Privacy Policy

1. Who is responsible (Controller)

The controller within the meaning of Article 4(7) GDPR is:

Revis-1 LLC, trading as Usantis
2645 Executive Park Drive, 33331 Weston, Florida, United States of America
Represented by: Manuel Horn, Managing Director
Email: [email protected]

2. EU representative (Article 27 GDPR)

As a service operator established outside the European Union, we have designated the following representative in the EU pursuant to Article 27 GDPR:

Manuele Fink
Bohlstrasse 2, 78579 Mahlstetten, Germany
Email: [email protected]

You may contact our EU representative for any data-protection matter, including the exercise of your rights as a data subject, in any official language of the European Union.

3. Data protection contact

For all data-protection matters and to exercise your rights under Chapter III GDPR (access, rectification, erasure, restriction, portability, objection, automated decision-making), please contact [email protected].

4. What data we process, why and on what legal basis

We process personal data for the following purposes; the table summarises the scope, legal basis, retention and source for each.

We do not knowingly process special categories of personal data (Article 9 GDPR) unless we agree this in writing with you in advance.

5. Where the data comes from

• Directly from you (account information, onboarding data, support correspondence).
• From third parties acting on your behalf (e.g. your authorised signatory uploading documents during onboarding).
• From technical sources (your browser when you visit the website, our application logs).
• From our identity-verification provider (Stripe Identity) when you verify your identity.

6. Service providers (sub-processors)

We use carefully selected processors that are bound by written data-processing agreements with technical and organisational measures equivalent to ours. The critical processing path is hosted in the European Union.

The current sub-processor list is also set out in Annex 2 of our DPA. Customers are notified of changes in line with our DPA.

7. International transfers

We keep the critical processing path (application, database, backups) within the European Union (Hetzner, Germany and Finland). Some service providers are located in, or transfer data to, third countries. For transfers to the United States we rely on the EU-US Data Privacy Framework where the recipient is certified (for example Cloudflare and Stripe, including Stripe Identity), supplemented by the European Commission’s Standard Contractual Clauses (2021/914) as a fallback. A Transfer Impact Assessment is performed and is available on request.

Application data at rest is stored in the European Union. Website traffic is routed through Cloudflare’s edge network, which terminates TLS and may process connection metadata and transient request content in the United States; no application data is stored there. The eSignature provider is Skribble (data hosted in Germany via IONOS; Skribble AG seat in Switzerland under the EU adequacy decision); hosting is Hetzner in Germany and Finland; analytics run on Plausible in Estonia.

8. How long we keep data

We keep personal data only as long as necessary for the purpose for which it was collected, and then delete or anonymise it. Where statutory retention obligations apply (in particular German tax law), we retain data for the statutory minimum period. Specific retention periods are listed in the table in Section 4.

Account data is removed in line with the schedule in our Information Security Policy (default: anonymisation 30 days after termination of the mandate; full deletion 90 days after termination, subject to retention obligations).

9. Your rights as a data subject

Under the GDPR, you have the following rights:

• Right of access (Art. 15) — obtain confirmation of and a copy of your personal data and the information required by Art. 15(1).
• Right to rectification (Art. 16) — have inaccurate personal data corrected without undue delay.
• Right to erasure (Art. 17) — have your personal data erased in defined circumstances.
• Right to restriction of processing (Art. 18) — limit how we process your data.
• Right to data portability (Art. 20) — receive your data in a structured, commonly used and machine-readable format.
• Right to object (Art. 21) — including against processing based on legitimate interests and against direct marketing at any time.
• Right not to be subject to a decision based solely on automated processing (Art. 22) — we do not currently apply automated decision-making with legal effects.
• Right to withdraw consent (Art. 7(3)) — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, email [email protected]. We respond within one (1) month; this period may be extended by up to two further months for complex requests, in which case we will inform you.

Right to lodge a complaint with a supervisory authority (Art. 77): You have the right to lodge a complaint with the data protection authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. A list of national authorities is maintained by the European Data Protection Board (edpb.europa.eu).

10. Cookies and analytics

We keep cookies to the minimum needed to run the Service and use cookieless analytics (Plausible). We do not use advertising, retargeting, social-plugin or third-party tracking cookies. Details are in our Cookie Policy.

11. Security

We apply technical and organisational measures appropriate to the risk, including:

• Encryption in transit (TLS 1.3) and at rest.
• Field-level encryption (AES-256-GCM) for sensitive personal data (addresses, emails, VAT-IDs).
• Role-based access control with mandatory multi-factor authentication for administrative access.
• Append-only audit log with a cryptographic hash chain for tamper-evidence.
• Daily encrypted backups with quarterly restore tests.
• Annual external penetration tests and quarterly vulnerability scans.

A more detailed description is available in our Technical and Organisational Measures document on request via [email protected].

12. Automated decisions, profiling, AI

We do not currently apply automated decision-making with legal or similarly significant effects on you (Article 22 GDPR). Identity-verification scoring by our KYC provider produces a recommendation that is reviewed by a human before any onboarding decision is made. We do not train AI models on Customer personal data and do not pass Customer personal data to third-party generative AI providers.

13. Sources for data we did not receive from you

Where we receive personal data about you that did not come from you directly (in particular: identification data of beneficial owners of our Customer; sanctions-list matches; details forwarded by your authorised representative), the categories and sources are described in Section 5 and the legal bases are in the table in Section 4. We comply with Article 14 GDPR for indirect collection.

14. Changes to this policy

We may update this policy as the Service evolves. The current version is always available at usantis.com/privacy. Material changes that affect account holders are notified by email. For other changes, the updated version takes effect with publication.

15. Contact

Controller: Revis-1 LLC (trading as Usantis), 2645 Executive Park Drive, 33331 Weston, Florida, USA. General: [email protected].

EU representative: Manuele Fink, Bohlstrasse 2, 78579 Mahlstetten, Germany.

Data protection: [email protected].