Privacy Policy

1. Who We Are and Our Role

Sprevi ("we", "us", "our") is a data processor. When you connect your business mailbox to Sprevi, you (the business owner) are the data controller — you determine why and how your enquirers' personal data is processed. We process that data only on your instructions, only to provide the Service, and only for as long as you have an active account.

If your enquirers wish to exercise their rights over their personal data (erasure, access, portability), those requests should be directed to you as the data controller. You can fulfil deletion requests using the "Delete all data for this contact" action in your Contacts view, or by requesting full account deletion from us.

Our registration with the Information Commissioner's Office (ICO) as a data processor is in progress. Our registration number will be displayed here once issued.

2. What Data We Process and Why

We process the following categories of data, under the legal basis of contract performance (processing necessary to provide the Service you have contracted for):

• Account Data: Your name, business email address, and authentication credentials (hashed or secured via OAuth). Used to authenticate you and maintain your account.
• Mailbox Credentials: IMAP passwords or OAuth tokens for your connected email account. Stored encrypted (AES-256-GCM). Used to import enquiry messages, and — on paid plans — to mark messages as read and to send email replies on your behalf once you've approved them. Sprevi does not send email autonomously: every outbound reply requires your explicit one-tap approval, unless you've specifically configured and enabled an automation rule yourself. Sprevi never deletes mail by itself and never permanently deletes anything. If you choose to delete or clear specific messages in Sprevi (for example "Free up space") and have switched on mailbox changes for that mailbox, only those messages are moved to your mailbox's own Trash, one explicit action at a time. We never change mailbox forwarding or filter rules, or access folders unrelated to identifying enquiries.
• Enquiry Message Content: Subject lines, message bodies, sender names and email addresses. This arrives either from your connected inbox, or — if you've enabled the ChatBubble website widget — directly from a form your website visitor submits, which is stored in the same way as an inbox-sourced enquiry. Stored encrypted at rest (AES-256-GCM). Used to classify, score, and display your enquiries, and to generate automated reply drafts for your approval.
• Structured Metadata: Budget, location, dates, and other fields extracted from message content. Stored in your account to enable filtering and CRM features.
• Enquiry Engagement Data (paid plans only): If you enable open or click tracking, we record that a specific outbound email was opened, and separately, when an enquirer clicks a "status" link in an email (e.g. "still interested?"), the choice they made and when. We do not store the enquirer's IP address against either of these records — known email-security scanners that pre-fetch links are filtered out so they aren't counted as genuine opens.
• Team Activity Data (shared mailboxes only): Which colleague replied to or approved a reply for which contact, and when, so a shared mailbox can warn before two people reply to the same person. See section 6.
• Usage and Technical Data: IP addresses, browser type, session identifiers. Used for security and to maintain your login session.
• Notes and choices about contacts: notes and call logs you add about a contact (for example "we spoke on the phone"), and choices you make about a contact, such as starring them, snoozing them or marking them a close contact. They are your own records, stored encrypted where they contain text, shown only to people with access to that mailbox.
• Devices that stay signed in: if you tick "Stay signed in on this device" when you log in, we store a random token (only a one-way hash of it, never the token itself), a short description of the device (for example "iPhone"), and when it was created and last used. You can see and remove these in Settings.
• Notification devices: if you turn on phone or browser notifications, we store the notification address your device's browser gives us and its keys (encrypted), a name for the device, and the choices you make (which kinds of message, whether names and subjects may appear, quiet hours). Nothing is sent until you switch this on, per device.
• Signatures: the signature text you set for a mailbox, and, if you add one, a signature image (a logo, for example). Both are stored encrypted. The image is shrunk and re-saved by us, which removes any hidden information in the file, and is shown to the people you email from a public web address that cannot be guessed, so anyone who has one of your emails can load it. Sprevi does not record who loads it (ordinary web-server logs still note requests, as for any page). Removing the image, or deleting the mailbox, deletes it.

We do not use your data for advertising or for any purpose unrelated to providing the Service. We do apply automated classification and scoring to enquiry content — for example, identifying high-value enquiries or returning clients — solely to deliver the core features you've contracted for. This processing runs entirely within Sprevi's own systems; see Section 5.

3. Data Security and Encryption

Mailbox Access, Precisely

Sprevi requests only the permissions needed to operate: reading enquiry messages, marking them as read or unread, sending replies you've approved, and, only when you choose to delete specific messages and have switched on mailbox changes, moving those messages to your mailbox's own Trash. None of this happens automatically, and Sprevi never permanently deletes mail, modifies your mailbox rules or forwarding settings, or accesses anything outside your mailbox. Disconnecting your mailbox (available any time in Settings) immediately revokes our access and stops all reading, marking, and sending activity; any automation rules you created are disabled at the same moment.

We implement the following technical measures to protect your business communications:

• AES-256-GCM field-level encryption on all sensitive columns: message subjects, bodies, sender names, email addresses, and IMAP/OAuth credentials. The encryption key is held separately from the data.
• PII-scrubbed search index: Keyword search is performed against a tokenised, non-reversible index — not against decrypted message content. This means full-text search does not expose plaintext PII to the search engine.
• CSRF protection on all state-changing operations.
• HTTPS-only transport in production.

In the event of a data breach affecting your personal data, we will notify you without undue delay so that you, as data controller, can meet your own regulatory obligations, including notifying the ICO within 72 hours where required.

4. Data Retention

We apply the following retention limits:

• Message content — Free plan: Messages older than 3 months are automatically purged from our database. They remain in your own email account.
• Message content — Starter plan: Messages older than 1 year are automatically purged from our database.
• Message content — Business plan: Messages older than 2 years are automatically purged from our database.
• Message content — Enterprise plan: Messages older than 6 years are automatically purged from our database.
• Shared-mailbox reply records: The record of which colleague replied to which contact is kept for about 90 days, and is deleted earlier with the contact, the mailbox, or the colleague's account.
• Account inactivity: If your account has had no login activity for 23 months, we will send a warning email to the address on file. If no login occurs within 30 days of that warning (24 months total inactivity), your account and all associated data are permanently deleted. Logging in at any point resets this clock.
• Account closure: On account deletion (whether initiated by you or triggered by inactivity), all messages, extracted fields, contacts, rules, and templates stored in Sprevi are permanently deleted within 30 days. The one exception is backup files, which are described next and are overwritten as set out there.
• Signed-in devices and notification devices: a device you keep signed in expires 60 days after you last use it, and is deleted when you log out on it, remove it in Settings, change your password, or delete your account. A notification device is deleted when you remove it, when your device's push service tells us it no longer exists, or when you delete your account.
• Backups (Business and Enterprise plans): Business accounts are backed up monthly and Enterprise accounts weekly (Free and Starter have no scheduled backups). A backup is an encrypted file of your Sprevi settings and the decisions you have made in Sprevi, such as rules, templates, contact choices (names you corrected, snoozed or unsubscribed contacts), and the history figures Sprevi keeps. It stays inside the retention limits above, and it does not contain copies of your emails or your mailbox login details. We keep the four most recent backup files for each mailbox. Each new backup replaces the oldest, so a backup that contains your data is overwritten within four backup cycles (about four weeks for weekly backups, about four months for monthly ones). After an account is deleted, its data is gone from our database within 30 days and from backups once they have been overwritten in this way.

These purges apply to data held in the Sprevi database only. These purges never alter, delete, or move anything in your actual email mailbox. The only time Sprevi changes your mailbox is an explicit action by you, such as moving a message you chose to delete to Trash.

5. Data Sharing

We do not sell, rent, or share your data with third parties for their own purposes. We may share data with:

• Hosting and infrastructure providers (processing on our behalf under appropriate data processing agreements).
• Payment processors (Stripe) — payment card data is handled directly by Stripe; we store only your subscription status.
• Messaging providers (Twilio) — used only if you explicitly enable WhatsApp or SMS notifications on a paid plan; only the notification content and destination number are shared, for that purpose alone.
• Integrations you explicitly configure and enable — for example, the Booking app, a Slack or Microsoft Teams webhook you supply, or connecting your own HubSpot account. For webhook-based integrations (Slack, Teams), we deliver only to the address you provide; we do not hold a relationship with Slack or Microsoft on your behalf. For HubSpot, you authorise the connection directly via HubSpot's own login, and only the data needed for that sync is shared. Nothing outside what a given integration needs is included.
• Notification delivery (your device maker's push service: Google, Apple, Mozilla or Microsoft, depending on your device) — only if you turn on notifications. The notification is encrypted for your device, so the push service cannot read it, and by default it says only what kind of message arrived (for example "New enquiry"), never a name or subject, unless you choose to show them on that device.
• Backup delivery (Google) — the encrypted backup files in section 4 are sent by email to a dedicated Google (Gmail) account that we control, and are held there until they are overwritten. Google is a sub-processor for that delivery. It receives the files only in encrypted form: the key that opens them is kept separately and is never stored in that account.
• AI assistance (Anthropic) — used in three places, none of which reads your inbox to detect or classify enquiries. (1) Redraft with AI, only when a mailbox owner switches it on (anyone with access to that mailbox can then use it, and it counts against the owner's allowance): each time it is used, only the current draft and the visible email thread with that one contact are sent, and for a colleague who has only enquiries-and-replies access, only the messages they are allowed to see; personal names, email addresses, phone numbers and postcodes are replaced with placeholders before the request leaves our servers, and restored locally in the returned draft. (2) The reply library, built only for a mailbox that has switched on AI drafting (or when its owner asks for a rebuild), and refreshed about monthly: a sample of that mailbox's own sent replies, with the same placeholder redaction (and links removed), is summarised into a library of how the business tends to answer common questions. (3) The campaign compliance check: when you review a bulk campaign before sending, the campaign's own subject and wording, plus the approximate audience size and how long ago those people last wrote, are checked by the model; this does not include any customer's emails or details. Anthropic processes this solely to return the result of the request: it does not use commercial API data to train its models, and applies a limited retention window (around 30 days). The UK–US transfer is covered by Anthropic's Data Processing Addendum, which incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. Items (1) and (2) are not used while AI drafting is left off; (3) applies only when you choose to run a campaign review. See "Enquiry Detection and Classification" below for how this differs from the core product.

All sub-processors are bound by confidentiality and GDPR-compliant data processing terms. We will notify you by email of any new sub-processor at least 14 days before they begin processing your data, giving you the opportunity to raise concerns.

Enquiry Detection and Classification: Identifying, classifying, and scoring enquiries is performed using Sprevi's own proprietary logic, running entirely on our own infrastructure. We do not send your message content to any third-party AI or language model provider for this purpose. Separately, a small number of optional features use our AI sub-processor, Anthropic: the opt-in "redraft with AI" button, the reply library that supports it, and the pre-send campaign compliance check — see the AI assistance entry above for exactly what is sent and how it is protected. None of these is automatic, every drafted reply is reviewed and approved by a person before anything sends, and detection, classification, scoring and targeting do not use a third-party model. If you choose to connect your own third-party AI provider or API key, you are instructing that provider directly for that purpose; we will send only the data necessary to fulfil your configured request, and you are responsible for that provider's own data handling terms.

6. Shared Mailboxes and Team Members

If you share a mailbox with colleagues, the people you add act on your behalf and under your authority: you remain the data controller of the messages in the mailbox, and we remain your processor. You decide who is added and what they can see. By default a person you add sees only the enquiries in the mailbox and the conversations with the people who sent them, not other mail such as newsletters or invoices, and you can give an individual access to everything or remove their access at any time. This limit is applied by our servers on every page and every action, including when a colleague uses an optional feature you have switched on, such as AI redraft: only what that person is allowed to see is used.

So that a shared mailbox can work without two people replying to the same person, we also record, about the people you add:

• Who replied to whom: which person sent a reply to which contact, and when. Kept for about 90 days, used to warn colleagues and to show who last replied, and deleted sooner if the contact, the mailbox or the colleague's account is deleted.
• Who is replying right now: a short-lived marker (a few minutes) while someone has a conversation open to reply to.
• Who approved a queued reply: kept with that queued reply for as long as the queue record is kept.

We do not use this to monitor or rate the people you add, and it is shown only to other people on the same mailbox. As the controller, you are responsible for telling your own staff and contractors that this is recorded, and for making sure the enquirers whose messages your team will see have been given the information the law requires. A person you add also has their own Sprevi account; their account details are handled as set out in section 2, and they can ask us (or you) to delete it.

7. Your Rights Under UK GDPR

As the data controller for your account data, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Ask us to correct inaccurate data.
• Right to erasure ("right to be forgotten"): Request deletion of your account and all associated data. Use the account deletion option in Settings, or contact us.
• Right to restriction: Ask us to pause processing your data while a dispute is resolved.
• Right to data portability: Receive your account data in a machine-readable format.
• Right to object: Object to processing based on legitimate interests.

To exercise any of these rights, contact us at privacy@sprevi.com. We will respond within 30 days. If you are unhappy with our response, you have the right to lodge a complaint with the ICO at ico.org.uk/make-a-complaint.

8. Cookies

We use one essential cookie to keep you logged in. If you tick "Stay signed in on this device" at login we also set a second essential cookie, used only for that, which lasts up to 60 days from when you last used the device and is removed when you log out or remove the device in Settings. On our public pages (the home page, About pages and sign-in) we may use analytics to count visits, with your consent where the law requires it. Nothing inside the app, and nothing from your mailbox, is sent to an analytics provider. Disabling cookies will prevent you from logging in.

9. Changes to This Policy

We may update this policy as the Service evolves or as legal requirements change. Material changes will be notified by email to the address on your account at least 14 days before they take effect. The "Last updated" date at the top of this page reflects when the policy was last substantively changed.