Razviel Privacy Policy

Version: v1.0 (2026-08-25)
Last updated: August 25, 2026
Entity: Razviel LLC, a Delaware limited liability company

Notice at Collection

The short version, at the point of collection. The detail is in §3 (what we collect, from where, why, and who receives it) and §9 (your rights).

1. Who We Are

Razviel LLC is a Delaware limited liability company. Our mailing address is 28 Geary St, Ste 650, PMB 671, San Francisco, California 94108, United States. We were formed on August 18, 2026.

We provide managed AI and human customer-support infrastructure to businesses ("brands"). Brands connect their support and commerce systems to Razviel; support requests from their customers are then handled by our AI or by independent service providers ("Human Nodes") working through our console.

You can reach us about privacy at legal@razviel.com.

2. The Four Groups of People in this Policy

This policy covers four distinct groups, and the difference matters — because for one of them we are not the decision-maker.

Where the GDPR, the UK GDPR or the LGPD applies. This policy is written to meet the EU General Data Protection Regulation, the UK GDPR and the Brazilian LGPD wherever they apply to you — and we apply their standard to everyone, regardless of where you are. For the people in the first three groups above we are the controller; for the fourth group the brand is the controller and we are its processor. §3A lists, for each purpose, the legal basis we rely on; §9A lists your rights under those laws and how to use them.

If you contacted a store's support and want to know about your data: we process that conversation on behalf of that brand, under a written data processing agreement, and only for the purposes the brand instructs. Please contact the brand you purchased from — it decides what happens to your data and it is the right party to handle your request. If you reach us directly, we will not act on the data ourselves; we will point you to the brand and let the brand know.

For the full terms of that processing, see our Data Processing Addendum.

3. What We Collect and Why

Two readings of the same facts. §3.0 states it in the statutory form the CCPA/CPRA asks for — the legal categories, their sources, the business purpose, and who receives them. §§3.1–3.4 state the same thing the way a person actually reads it, group by group. Neither replaces the other; where they differ in wording they do not differ in substance.

3.0 The statutory table (CCPA/CPRA categories)

We do not collect biometric identifiers or biometric information for identification purposes (§4), precise geolocation, government identification documents, or the categories of sensitive personal information the CCPA defines — and the Services are not designed to receive them. We do not sell or share any category above, and we did not in the twelve months preceding this notice. Retention by category is in §10.

3.1 Website visitors

We do not run advertising pixels on our site (see §7).

3.2 Brand users (our customers)

3.3 Human Nodes (independent service providers on our platform)

Payout details are collected and held by our payout provider, not by us.

3.4 Consumers of the brands we serve — processed on the brand's behalf

When you contact a brand's support and Razviel handles that request, we process: your name, email address and, where the channel carries it, phone number; the content of your conversation, including attachments or photos you send; your order information (order number, contents, status, tracking, refund history); and derived commercial attributes such as a customer-value segment. We process this only to resolve your request for that brand, under the brand's instructions. We do not sell it, we do not share it for advertising, and we do not use it to build a profile of you outside that brand.

3.5 Affiliates (participants in our referral program)

Payout details are collected and held by our payout provider, not by us. An Affiliate is an independent business or individual under our separate Affiliate Program Agreement — never Razviel staff, and is not a party to the Services Agreement or to the DPA.

3A. Purposes and Legal Bases (controller activities)

Where we rely on a legitimate interest, we have balanced it against your interests and you may object (§9A). Where a purpose requires your consent — today none does — we ask for it separately, unbundled from any agreement, and you may withdraw it at any time without affecting what came before.

What you must provide. A Human Node who does not supply valid tax documentation is not paid (Node Master Agreement §5.3); an Affiliate likewise (Affiliate Agreement §9.2). An application is sent only once the questions it requires are answered — the questions answered in your own words are not required — because we decide an application on those answers. Nothing else in this policy is a condition of a contract.

If you were invited by your brand's administrator, your account data reached us from that administrator, not from you; we tell you this, and point you here, when you first sign in.

4. The Certification Video — What It Is and What It Is Not

Human Nodes record a short video as part of platform certification. We want to be precise about it.

What the analysis does: it evaluates communication proficiency — whether the spoken English is intelligible, fluent and coherent, and whether the recording is of usable quality. The assessment is performed on the transcribed text and general audio/visual quality.

What the analysis does NOT do — expressly:

• it does not create a faceprint, voiceprint, face geometry template, or any other biometric identifier or biometric template;
• it does not identify or attempt to identify anyone, and does not match the recording against any face, voice, image or identity database;
• it does not verify identity, and it is not used for identity verification;
• it does not score accent, and it does not generate accent, tone or language-certification metrics.

We do not collect or use biometric identifiers or biometric information for identification purposes.

How the video is stored: in a private storage bucket, referenced only by an opaque storage key that contains no name, no filename and no personal information. It is never exposed through a public link.

Who can see it — and who decides. Certification is decided automatically. The assessment is produced by the automated analysis, and passing it grants access without a human approving it — no person reviews the video in order to approve or refuse a certification. Human access to a recording is limited to a small number of authorized people, and only for auditing the automated analysis, for security, or for investigating a specific incident or a report of falsified submission (Node Master Agreement §8.3). Every such access is logged.

Notice before you record — automated decision-making. We give you this notice before you record, so that you know what you are agreeing to:

The decision is automated. Certification is decided by automated decision-making technology (ADMT). No person approves or refuses it. The acceptance of your application, which comes before certification, is a decision made by a person; this notice concerns the certification only.
What the technology analyzes: your communication proficiency in the recording — whether the spoken English is intelligible, fluent and coherent, and whether the recording is of usable quality. Nothing else. It does not analyze the things listed above under What the analysis does NOT do.
What the decision is used for: deciding whether you are granted access to the platform as a service provider (a Human Node). It is used for nothing else, and it is not shared with brand clients as an assessment of you.
You can ask a person to look at an adverse result. If the automated analysis refuses your certification, you may request human review of that adverse result by writing to legal@razviel.com. A person will re-examine the recording and the result, and tell you the outcome. An approval is never re-examined — it takes effect automatically, as described above.
Human review, in the product. The request for human review of a refused certification is available from the Privacy screen of your account, under Automated decisions, as well as by email, and every review is recorded.
Your display name. The name you use with customers is assigned by the platform and derived from the name you registered; if it is wrong for you, tell us at legal@razviel.com and we will correct it.

Retention — the two recordings are kept differently. The recording made for platform certification (the English verification) is not kept: it is held in temporary storage only while it is analyzed and is then deleted automatically, and what remains is the result — never the recording, the transcript or the raw output of the analysis. The recording made for a brand is kept, privately and encrypted, while that brand certification is active and for a reasonable period afterward for audit, and is then deleted. A Human Node may request deletion of a brand recording at any time; deleting it may require re-certification for that brand.

Who the brand sees. We show a brand the certification recording made for that brand, together with your name and profile photograph, so that the brand can confirm that a real, certified person is assigned to its account. We do not show a brand any recording made for a different brand or for platform onboarding, and we never give a brand your e-mail address, telephone number, postal address, tax identification, payout details or employment history. The brand views the recording through the platform while you are allocated to it; recordings are stored privately and are never publicly accessible. You may object to a recording being shown to a brand by writing to us, and your certification, standing and allocation are not affected by that choice.

5. Artificial Intelligence

We build AI into the support experience, and we will tell you the truth about it.

• The platform uses AI to handle support conversations. When you contact a brand that uses Razviel, an automated system may read, answer and act on your request, speaking in that brand's name and voice.
• Our automated agents never claim to be human. They will not tell you they are a person, and they will not invent a human colleague or supervisor.
• If you ask whether you are talking to AI, you get a truthful answer. Always.
• Our automated agents identify themselves as AI. The identification appears on every channel we operate — beside the name in the conversation header where the chat surface is ours, and in the message itself everywhere else. It is part of how the system is built, not a setting a brand can switch off.
• Automated decisions are bounded by rules the brand sets. Before any action that moves money — a refund, a credit, a discount — a deterministic backend control checks it against the policy the brand configured, and permits it only where the action is among the actions that policy allows and within the limit that policy sets. Where the rules do not cover a case, or where judgment is needed, the request goes to a human.
• These are best-effort architectural controls, not a promise of infallibility. AI systems and people make mistakes. The controls above are how the system is designed to behave; we do not represent that no action will ever be executed outside a brand's configured policy, and nothing here is a warranty of an error-free service. This is the same statement our Services Agreement makes to brands (§5.5 and §14.4 of that agreement).
• We do not use your conversation to train models in a way that identifies you. See §8.

Automated decisions about a brand's customers. When you contact a brand that uses Razviel, an automated system may decide your request within the rules the brand configured — for example, approve a refund up to the limit the brand set. Where the system declines something you asked for, you can always ask for a person: the request goes to a human at the brand (or to a certified Human Node), and it is honored without conditions. The brand is the decision-maker for that process; its own notice tells you how it uses automated decisions and how to contest them. The logic, in one sentence: the brand writes its policy as a table of cases, customer segments and permitted actions with limits; the system classifies your request, checks the exact cell, and never acts outside it.

6. Who We Share Information With

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

Our service providers:

Human Nodes — independent service providers (individuals or their own entities) under contract with Razviel, never Razviel staff — who see only the tickets assigned to them, for the brands they are certified for, inside our console, under a written confidentiality obligation. They work from countries outside the United States, and nothing is stored in their country (§12).

The list, with its version. The service providers above and the Human Node category are the subprocessor list of our DPA §8, published there with a version number; a brand is told at least 30 days before that list changes, and may object.

The brand's own connected systems — the helpdesk, e-commerce and order-tracking platforms the brand connects (for example Gorgias and Shopify). Those are the brand's own accounts under the brand's own agreements; we access them as the brand's authorized agent. They are not our service providers.

Others: professional advisors under confidentiality; authorities where legally required; and an acquirer in a merger, acquisition or sale of assets (with this policy continuing to apply until superseded by notice).

7. Cookies and Tracking

We do not run advertising or ad-tech pixels on our website or dashboards. There is no Meta Pixel, no Google Ads tag, and no cross-site advertising tracker.

We use strictly functional cookies and local storage only: keeping you signed in, remembering your session, preserving interface preferences, and basic security. We run no analytics script on our website or our dashboards — no client-side analytics, aggregate or otherwise; what we know about traffic comes from our own server logs, which set no cookie and are kept for short operational periods (§10). Our website sets no cookie at all.

The inventory. We keep an inventory of every cookie and every browser-storage key each of our surfaces sets — its name, purpose, duration and why it is strictly necessary — and we add none without adding it there. You may request it at legal@razviel.com.

Because we do not "sell" or "share" personal information as those terms are defined under U.S. state privacy laws, there is no "Do Not Sell or Share My Personal Information" link and no cookie consent banner — U.S. state privacy laws are opt-out, and there is nothing here to opt out of. Under the EU and UK ePrivacy rules the same is true for a different reason: everything we store in your browser is strictly necessary for a service you asked for, which is the case those rules exempt from consent, so there is nothing to ask you for.

Global Privacy Control and other opt-out-preference signals — honestly stated. We do not sell or share personal information as those terms are defined by the CCPA, so an opt-out-preference signal such as GPC does not change any processing we perform — there is no sale or sharing for it to stop. We nonetheless treat such a signal as a valid opt-out request wherever it applies to us, and if we ever begin an activity that qualifies as a sale or a share, a signal already received will be honored for that activity without your having to send it again.

Chat widget on a brand's store: when Razviel powers support on a brand's own site, the widget sets functional cookies only (chat session continuity). It does not track you across other websites. Cookies set on the brand's store are disclosed by that brand's own cookie notice.

8. How We Use Data to Improve the Service

We improve our AI using what we learn from operating it — with one rule that governs everything:

Nothing containing personal information ever crosses from one brand to another.

Nothing crosses between brands — nothing at all. Not your conversation, not your details, and not a de-identified or aggregated version of either. What a brand's AI learns, it learns from that brand's own resolved cases, and it stays there permanently. Razviel does not train AI models on this data; it looks back at how similar cases were handled for that same brand, at the moment of answering. Raw conversations, transcripts, attachments and customer records stay siloed to the brand they came from, permanently.

If that ever changes, it will be asked for. Any cross-brand improvement would need the brand's separate, prior consent, given on its own. None is asked for or held today. See the DPA §6.

The models, statistics and aggregated insights that result from this work belong to Razviel and contain no personal information. We claim no ownership of a brand's raw customer data — that belongs to the brand.

9. Your Rights

Your rights depend on where you live. Wherever you are, you may contact us at legal@razviel.com — and remember §2: if your data reached us through a brand's support, the brand is the right party to ask.

California (CCPA/CPRA). You may request to know the categories and specific pieces of personal information we hold about you, to correct it, to delete it, to obtain a portable copy, and to limit the use of sensitive personal information. We do not sell or share personal information, so there is nothing to opt out of on that front. We will not discriminate against you for exercising a right. You may use an authorized agent. Where we act as a service provider for a brand, we forward your request to that brand.

Virginia, Colorado, Connecticut, Texas, Utah, Oregon, Montana and other U.S. states with comprehensive privacy laws. You have substantially the same rights — access, correction, deletion, portability, and opting out of targeted advertising, sale, and certain profiling (none of which we do).

How we handle a request. We verify that the request is genuinely yours before acting, respond within the period the applicable law requires — forty-five (45) days under the U.S. state laws (extendable once by a further 45 days where permitted and where we tell you why), one month under the GDPR and the UK GDPR, and fifteen (15) days under the LGPD (§9A) — and tell you if we cannot act and why.

If we refuse — how to appeal. Several states (including Virginia, Colorado and Connecticut) give you the right to appeal a refusal, and we extend the same process to everyone:

1. Write to us within a reasonable period of our decision, at legal@razviel.com, with the word "Appeal" in the subject line, the request you made, and why you believe the decision was wrong.
2. We respond in writing within forty-five (45) days of receiving the appeal — the shorter period being applied where your state's law requires one — explaining the reasons for the decision, whether we have reversed it in whole or in part, and what we have done.
3. If we deny the appeal, we will tell you how to complain to your state's Attorney General, and give you a working link or contact for that office. In Virginia, Colorado and Connecticut that is the office of the state Attorney General; in California, complaints may also be made to the California Privacy Protection Agency. You may complain to your regulator whether or not you appeal to us first.

Everywhere else. If a privacy law that applies to you gives you rights we have not listed, tell us and we will honor what applies.

9A. Your Rights under the GDPR, the UK GDPR and the LGPD

If those laws apply to you, you have the right to: access the personal data we hold about you and receive a copy; rectify it; have it erased; restrict its processing; object to processing based on a legitimate interest (including the display of your certification recording to a brand) and to profiling; receive the data you gave us in a portable format; withdraw any consent; and not be subject to a decision based solely on automated processing that significantly affects you, except where necessary for a contract with you — in which case you may ask for human review (§4). Under the LGPD you may also ask for confirmation that we process your data, for information about whom we shared it with, and for anonymization or blocking of data that is unnecessary.

How. From your account settings (export, correction, deletion and objection controls) or by writing to legal@razviel.com. We verify your identity, answer within one month (extendable by two months for complex requests, and we tell you why) — within fifteen days where the LGPD applies — and we tell you if we cannot act and why. We never charge for a first request.

Complaints. You may complain to a supervisory authority: in the EU, to the authority of your country of residence or workplace (our lead authority, once designated, is the Irish Data Protection Commission); in the UK, to the Information Commissioner's Office; in Brazil, to the Autoridade Nacional de Proteção de Dados (ANPD). We would rather hear from you first, and we answer complaints in writing.

If your data reached us through a brand's support, the brand is the controller: we forward your request to it within ten business days and act on its instruction (§2).

Representatives and data protection officer. We have not appointed a representative in the EU or the UK, or a data protection officer under the GDPR or the UK GDPR, because the thresholds that require them have not been met; we will name them here when they are. The Brazilian LGPD requires a data protection officer: ours is Bruno Mota Santos, Razviel's founder, reachable at legal@razviel.com.

9B. Human Nodes in Brazil — the LGPD

If you are a Human Node in Brazil, the Lei Geral de Proteção de Dados (Lei 13.709/2018) applies directly to what we do with your data, because we collect it from you in Brazil. The bases we rely on are those in §3A (art. 7 II, V and IX). Your rights are those in §9A — including confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about whom we shared your data with, and review of the automated certification decision (art. 18 and art. 20) — and we answer within fifteen (15) days. The channel is legal@razviel.com, which is the channel of our data protection officer; the authority is the ANPD. Because you give us your data directly, from Brazil, to a company established in the United States, we treat that as an international collection under the ANPD's rules on international transfers, and no standard clauses are needed between you and us; the customer data you access through our console is governed by Annex A of the Node Master Agreement, which is your link in the brand's data-protection chain. The Portuguese version of this section, of §3A, §4 and §9A is served to you in the platform (Node Master Agreement §16.4); the English text controls.

10. How Long We Keep Things

Routine backups expire on their ordinary cycle and are not restored for any other purpose.

A word on how to read this table. Where a row says "kept", it describes the period we hold the data for. Where a row states an action — "we make available", "we delete" — it describes what we do when the trigger occurs: an export window opening, an integration being disconnected, a deletion being requested. Nothing in this table is a promise that a given piece of data will exist to be exported or deleted at a moment when the trigger has not occurred.

11. Security

Our security is architectural, not a promise on a page. The measures we operate include:

• encryption in transit and at rest for personal information;
• row-level access control, scoping each Human Node to only their assigned tickets and the queue of the brands they are certified for — never another Node's work, never another brand's data;
• private media storage referenced by opaque keys that contain no filenames and no personal information; media is never served from a public URL;
• server-side authorization — every privileged operation is re-derived from the authenticated identity on our backend, never trusted from the browser;
• credential isolation — a brand's third-party credentials live only where our privileged backend reaches, and are never readable by Human Nodes or by dashboard users;
• data minimization — we collect the fields the service needs and no more;
• a full per-ticket audit record — context, policy applied, decision, execution and outcome — which is both how we improve and how we can show what happened;
• contractual controls on people — every Human Node accepts a confidentiality and data-protection annex before receiving any access, prohibiting copying, exporting, downloading or photographing customer data, and requiring immediate incident reporting.

No system is perfectly secure, and the measures above are how the system is designed to work — they are not a guarantee that no incident will occur. If a security incident affects personal information we process for a brand, we will notify that brand without undue delay and in no event later than 72 hours, and — where the incident involves data covered by a commerce platform's protected-data regime — we will notify that platform within 24 hours. The brand, as the decision-maker for its customers' data, notifies the individuals.

12. International Transfers

Our infrastructure is hosted in the United States, and a brand may choose a European region for its workspace. Where the GDPR, the UK GDPR or the Swiss FADP applies, we transfer personal data under the EU Standard Contractual Clauses (Module Two with brands, Module Three with our subprocessors and with Human Nodes) and the UK International Data Transfer Addendum, supported by a transfer impact assessment for each destination — the United States, and each country where Human Nodes work. Human Nodes are independent service providers located outside the United States; they access support conversations only on screen, through our console, under contractual, technical and organizational controls, and nothing is stored in their country. You may obtain a copy of the clauses and of the assessment summary at legal@razviel.com. Under the LGPD, data a Brazilian Human Node gives us directly is collected internationally rather than transferred (§9B); where a Brazilian brand's customers' data is processed, we apply the ANPD's standard contractual clauses.

13. Children

The Services are not directed to children, and we do not knowingly collect personal information from anyone under 16.

The CCPA opt-in for minors does not arise here. California requires affirmative authorization before selling or sharing the personal information of a consumer aged 13 to 15 (and a parent's or guardian's authorization for anyone under 13). We do not sell or share personal information at all (§7), for any age group, so that opt-in requirement does not apply to us and we have not obtained or relied on any such authorization.

If you are a parent or guardian and you believe a child's information has reached us, write to legal@razviel.com with enough detail to locate it. We will verify the request, delete the information, and confirm to you that we have done so. If the information reached us through a brand's support conversation, we will also notify that brand, since the brand — not Razviel — decides what happens to its customers' data (§2).

14. Changes to this Policy

We may update this policy. We will change the version and the "last updated" date at the top, and for material changes we will give notice in-product or by email — and, where our agreements require it, ask for active re-acceptance before the change takes effect.

Governing language. This policy is published in English, with Portuguese and Spanish versions of the sections that concern Human Nodes (§3A, §4, §9A and §9B), served in the platform; the English text controls. Any translation is provided for convenience only; where a translation differs, the English text governs.

15. Contact

Razviel LLC
Mailing address: 28 Geary St, Ste 650, PMB 671, San Francisco, California 94108, United States
Delaware, United States

Privacy: legal@razviel.com — also the channel of our data protection officer under the LGPD (§9A). EU and UK representatives: none appointed (§9A).

If you are a consumer of a brand that uses Razviel, please contact the brand you purchased from first — see §2.