Privacy Policy

Last updated: October 21, 2026
(Previous version: June 28, 2026)

1. Introduction

RevSplitPay ("we", "our" or "us") operates the RevSplitPay platform, a secure, multi-tenant revenue-splitting, commission and payout service, at app.revsplitpay.com. The platform is operated by RevSplitPay Limited, a company registered in Ireland.

This Privacy Policy explains how we collect, use, disclose and safeguard personal data when you use our platform. It applies to:

• business owners and admins;
• team members;
• people who pay a business through a page we host ("customers");
• anyone else who contacts us.

Our role:

• We are the data controller for the personal data we use to run our own service: accounts, sign-in, our billing, security, support and service communications.
• When a business uses RevSplitPay to manage its customers' and team members' data (sales, payment details received from the payment provider, commissions, invoices, awards), the business decides why that data is processed and is the controller. We process it on the business's behalf as its processor, to provide the service.

This policy also serves as our disclosure under the General Data Protection Regulation (GDPR), and under applicable national data protection laws, for people in the European Economic Area (EEA), the United Kingdom or Switzerland. We have not appointed a Data Protection Officer (DPO). All data-related enquiries should be directed to the contact address in section 15.

Please read this policy carefully. If you disagree with its terms, please discontinue use of the platform.

2. Information We Collect

Account information:

• name, email address and profile data you provide when signing up;
• or the same details received from your Google account if you sign in with Google;
• your role in each workspace.

Business information:

• organisation name, workspace identifiers (slugs), country and products;
• checkout links, payment plans and settings;
• team structure, commission rates and workspace configuration.

Financial and payout information:

• payment account identifiers and the status of your payout account at the payment provider (for example whether it is verified and its country);
• payout settings;
• transaction, commission, payout, invoice and award records.

We do not store full payment card numbers or bank account numbers. Payment processing and identity verification for payout accounts are handled by our payment providers (Stripe or Whop).

Billing information (businesses):

• your plan and billing history;
• promotional codes used;
• card brand and last four digits, as provided by Stripe.

Customer information (the business's customers, processed on the business's behalf):

• name and email address;
• payment references and amounts;
• payment schedules;
• payment status, as received from the payment provider or entered by the business.

Content you submit:

• invoices and payment requests;
• awards;
• notes, messages and support requests;
• integration settings (for example a Slack workspace and channel, or webhook addresses).

Public profile information: if a team member chooses to share their public profile, the verified results, rank and badges shown on it.

Usage and device data:

• pages visited and features used;
• timestamps;
• IP addresses;
• device and browser information.

This data is collected automatically, including through privacy-friendly, cookieless analytics (see section 9).

Communications:

• messages and support requests you send to us;
• records of the service emails we send you (for example welcome, payout, achievement and billing emails).

3. Lawful Basis for Processing (GDPR)

If you are located in the EEA, UK or Switzerland, we rely on the following lawful bases under Article 6 GDPR:

• Performance of a contract (Art. 6(1)(b)): processing account, business, financial and billing information is necessary to provide RevSplitPay. That includes:
  • processing revenue splits;
  • facilitating payouts;
  • billing your plan;
  • sending service emails.
• Legitimate interests (Art. 6(1)(f)): we process usage data and communications to:
  • monitor platform security;
  • detect and prevent fraud;
  • resolve disputes;
  • improve our service.

  Our legitimate interests do not override your fundamental rights.

• Legal obligation (Art. 6(1)(c)): we retain financial transaction records and disclose data to authorities where required by applicable law.
• Consent (Art. 6(1)(a)): where we rely on consent (for example for any non-essential cookies, if we introduce them, or for marketing emails), you may withdraw it at any time without affecting the lawfulness of prior processing.

For customer and team data we process on a business's behalf, the business is responsible for its own lawful basis.

4. How We Use Your Information

We use the information we collect to:

• provide, operate and maintain the RevSplitPay platform;
• process revenue splits, commissions, invoices and awards, and facilitate payouts through our payment providers;
• bill subscription plans, seats and platform fees;
• authenticate users and enforce role-based access controls;
• send service notifications, alerts and emails (for example new sales, payouts, failed payments, plan and billing notices);
• deliver data to integrations you connect (Slack, webhooks);
• monitor platform health, detect fraud and improve security;
• comply with legal obligations and resolve disputes;
• analyse usage trends, using anonymised or aggregated data where possible, to improve our service.

We do not use your personal data for solely automated decision-making that produces legal or similarly significant effects on you. Fraud-detection signals are reviewed by our team before any account action is taken.

Within a workspace, some information is visible to others:

• the owner and admins can see team members' commissions, payouts and payout-account status;
• team members see their own records and limited information about their team (for example the member list and leaderboard).

5. Sharing of Information

We do not sell your personal information. We share data only as needed to provide the service, with the following providers and recipients:

6. International Data Transfers

We are based in Ireland, and our main database is hosted in the EU (Ireland). Some of our service providers (including Stripe, Whop, Clerk, Vercel and Resend) are based in, or process data in, the United States and other countries. Those countries may not provide the same level of data protection as your home jurisdiction.

Where personal data is transferred outside the EEA, UK or Switzerland, we rely on appropriate safeguards:

• the EU–US Data Privacy Framework (and its UK and Swiss extensions), where the provider is certified;
• Standard Contractual Clauses (SCCs) approved by the European Commission, where providers offer them;
• the provider's contractual obligations to protect your data in accordance with applicable data protection law.

You may request a copy of the relevant transfer mechanisms by contacting us at the address in section 15.

7. Data Retention

We retain personal data only for as long as necessary:

• Account and business information: retained for the duration of your account. It is deleted within 90 days of a verified account or workspace deletion request, unless retention is required by law.
• Financial transaction records (payments, commissions, payouts, invoices, awards, plan billing): retained for up to seven (7) years to comply with applicable accounting and tax regulations. For this reason, a workspace with payment history may be closed but its financial records are kept.
• Usage data (IP addresses, logs): retained for up to 12 months for security and fraud-detection purposes.
• Support communications: retained for up to three (3) years to support dispute resolution.
• Records of emails sent: retained for up to 12 months.

You may request deletion of your account at any time. Certain data may be retained where required by law.

8. Security

We implement industry-standard security measures, including:

• encryption in transit (TLS);
• encryption at rest by our infrastructure providers;
• role-based access controls;
• verification of payment-provider messages (webhook signatures);
• secure third-party authentication (OAuth 2.0 through our authentication provider).

Card data is handled by our payment providers and never stored by us.

While we strive to protect your data, no system is completely secure, and we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the relevant authorities as required by law.

9. Cookies

We use a small number of cookies and similar technologies that are strictly necessary for the platform to work, such as sign-in and security cookies. We also use a few preference settings, such as your light or dark theme and whether the sidebar is open.

Our analytics are cookieless: they do not store cookies or similar identifiers on your device. We do not use advertising or cross-site tracking cookies, so we do not currently show a cookie consent banner. If we ever introduce non-essential cookies, we will ask for your consent first.

Payment pages hosted by Stripe or Whop may set their own cookies, for example for fraud prevention. Those are governed by the providers' own policies.

Full details are in our Cookie Policy.

10. Your Rights

If you are located in the EEA, UK or Switzerland, you have the following rights under the GDPR and applicable data protection law. Users in other jurisdictions may have similar rights under their local law.

• Right of access (Art. 15): request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): request deletion of your account and associated personal data, subject to legal retention obligations.
• Right to restriction (Art. 18): request that we restrict processing of your data in certain circumstances.
• Right to data portability (Art. 20): receive the personal data you have provided to us in a structured, commonly used, machine-readable format, and transmit it to another controller.
• Right to object (Art. 21): object to processing based on legitimate interests, including profiling.
• Right to withdraw consent: withdraw consent at any time where processing is based on consent, without affecting prior lawful processing.

To exercise any of these rights, contact us at revsplitpay@gmail.com. We will respond within 30 days, and may need to verify your identity before fulfilling a request.

If you are a customer or team member of a business on RevSplitPay, the business is the controller of your data in its workspace. We may refer your request to the business, or help it respond.

11. Right to Lodge a Complaint

If you believe we have processed your personal data in violation of applicable law, you have the right to lodge a complaint with a data protection supervisory authority:

• our lead supervisory authority is the Data Protection Commission (Ireland);
• in the UK, the Information Commissioner's Office (ICO);
• in the EU, you may also complain to the supervisory authority in the member state of your habitual residence, place of work, or where the alleged infringement took place.

We encourage you to contact us first so we can try to resolve your concern directly.

12. Children's Privacy

RevSplitPay is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us immediately and we will take steps to delete it.

13. Emails We Send

We send service emails that are part of using the platform. You cannot opt out of service emails while you have an account, because they carry information about your money and access. They include:

• welcome emails;
• notices about sales, payouts and failed payments;
• achievement emails;
• invoice and award emails;
• plan, trial and billing notices.

We do not send marketing emails without your consent, or where otherwise permitted by law. Every marketing email will include an unsubscribe link.

14. Changes to This Policy

We may update this Privacy Policy periodically. When we make material changes, we will notify users via email or a prominent notice on our platform at least 14 days before the change becomes effective. The current policy is always available on our website.

Continued use of RevSplitPay after the effective date constitutes acceptance of the updated policy.

15. Contact Us

If you have questions or concerns about this Privacy Policy, or wish to exercise your data rights, please contact us at:

RevSplitPay (Data Controller)
RevSplitPay Limited, Ireland
Email: revsplitpay@gmail.com