text;
  • Google and Microsoft, only where a Client connects Google Calendar or Outlook, to create viewing appointments;
  • Calendly, for demo scheduling on the Website;
  • Vercel, for Website hosting and privacy-friendly analytics.
• For legal reasons, where required by law, regulation, court order or a competent authority, or where necessary to protect the rights, safety and security of our Clients, End Users, Reva or others.
• In a business transfer, such as a merger, acquisition or sale of assets, subject to the protections in this Policy.

A current list of sub-processors is available to Clients on request.

7. International data transfers

Some of our service providers, including Meta, may process personal data outside the United Arab Emirates. Where personal data is transferred outside the UAE, we rely on the transfer mechanisms permitted under applicable law, such as contractual safeguards or, where appropriate, consent, and we apply the security measures described in Section 9.

8. Data retention

• Client account data is kept for the duration of our agreement and for a limited period afterwards where needed for legal, accounting or dispute-resolution purposes.
• End User conversation data and any synced chat history are kept for the Client, in accordance with its instructions, for as long as the Client's account is active. They are deleted when the Client deletes them, closes its account or asks us to delete them, unless a longer retention period is required by law.
• Demo and enquiry data is kept for as long as needed to respond and follow up, and is then deleted or anonymised.
• Website analytics are held in aggregated, anonymised form.

Backups are overwritten on a rolling basis, and deleted data is removed from backups in the ordinary course of that cycle.

9. Security and compliance

Reva is built with security and privacy by default and maintains technical and organisational measures aligned with recognised industry practice and applicable data protection law, including:

• Official, token-based access. WhatsApp access uses Meta-issued access tokens through the Cloud API. No WhatsApp passwords or personal device sessions are ever collected or stored.
• Encryption. Personal data is encrypted in transit using TLS 1.2 or higher and encrypted at rest.
• Access control. Role-based access control, the principle of least privilege and authenticated dashboard access. Internal access to personal data is limited to what is necessary for support and security, and is logged.
• Data isolation. Each Client's data, including any synced chat history, is logically segregated from other Clients' data.
• Secrets management. API keys and access tokens are held in secured secret stores and rotated.
• Monitoring and incident response. Continuous monitoring and logging, and a documented incident response process. We notify affected Clients, and the competent authority where required, of personal data breaches without undue delay.
• Data minimisation and vendor due diligence. We collect only what the Service needs, and we assess the security and privacy practices of our sub-processors.

We process personal data in accordance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and other applicable laws, including, where applicable, the data protection laws of the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM). We also operate in line with the WhatsApp Business Terms of Service, the WhatsApp Business Messaging Policy and Meta's Platform Terms.

No method of transmission or storage is completely secure, but we continually review and improve our safeguards.

10. Your rights

Depending on the law that applies to you, you may have the right to:

• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data deleted;
• restrict or object to certain processing;
• receive your data in a structured, machine-readable format;
• withdraw consent at any time, without affecting processing carried out before the withdrawal;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (Reva does not make such decisions, as explained in Section 4); and
• lodge a complaint with the UAE Data Office or another competent supervisory authority.

How to exercise your rights. Website visitors and Clients can email us at shivam@revaagent.com. End Users should contact the agency they messaged; you may also email us and we will help direct your request. We will verify your identity before acting on a request and respond within the period required by applicable law.

11. Cookies and similar technologies

• The Website does not use advertising or cross-site tracking cookies.
• Vercel Web Analytics is cookieless.
• The Calendly scheduler on our demo page is provided by Calendly and may set cookies that are necessary for scheduling when you use it. Calendly's privacy notice applies to that interaction.
• WhatsApp links open WhatsApp, which is governed by Meta's privacy policy.

12. Children

The Website and the Service are intended for businesses and adults. They are not directed at anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Changes to this Policy

We may update this Policy to reflect changes to the Service, our practices or the law. The "Last updated" date at the top shows when it was last revised. We will notify Clients of material changes before they take effect.

14. Contact us

For questions about this Policy or our data practices, contact:

• Email: shivam@revaagent.com
• WhatsApp: +91-7889303305
• Website: revaagent.com