Privacy Notice

This notice applies to the public website, Revenue Leak Scan requests, authorized accounts, and the managed Revenue Recovery Desk. Depending on the relationship and applicable law, Revenue Reclaim AI may act as a business or controller for account and commercial information, and as a service provider or processor for client-directed recovery data. Contract documents govern client-processor responsibilities where applicable.

Categories may include business and contact details; account, authentication, role, and access records; company configuration; source-system and import metadata; customer, lead, estimate, and opportunity records supplied under written authorization; proposed actions and human decisions; responses, handoffs, outcomes, invoices, payments, refunds, corrections, and verification evidence; audit, security, and diagnostic events; and public-site request information.

The initial controlled pilot is limited to eligible stale estimates. A broader product capability does not itself authorize broader data collection or use.

Information may come from a visitor or client, an authorized read-only source or managed export, authorized users, service providers, or records created while operating the Recovery Desk. It may be used to evaluate readiness, configure and secure the service, identify and review authorized opportunities, prepare controlled follow-up, document decisions, reconcile outcomes, support clients, prevent misuse, comply with obligations, and improve reliability.

Information may be disclosed to authorized client users, personnel operating the service, and approved infrastructure or service providers that perform contracted functions. A current subprocessor inventory must identify each active provider, purpose, relevant data, location information, and activation status. Planned providers do not receive client data merely because they appear on that inventory.

Whether information is sold, shared for cross-context behavioral advertising, or otherwise subject to a jurisdiction-specific opt-out must be confirmed by qualified counsel before this notice becomes effective.

Information is retained only for approved operational, security, contractual, and legal purposes under the versioned retention and deletion schedule. Source records, held imports, operational evidence, audit records, account records, and backups may have different periods. A verified client request, contract end, legal hold, dispute, or incident may change the applicable sequence. Backup copies expire through the approved backup lifecycle rather than ad hoc deletion.

Safeguards are intended to include tenant-scoped authorization, least-privilege roles, server-only credentials, row-level security, audit records, controlled releases, and fail-closed communication paths. No safeguard eliminates all risk. Production access, backup restoration, incident response, and authentication controls must be verified before real data is accepted.

People may request access, correction, deletion, restriction, portability, objection, or appeal where applicable. Identity and authority must be verified before a request is fulfilled. When client data is processed on a client’s instructions, requests may be referred to or coordinated with that client.

The service may use essential authentication, security, preference, and session technologies. Any analytics or non-essential technologies require separate review and disclosure before activation. The service is intended for businesses and is not directed to children. Material changes to an effective notice will be identified by a revised version and effective date, with additional notice where required.