Privacy Policy

Effective date: July 1, 2026

Revup Inc (“Revup,” “we,” “us,” or “our”) provides software that businesses and organizations use to create and operate forms, sweepstakes, contests, giveaways, instant-win experiences, surveys, quizzes, purchase promotions, and other marketing programs (each, a “Promotion,” and collectively, “Promotions”).

This Privacy Policy explains how we collect, use, disclose, and protect personal information when you:

visit revup.com or another website we operate;
create or use a Revup business account;
contact our sales or support teams; or
enter, visit, vote in, submit content to, or otherwise interact with a Promotion powered by Revup.

This policy applies to three groups:

Visitors are people who visit our websites or contact us without using a business account.
Customers are businesses or organizations that use Revup, including their authorized users.
Participants are people who interact with a Customer's Promotion.

1. Revup's role and the Customer's role

A Customer decides how its Promotion operates, what information it asks Participants to provide, why it collects that information, which integrations receive it, how long it keeps it, and whether Participant submissions are displayed publicly.

For personal information Revup handles on the Customer's instructions, the Customer is generally the controller or business and Revup is generally its processor or service provider. The Customer's own privacy policy, Promotion notice, and Official Rules govern the Customer's use of Participant information.

Revup may separately act as a controller or business when we use information for our own account administration, billing, security, fraud prevention, legal compliance, support, and service-level analytics.

If you are a Participant, please review the Promotion's Official Rules and the sponsor's privacy policy. Contact the Promotion sponsor first if you have questions about its use of your information or want to exercise a privacy right relating to a specific Promotion. We will assist the sponsor as required by law and our agreement with it.

2. Information we collect

The information we collect depends on how you interact with Revup and which features a Customer enables.

A. Information from Visitors and Customers

We may collect:

Account and contact information, such as name, email address, phone number, password, profile details, company, website, job information, and account memberships.
Authentication information, such as sign-in records, session identifiers, verification status, security settings, and information received when you choose Google or another supported sign-in method. We do not receive your third-party account password.
Billing and subscription information, such as plan, billing contact, transaction details, tax information, payment status, and identifiers from Stripe, Shopify, or another payment provider. Payment providers, including Stripe and Shopify, process payment-card information under their own privacy policies; Revup does not receive or store payment-card numbers.
Customer content and settings, such as Promotions, forms, Official Rules, designs, files, templates, custom domains, audience or contact lists, workflow content, API activity, and configuration choices.
Integration information, such as connected-store details, account identifiers, access tokens, field mappings, list selections, webhook destinations, and data received from services a Customer connects.
Communications, such as sales inquiries, support conversations, feedback, survey responses, and records of notices we send.
Usage and device information, such as IP address, approximate location derived from IP address, browser, device, operating system, pages or features used, referring URL, timestamps, log data, and error or performance information.

B. Information from Participants

A Customer can configure Revup to collect information such as:

name, email address, phone number, mailing address, and other contact details;
age or date of birth, location, eligibility responses, demographic information, preferences, survey answers, quiz answers, ratings, signatures, and other custom form responses;
marketing preferences and records of consent, including the wording shown when consent was requested;
Promotion entries, entry methods, referrals, social actions, passcodes, coupons, votes, scores, winner status, prize claims, and fulfillment information;
photos, videos, documents, captions, profile information, and other content submitted to a Promotion;
payment, purchase, order, product, and refund information when a Customer enables Stripe, Shopify, or another commerce feature;
email or phone verification results and delivery status;
email and SMS delivery, open, click, unsubscribe, reply, STOP/START, and carrier-status events, depending on the Customer's messaging configuration;
IP address, IP-derived country or region, browser, device, operating system, referring and landing pages, campaign parameters, timestamps, cookies or similar identifiers, and other activity information;
information used to detect duplicate, automated, abusive, or fraudulent entries, referrals, votes, claims, or account activity; and
information requested in a winner claim, such as a shipping address, eligibility affidavit, tax form, identity document, or other information the Customer lawfully requests through a designated Revup feature.

Customers should not use ordinary custom fields to collect highly sensitive or regulated information. Where Revup provides a designated feature for winner, tax, identity, or payment information, Customers must use that feature and comply with applicable law.

C. Information from connected services and other sources

We may receive information from:

Customers, account administrators, Promotion sponsors, and other authorized users;
Google and other identity providers;
Stripe, Shopify, and other billing or commerce providers;
Customer-selected marketing, CRM, email, SMS, automation, and webhook integrations;
social networks or platforms when you or a Customer connects an account or requests an action;
security, fraud-prevention, email-verification, geolocation, and anti-bot services; and
public sources, business data providers, and websites a Customer asks us to analyze for brand setup.

The information received depends on the service, the permissions granted, and the Customer's configuration.

3. How we use information

We may use personal information as appropriate to its source and role to:

provide, host, maintain, secure, and support the Revup service;
create and administer accounts, authenticate users, and manage permissions;
process subscriptions, transactions, and Customer-requested payment features;
operate Customer Promotions, record entries and votes, calculate eligibility or entry totals, run Customer-initiated winner tools, and support Customer-configured prize claims;
create account-scoped contact profiles and connect qualifying activity across a Customer's Promotions;
perform Customer-configured workflows, messages, exports, APIs, and integrations;
deliver transactional, account, Promotion, email, and SMS communications;
verify email addresses or phone numbers and manage unsubscribe or messaging preferences;
detect, investigate, prevent, and respond to spam, bots, duplicate entries, vote manipulation, fraud, security incidents, prohibited activity, and violations of our Terms;
provide support and troubleshoot a Customer or Participant request, which may require authorized personnel to access relevant account or Promotion information;
use Customer-account, Visitor, and separate technical telemetry that does not contain or derive from Customer Content or Participant Data or identify a Participant to measure performance, understand use of the service, generate internal reports, and develop or improve features;
communicate with Customers, Customer account users, prospective Customers, and Visitors about Revup, including product announcements, offers, newsletters, security, billing, and other service or marketing communications;
comply with law, enforce agreements, establish or defend legal claims, and protect Revup, Customers, Participants, and others; and
complete a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality and legal requirements.

Revup marketing emails to Customer account users and prospective Customers include an unsubscribe method as required by law. Unsubscribing from marketing does not stop account, security, billing, or other non-marketing service messages when they remain relevant.

Revup does not send its own marketing text messages to Customers, Customer users, prospects, or Participants. Any SMS Revup sends for its own operations is limited to requested or necessary non-marketing account, authentication, security, or service communications. Participant SMS sent through the platform is configured by the Customer and sent on the Customer's behalf.

We do not use Customer Content or Participant Data to develop or improve our products, market Revup's products to Participants, or train Revup or third-party artificial-intelligence models. This restriction also applies to aggregated or deidentified information derived from Customer Content or Participant Data.

4. Legal bases for processing

Where applicable law requires a legal basis, we rely on one or more of the following:

Contract, when processing is necessary to provide the service or requested feature.
Legitimate interests, such as securing the service, using Customer-account, Visitor, and separate technical telemetry to improve it, preventing fraud, supporting Customers and Participants, and operating our business, when those interests are not overridden by individual rights.
Consent, when we or a Customer ask for consent and consent is the appropriate basis. Consent may be withdrawn for future processing.
Legal obligation, when processing is necessary to comply with law or a valid legal request.

For Customer-directed Participant Data, the Customer determines the applicable legal basis. Participants should contact the Customer for details about its basis for collecting and using information in a Promotion.

5. How we disclose information

We may disclose personal information as follows.

A. Customers and Promotion sponsors

When a Participant interacts with a Customer's Promotion, the Customer can access the information collected through that Promotion, including associated activity, fraud, verification, and analytics information. Information may also be available to the Customer's authorized users, agencies, administrators, and partners according to the Customer's account permissions and arrangements.

If a Customer enables a public gallery, leaderboard, winner announcement, referral feature, or similar public element, the information identified before submission may be displayed publicly. Participants should not submit content they do not want handled as described in the Promotion notice and Official Rules.

B. Service providers

We use service providers to host and secure the service, store files, process payments, deliver communications, provide support, verify contact information, detect abuse, monitor performance, translate content, and perform other operations for us.

Our Subprocessors page identifies the providers that process personal information on our behalf. Our Data Processing Addendum describes the data-protection terms that apply when incorporated into a Customer's agreement with Revup.

C. Customer-selected integrations

A Customer may direct Revup to send Participant Data to third-party services it connects, including marketing, email, SMS, customer-relationship management, ecommerce, automation, and custom-webhook services. The Customer controls the integration and is responsible for its instructions, permissions, notices, consents, and use of information after transfer. The receiving service's terms and privacy policy also apply.

D. Legal, safety, and business disclosures

We may disclose information:

to comply with law, court orders, subpoenas, or lawful government requests;
to protect rights, safety, security, and property;
to investigate fraud, abuse, prohibited Promotions, or Terms violations;
to professional advisers, auditors, insurers, financing sources, and transaction counterparties under appropriate duties; or
as part of a corporate transaction or insolvency process.

E. Technical, aggregated, or deidentified information

We may use technical telemetry and information derived from Customer-account or Visitor activity that has been aggregated or deidentified so that it does not identify an individual. Operational telemetry may contain a Customer, account, or Promotion identifier when needed to measure traffic or capacity, diagnose outages or delivery issues, secure the Service, prevent fraud, or produce internal technical analytics. It does not use a persistent identifier to track a Participant across unrelated Customer Promotions and is not used for Participant marketing, advertising, or cross-customer Participant profiles. We do not use or disclose aggregated or deidentified information derived from Customer Content or Participant Data for product improvement, marketing, or independent business purposes. We will not attempt to reidentify information we maintain as deidentified except to test whether our deidentification measures are effective or as permitted by law.

6. Sale and sharing of personal information

Revup does not sell or rent personal information. Revup does not sell Customer-controlled Participant Data or share it for cross-context behavioral advertising.

Customers may independently use Participant Data for advertising or marketing as described in their own notices. Participants should contact the Customer that sponsored the Promotion about those practices.

7. Cookies and similar technologies

Revup and our providers may use cookies, local storage, pixels, and similar technologies to:

keep users signed in and remember settings;
operate hosted and embedded Promotions;
maintain security and prevent fraud or duplicate activity;
attribute referrals and campaign traffic;
measure website, Promotion, email, and feature performance; and
provide support tools.

Some technologies are necessary for the service to work. Where required, we will request consent before using non-essential technologies. Browser controls can block or delete cookies, but doing so may prevent account, embedded Promotion, referral, or security features from working correctly.

Revup does not currently respond to browser “Do Not Track” signals. Where legally required and technically supported, we will honor recognized opt-out preference signals for the activities to which they apply.

For more information about the technologies Revup uses and the choices available to you, see our Cookie Policy.

8. Data retention

We retain personal information only as long as reasonably necessary for the purposes described in this policy, including to provide the service, follow a Customer's instructions, maintain security and audit records, comply with legal, tax, accounting, and reporting obligations, resolve disputes, and enforce agreements.

Retention depends on the type of information and context:

Customer account information, configuration information, Customer Content, and Participant Data are generally kept while the account is active and for one year after the account is canceled. After that period, we may delete or deidentify the information, subject to the exceptions described below.
A Customer may delete Participant Data or instruct us to delete or return it before the end of that one-year period, subject to applicable law, the Customer's agreement with Revup, and reasonable identity and authority verification.
Once a Customer deletes Participant Data or a Promotion through the Service, that data is no longer available to the Customer, and Revup does not restore it from backups for individual recovery requests.
Temporary uploads and generated exports are kept for short operational periods unless they become part of a Promotion record.
Technical analytics, traffic, error, security, and operational logs are retained for the periods approved in Revup's retention schedule; internal metrics that do not contain or derive from Customer Content or Participant Data may be retained longer.
Billing, audit, security, fraud, messaging-suppression, and legal records may be kept longer when necessary.
Residual copies may remain in protected backups until they are overwritten through the normal backup cycle, but those copies are not used to recover Customer-deleted data.

We consider the amount, sensitivity, purpose, risk, and legal requirements of the information when setting retention periods.

9. Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including access controls, optional two-factor authentication for Customer users, encryption in transit, credential protections, logging, monitoring, and restricted storage for designated sensitive winner documents.

No service or transmission method is completely secure. Customers are responsible for configuring their accounts appropriately, limiting user access, protecting credentials and API keys, using designated secure fields for sensitive information, and promptly notifying us of suspected unauthorized access.

If we confirm that a security incident affected Customer Data, we will notify the affected Customer without undue delay and no later than 24 hours after confirmation, even if our investigation is continuing. The Customer is responsible for notifying Participants or others when it is the controller or business responsible for that data, and we will provide reasonable assistance. Revup may notify Participants or authorities directly when Revup is independently required to do so by law.

10. International data transfers

Revup and our providers may process information in the United States and other countries where privacy laws may differ from those in your location.

When required, we use appropriate safeguards for international transfers, as described in our Data Processing Addendum.

11. Your privacy rights and choices

Depending on where you live and subject to legal exceptions, you may have the right to:

know whether we process your personal information and access it;
request correction or deletion;
receive a portable copy of certain information;
restrict or object to certain processing;
withdraw consent for future processing;
opt out of certain sales, sharing, targeted advertising, or profiling;
appeal a decision on a privacy request; and
lodge a complaint with a privacy or data-protection authority.

We will not discriminate against you for exercising an applicable privacy right.

Participants

For information collected through a specific Promotion, contact the Customer identified as the sponsor in the Promotion or its Official Rules. Because the Customer controls that information, we may forward your request to it or ask for information needed to locate the correct Promotion and verify your identity.

Revup is not the primary intake point for a Participant request concerning Customer-controlled Promotion data. Revup will assist the Customer and will act directly only when independently required by applicable law.

Customers and Visitors

You can update some account information in the service and unsubscribe from Revup marketing using the link in a message. Account, security, billing, and other transactional messages may continue while relevant.

To submit a privacy request concerning Customer-account or Visitor information Revup controls directly, email [email protected] or write to the address in Section 16. We may verify your identity and authority before completing a request. Authorized agents may submit requests where permitted by law, but we may require proof of authorization and identity verification.

12. Email and SMS choices

Customers are responsible for obtaining and documenting any consent required to send Participant marketing emails or text messages. Entering a Promotion does not by itself authorize unrelated marketing where separate consent is required.

Participants can use unsubscribe links in commercial emails and can reply STOP to supported marketing text messages. Transactional or Promotion administration messages may still be sent when legally permitted, such as entry verification, security, winner notification, prize fulfillment, and legally required notices.

13. Children's privacy

Revup is not directed to children under 13, and we do not knowingly collect personal information from a child under 13.

Customers may not use Revup to create a Promotion directed to children under 13 or knowingly collect personal information from children under 13.

Customers are responsible for setting and enforcing any higher minimum age required by the Promotion, prize, product category, social platform, or applicable law. If you believe a child provided information improperly through a Promotion, contact the Promotion sponsor.

14. Third-party websites and services

Revup Promotions and websites may link to or interact with third-party websites, social networks, commerce platforms, and services. Revup does not control their content or privacy practices. Review their terms and privacy policies before providing information or connecting an account.

15. Changes to this policy

We may update this Privacy Policy to reflect changes in our service, practices, or legal obligations. We will post the revised policy and change its effective or last-updated date. Posting the revised policy with the changed date is sufficient notice, except where applicable law requires another form of notice.

16. Contact us

Questions or privacy requests may be sent using the contact information below.

Attn: Legal
Service: Revup

Address:
Revup Inc
320 Boston Post Rd, Suite 180
#1070
Darien, CT 06820

Email: [email protected]

Data protection officer: [email protected]