Privacy Policy

Last updated: November 10, 2026

This policy explains how RevMunk ("RevMunk", "we", "us") collects, uses, shares and protects information when you visit revmunk.ai or use the RevMunk service, including the RevMunk app and buyer portal (together, the "Service"). If you have questions, contact us at vikas@revmunk.ai.

1. Our role

RevMunk provides accounts-receivable software to businesses ("Customers"). When a Customer uses the Service to manage invoices and communicate with its own customers ("Buyers"), we process that information on the Customer's behalf and under its instructions; the Customer decides what data the Service handles. For information about website visitors and the people who sign up for or administer a Customer account, RevMunk decides how it is used, as described here.

2. Information we collect

Account information

• Name, work email address and organization for people who use the Service.
• Sign-in credentials. We use passkeys and email sign-in links; for passkeys we store only the public key, never a password or biometric data.

Customer business data

• Invoices, payment status, and Buyer contact details that a Customer imports or connects, for example from its accounting or ERP system.
• Messages exchanged with Buyers through the Service, and documents attached to them.

Mailbox data (when a Customer connects a mailbox)

See section 4 for exactly what we access from Google and Microsoft mailboxes.

Technical information

• Log data such as IP address, browser type, pages requested and timestamps, used for security and to operate the Service.
• Strictly necessary cookies that keep you signed in. We do not use advertising or cross-site tracking cookies.

3. How we use information

• To provide the Service: delivering invoices, sending reminders, reading and routing Buyer replies, and showing Buyers their invoices in the portal.
• To secure the Service, prevent fraud and abuse, and troubleshoot problems.
• To communicate with you about your account, including sign-in links, security notices and service updates.
• To comply with legal obligations and enforce our terms.

We do not sell personal information, and we do not use Customer data or mailbox data for advertising.

4. Google and Microsoft mailbox data

A Customer may connect a Google Workspace or Gmail mailbox, or a Microsoft 365 mailbox, so that RevMunk can send collections email from the Customer's own address and read Buyers' replies.

What we access

• Google: gmail.readonly to read messages, and gmail.send to send messages on the Customer's behalf.
• Microsoft: Mail.Read and Mail.Send (and their .Shared forms for a shared mailbox the user can open), User.Read to identify the signed-in user, and offline_access to stay connected.

How we use it

• We store only messages from known Buyer addresses or in threads that RevMunk started. Other mail in the mailbox is not stored.
• We use those messages only to provide the collections features the Customer turned on: recognizing payments, questions and disputes, threading replies, and handling bounces.
• We never move, label, archive or delete messages in the mailbox.
• Access tokens are encrypted at rest. When a Customer disconnects a mailbox, we delete its tokens and revoke them with the provider.

Limited Use

RevMunk's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, for data from Google and Microsoft mailboxes:

• We use it only to provide and improve the user-facing features described above.
• We do not transfer it to others except as needed to provide the Service, to comply with law, or as part of a merger or acquisition with notice to users.
• We do not use it for advertising, and we do not sell it.
• We do not use it to develop, improve or train generalized artificial intelligence or machine learning models.
• No person at RevMunk reads it unless the Customer gives us permission for specific messages, it is necessary for security purposes such as investigating abuse, or it is required by law.

5. How we share information

• Service providers that host and operate the Service for us under contract, such as Amazon Web Services (hosting, storage and email delivery). They may use the data only to provide their services to us.
• Providers you connect, such as Google, Microsoft, or your accounting system, to carry out actions you ask for.
• Buyers, who receive the invoices and messages a Customer sends through the Service.
• Legal and safety: when required by law, or to protect the rights, safety and security of our users, Buyers, or the public.
• Business transfers: in connection with a merger, acquisition or sale of assets, subject to this policy.

6. Security

We protect information with industry-standard measures, including encryption in transit (TLS) and at rest, encrypted storage of third-party credentials, isolation of each Customer's data, least-privilege access for our staff and systems, and audit logging. No system is perfectly secure, but we work to protect your information and will notify affected Customers of a breach as required by law.

7. Retention

We keep Customer data for as long as the Customer's account is active or as needed to provide the Service. When a Customer closes its account, we delete or anonymize its data within 90 days, except where we must keep it longer to meet legal, tax or accounting obligations. Mailbox tokens are deleted as soon as a mailbox is disconnected.

8. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or export your personal information, or to object to or restrict certain processing. If your information is in the Service because a Customer uses it (for example, you are a Buyer), please contact that Customer; we will help them respond. Otherwise, contact us at vikas@revmunk.ai. You can revoke RevMunk's access to a Google account at any time at myaccount.google.com/permissions.

9. International transfers

The Service is hosted in the United States. If you access it from elsewhere, your information will be transferred to and processed in the United States, with safeguards as required by applicable law.

10. Children

The Service is for businesses and is not directed to children under 16. We do not knowingly collect their personal information.

11. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new "Last updated" date and, for material changes, notify Customers by email or in the Service.

12. Contact

RevMunk · vikas@revmunk.ai