Privacy Policy

Reava ("Reava", "we", "us", or "our") is operated by Batuhan Bekir Gultekin, trading as BATU Consulting, a sole proprietor (Einzelunternehmen) established in Germany, and provides an AI-powered product development environment at reava.co (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard personal data when you access or use our Service, in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

By creating an account or using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Service.

The controller responsible for the processing of your personal data within the meaning of Art. 4(7) GDPR is:

• Batuhan Bekir Gultekin, trading as BATU Consulting
• Scharnhorststraße 4F
• 10115 Berlin, Germany
• Email: privacy@reava.co

We are not required to appoint a Data Protection Officer under Art. 37 GDPR and have not done so. For any questions, concerns, or requests related to this Privacy Policy, please contact us at privacy@reava.co.

We use the information we collect for the following purposes, each grounded in a lawful basis under the GDPR:

• Provide, operate, and maintain the Service (Art. 6(1)(b) — performance of contract)
• Process payments and manage subscriptions and credit balances (Art. 6(1)(b) — performance of contract)
• Analyse and cluster your connected feedback signals using AI models (Art. 6(1)(b) — performance of contract)
• Generate machine-readable product specifications and AI insights (Art. 6(1)(b) — performance of contract)
• Authenticate users and secure your workspace (Art. 6(1)(f) — legitimate interest / Art. 6(1)(b))
• Send transactional emails such as account confirmations, invoices, and password resets (Art. 6(1)(b) — performance of contract)
• Send product update and marketing emails (Art. 6(1)(a) — consent, where required)
• Monitor Service performance, diagnose bugs, and improve reliability (Art. 6(1)(f) — legitimate interest)
• Conduct anonymised, aggregated analytics to understand usage patterns and improve the product (Art. 6(1)(f) — legitimate interest)
• Comply with legal obligations such as tax, accounting, and fraud prevention (Art. 6(1)(c) — legal obligation)

We do not sell your personal data. We do not use your workspace signal data or AI Outputs to train any publicly shared or third-party AI model.

We share information only as described below. We do not sell, rent, or trade personal information.

We retain personal data only for as long as necessary to provide the Service and to comply with our legal obligations:

• Account data is retained for the duration of your account and for up to 90 days after deletion.
• Workspace signal data and AI Outputs are retained while your account is active and deleted within 30 days of a verified deletion request.
• Invoices and accounting records are retained for up to 10 years as required by German commercial and tax law (§ 257 HGB, § 147 AO).
• Server logs are retained for up to 90 days for security and debugging purposes.

You may request earlier deletion of your data at any time (see Section 8), subject to the statutory retention periods above.

We implement industry-standard technical and organisational measures to protect your data, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Row-level security on all workspace-scoped database queries
• API key and OAuth token storage using server-side secrets, never exposed client-side
• HMAC-signed internal service tokens for background processing
• Regular security reviews and penetration testing

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee its absolute security.

Under the GDPR, you have the following rights regarding your personal data:

• Access (Art. 15): Request a copy of the personal data we hold about you.
• Rectification (Art. 16): Request that we correct inaccurate or incomplete data.
• Erasure (Art. 17): Request that we delete your personal data, subject to legal retention obligations.
• Portability (Art. 20): Request your data in a structured, commonly used, machine-readable format.
• Restriction (Art. 18): Request that we restrict processing of your data in certain circumstances.
• Objection (Art. 21): Object to processing based on our legitimate interests; you may object to direct marketing at any time.
• Withdraw Consent (Art. 7(3)): Where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us at privacy@reava.co. We will respond within one month, extendable by two further months for complex requests in accordance with Art. 12(3) GDPR. We may need to verify your identity before fulfilling a request.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence, place of work, or the place of an alleged infringement (Art. 77 GDPR). Our competent supervisory authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

Reava is operated from Germany, and personal data is, as a rule, processed on servers located within the European Union or the European Economic Area (EEA).

Some of our sub-processors (see Section 5) are established in the United States or may process data there. Where personal data is transferred to a country outside the EEA that has not received an EU adequacy decision, we rely on appropriate safeguards under Art. 46 GDPR — in particular the European Commission's Standard Contractual Clauses (SCCs) — and, where applicable, on the EU–U.S. Data Privacy Framework. You may request a copy of the relevant safeguards by contacting privacy@reava.co.

We use cookies and similar technologies to operate and improve the Service:

• Essential cookies: Required for authentication, session management, and security. Cannot be disabled.
• Preference cookies: Remember your settings and preferences across sessions.
• Analytics cookies: Help us understand how users interact with the Service (using privacy-respecting, aggregated analytics).

Non-essential cookies are only set with your consent in accordance with § 25 TDDDG. You can control non-essential cookies through your browser settings or our cookie preference centre (accessible from the footer of our website). Disabling essential cookies may prevent the Service from functioning correctly.

The Service is intended for use by businesses and professionals and is not directed at children under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected such information, we will take steps to delete it promptly. If you believe a child has provided us with personal data, please contact us at privacy@reava.co.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (to the address on your account) or by displaying a prominent notice within the Service at least 14 days before the change takes effect. The "Last Updated" date at the top of this document reflects the most recent revision.

Your continued use of the Service after the effective date of a revised Privacy Policy constitutes your acceptance of the changes.

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us:

• Email: privacy@reava.co
• Website: reava.co/privacy
• Post: Batuhan Bekir Gultekin, trading as BATU Consulting, Scharnhorststraße 4F, 10115 Berlin, Germany