Privacy Policy
Last updated: October 28, 2026
This policy explains how Oasis Enterprise LLC, a Wisconsin limited liability company, doing business as RevPass ("RevPass", "we", "us") handles personal information in connection with the RevPass website (revpass.io), the RevPass application, the RevPass panel inside Salesforce, the RevPass Slack app, and our sales and support communications.
Contact: privacy@revpass.io · 708 Heartland Trl, 3rd Floor, Madison, WI 53717
1. Two roles
When we act for our customers (processor). RevPass customers are businesses. They upload signed order forms, purchase orders, master agreements and similar documents, and connect their Salesforce and, optionally, Slack. Those documents and records can contain personal information about the customer's staff and about people at the customer's own customers and suppliers (for example a signatory's name and title, or a billing contact's email). We process that information on the customer's behalf and under its instructions, under our agreement with the customer and our Data Processing Addendum. If your information is in a RevPass customer's documents or Salesforce, please contact that customer; we will help them respond.
When we decide how information is used (controller). We are responsible for personal information about the people who use RevPass accounts, visitors to our website, people who download our guides or join our waitlist, prospective customers we contact, and anyone who writes to us. The rest of this policy is mainly about this information, and also explains, for transparency, what happens to customer data inside the service.
2. What we collect
Account users
- Name, email address and the role your administrator gives you.
- Sign-in data handled by our identity provider, Clerk: your verified email and sign-in identifiers. If you sign in with Google or Microsoft, we receive your login identity from them. We do not receive or store your password.
- If your workspace connects Slack, your Slack user ID so we can send you notifications and let you act from Slack.
- If you use the RevPass panel inside Salesforce, the Salesforce user details Salesforce passes to the panel (including your Salesforce user ID and email) so we can link the panel to your RevPass account.
- Your notification preferences.
Activity and audit logs
- A record of key actions in the service (for example sign-in, document uploads and downloads, findings applied, Salesforce writes, deals marked booked, data exports), with who did it and when.
- Technical logs and error reports, which may include IP address, browser type and request details.
- Usage of the AI model per workspace (counts and token usage), for cost control.
Customer data inside the service (processed for the customer)
- Documents customers upload: signed order forms, purchase orders, MSAs and related files, the text we extract from them, and the findings we produce.
- Salesforce data the customer's connection allows us to read, mainly Opportunity, Account, Quote and related records and the fields mapped in settings. These can include names and contact details of people at the customer and at its customers.
- Messages users send to the RevPass Slack app or the in-app assistant.
Website visitors
- We use Umami, an analytics tool we host ourselves. It does not use cookies or advertising identifiers. It records page views (the page address without any query string), referrer, browser, device type and country.
- On our public website pages only (the home page, pricing, security, comparison and legal pages), Umami also records sessions: how visitors scroll, move and click, and what the page shows, so we can see where the site is unclear. Anything typed into a form field is hidden from these recordings. Recordings are not made inside the RevPass application, on sign-in pages, or in the RevPass panel in Salesforce, so they never include customer data.
- Sign-in uses cookies set by Clerk that are needed to keep you signed in. We do not use advertising cookies.
Guide downloads, waitlist and contact
- Email address, the guide you asked for, a one-way hash of your IP address, your browser's user-agent string, and anything you write to us.
Prospective customers (outbound sales)
- We contact people at businesses we think may benefit from RevPass. For this we hold business contact details (name, business email, company, job title) and short notes on why we are getting in touch. These come from public sources, from commercial business-contact data providers, and from people we meet. We check addresses before sending (format, domain and do-not-contact list) and honour unsubscribe requests.
Billing
- Billing contact and subscription details. Payments are handled by Stripe; we do not store card numbers.
3. How we use it, and our legal bases
For people in the EU, UK or Switzerland, we rely on the legal bases shown.
| Purpose | Legal basis |
|---|---|
| Providing the service to our customers: reading documents, comparing them with Salesforce, showing findings, applying corrections the customer chooses, notifications, reporting | Performance of our contract with the customer; our legitimate interest in providing the service the user's organization has bought |
| Creating and securing accounts, sign-in, access control and audit logs | Contract; legitimate interest in keeping the service secure |
| Fixing errors and keeping the service running | Legitimate interest |
| Billing | Contract; legal obligation (tax and accounting) |
| Answering questions and support | Legitimate interest; contract |
| Sending guides you asked for and waitlist updates | Consent or legitimate interest |
| Outbound sales emails to business contacts | Legitimate interest in B2B marketing, with an unsubscribe in every email |
| Website analytics and, on public pages, session recordings (cookieless, form input hidden) | Legitimate interest |
| Complying with law and protecting our rights | Legal obligation; legitimate interest |
We do not sell personal information, and we do not share it for cross-context behavioural advertising.
4. AI processing
To check a signed document, RevPass sends the whole document and the related deal fields to Anthropic's Claude through Anthropic's API. Messages sent to the RevPass Slack app or in-app assistant are also processed by Claude. Under Anthropic's commercial terms, data sent through the API is not used to train Anthropic's models. RevPass does not use customer data to train AI models.
The AI produces findings for people to review. It does not make decisions about individuals that have legal or similarly significant effects.
5. Who we share it with
We share personal information only with:
- Our subprocessors, who run parts of the service for us under written agreements. They are listed in the table below.
- The customer you work for: your workspace's administrators can see your account details and the actions you take in the service.
- Professional advisers (lawyers, accountants, insurers) where needed.
- Authorities where the law requires it.
- A successor or affiliate: if the RevPass business is transferred, including to a new company formed to operate RevPass separately from Oasis Enterprise LLC, personal information may transfer with it, under this policy.
Our current subprocessors:
Salesforce and Slack process personal information only when the customer connects them.
6. How long we keep it
- Customer workspace data is kept while the customer's subscription is active. A customer can set a retention period: documents on deals that closed (won, lost or voided) longer ago than that period are deleted automatically each day. Signed (executed) documents and audit records are kept. By default no retention period is set, so documents are kept until the customer deletes the workspace.
- Workspace deletion: when a customer's administrator deletes the workspace, sign-in stops at once; after 7 days we permanently delete the workspace's records and stored files.
- Former users: a workspace administrator can deactivate a user and then erase their personal details; their name and email are replaced with a placeholder in the workspace's history, including earlier audit entries.
- Backups: database backups are provided by our database provider (Supabase) under its standard service. Copies in those backups expire under our database provider's standard retention.
- Error reports are kept by Sentry for a limited period under our error-monitoring provider's retention settings.
- Guide-download, waitlist and outbound-sales records are kept for as long as we need them for those purposes, and suppression records (unsubscribes) are kept so we do not contact you again.
- Billing records are kept as long as tax and accounting law requires.
7. Security
- All traffic uses TLS. Data is encrypted at rest by our hosting and storage providers.
- Salesforce and Slack credentials are additionally encrypted in our application with AES-256-GCM.
- Access is invite-only, sign-in requires a verified email, and roles limit what each user can do.
- Each customer's data is kept separate from other customers' data in the application.
- Key actions and every Salesforce write are recorded in an audit log.
- Error reports have email addresses removed before they are sent to Sentry.
No system is perfectly secure. We do not hold a SOC 2 report or other third-party certification today; SOC 2 Type I is on our roadmap.
8. International transfers
RevPass is based in the United States and our subprocessors process data mainly in the United States. When we transfer personal information from the EU, UK or Switzerland, we rely on the EU Standard Contractual Clauses and UK Addendum, and on the EU-U.S. Data Privacy Framework where a vendor is certified.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict some uses, to withdraw consent, and to complain to a data protection authority. California and other U.S. state residents have similar rights and the right not to be discriminated against for using them.
To use these rights, email privacy@revpass.io. We may need to confirm your identity. If your request concerns data a RevPass customer controls, we will pass it to that customer or act on its instructions.
You can unsubscribe from our emails at any time using the link in each email.
10. Children
RevPass is a business service and is not directed to children. We do not knowingly collect children's information.
11. Changes
We will post any changes here and update the date above. For material changes we will also notify customer administrators by email or in the service.