1. Who is the data controller
The data controller for Rezva account, billing, website, support, and platform-security data is MAB Labs LLC, a Wyoming limited liability company with its registered address at 30 N Gould St, Ste N, Sheridan, WY 82801, United States. For any data-protection question or to exercise the rights described below, contact our privacy team at privacy@rezva.online or by post at the registered address above.
For end-customer data processed through a tenant business's Rezva workspace, the tenant business is normally the controller and Rezva acts as processor under the Data Processing Agreement.
2. Scope
This policy applies to personal data processed when (a) you visit our marketing website, (b) you sign up for and use the Rezva platform as a business owner or staff user, or (c) your end-customers interact with the Rezva AI receptionist on WhatsApp/SMS through your business.
3. Categories of personal data we process
- Account data - name, email, password hash, locale, role, and tenant membership.
- Tenant business data - business name, phone, opening hours, services, staff records, settings, and subscription details.
- Booking data - end-customer names, phone numbers, appointment times, services, and notes.
- Message content - WhatsApp/SMS inbound and outbound messages routed through the AI receptionist, including transcripts retained for support, security, and quality review.
- Technical data - IP address, browser user-agent, device and session data, audit logs, and security events.
4. Purposes and legal bases
We process personal data for the following purposes:
- Provide, secure, maintain, and improve the Service, including account access, bookings, messaging, AI replies, notifications, support, and billing.
- Comply with legal obligations such as tax, accounting, payment, sanctions, abuse, and security obligations.
- Detect fraud, abuse, spam, unauthorized access, and security incidents in our legitimate interest and the legitimate interests of our customers.
- Send transactional service emails. Marketing emails are sent only where permitted by applicable law and can be opted out of at any time.
5. How we use AI
The Rezva AI receptionist analyzes inbound WhatsApp/SMS messages to draft or send replies on behalf of the tenant business. Message content may be sent to an AI model provider for processing. We do not use Customer Data or end-customer message content to train third-party foundation models unless a separate agreement expressly allows it.
AI replies are probabilistic and may be wrong. Tenants remain responsible for their business policies, appointments, pricing, services, and customer communications. Rezva is not intended for emergency, medical, legal, financial, employment, credit, insurance, or other regulated high-risk decisions unless a separate written agreement says otherwise.
6. Recipients and processors
We share personal data with processors and service providers that help us run Rezva:
- Cloud hosting and database - Hetzner Online GmbH, currently in Falkenstein, Germany (fsn1), for the application servers, database, and internal services.
- Backup and object storage - Backblaze B2 Cloud Storage, EU Central / Amsterdam (eu-central-003), for encrypted off-provider backups and object storage where enabled.
- AI model provider - Microsoft Azure OpenAI in the configured Azure deployment region, for AI inference.
- WhatsApp Business Platform (Meta) and Twilio where enabled - for WhatsApp/SMS message delivery, delivery events, and verification flows.
- Email delivery and inboxes - Resend or the configured SMTP sender for transactional notifications, and Zoho Mail for Rezva support, privacy, and legal inboxes.
- Payment processing - Stripe and/or Paddle, depending on the billing configuration, for subscription billing, invoices, tax, and payment processing.
- Security, logging, analytics, and secrets - Sentry where enabled, self-hosted Grafana/Prometheus/Loki on Hetzner, and Infisical Cloud for secrets management.
Each processor is bound by contractual terms requiring confidentiality, security, limited use, and compliance with applicable data-protection laws.
7. International transfers
MAB Labs LLC is based in the United States and may use providers located in the United States, the European Union, the United Kingdom, Morocco, or other countries where our providers operate. This means personal data may be processed outside the country where you or your end-customers are located.
Where required, we use appropriate safeguards such as data processing agreements, Standard Contractual Clauses, transfer addenda, and vendor security commitments. For Moroccan tenants, Rezva can provide a tenant compliance support pack, including transfer language and sub-processor details, so the tenant can assess any local CNDP obligations that apply to its own use of the Service.
8. Retention
- Account data: retained for the duration of your subscription plus a reasonable period for legal, security, and accounting needs.
- Booking data and message content: retained according to the tenant's configuration and Rezva's retention schedule, then deleted or anonymized unless legal retention applies.
- Backups: encrypted backup copies are retained on a rolling basis according to the backup schedule.
- Audit logs: retained for security, fraud prevention, compliance, and troubleshooting according to the applicable log retention schedule.
9. Your privacy rights
Depending on where you are located, you may have rights to access, correct, delete, export, restrict, or object to processing of your personal data, and to lodge a complaint with the privacy regulator that has authority over your country or territory. To exercise rights for Rezva account data, contact privacy@rezva.online. For end-customer data controlled by a tenant business, contact that business directly; Rezva will assist the business under the DPA.
10. Security
We protect personal data with measures designed for the risk, including encryption in transit, encryption at rest where supported, tenant isolation, role-based access controls, audit logging, backups, monitoring, and an incident-response process. No system is perfectly secure; if a personal-data breach occurs, we will notify affected customers and regulators where required by applicable law.
11. Cookies
Our marketing website uses cookies as described in our Cookie Policy.
12. Changes to this policy
We may update this policy from time to time. When we make a material change we will increment the version slug at the top of this page. If you have a Rezva account you may be asked to re-acknowledge the updated policy on your next login.
13. Contact
Privacy contact: privacy@rezva.online