Privacy Policy

Revloom | https://revloom.in

Version: 1.0 | Effective date: 2nd November, 2026. |
Last updated: 2nd November, 2026.

This Privacy Policy is a standalone document. It works together with, but does not depend on, our Terms and Conditions.

Who we are: Revloom is a sole proprietorship based in Indore, India. We provide LinkedIn ghostwriting, content and social media management, profile optimization, lead lists, outreach management and consultations to businesses and professionals.
Two roles: For our own website, enquiries, billing and marketing, we decide why and how your data is used (we are the "controller" or "Data Fiduciary"). When we build lead lists or run outreach for a client, the client decides the purpose and we act on its instructions (we are the "processor" or "Data Processor").
What we collect: Contact details, business and billing details, content you give us, account access details you choose to share for account management, payment records, public business information about prospects, and basic website data.
What we do not do: We do not sell your personal data. We do not knowingly collect data from anyone under 18.
Sharing: We share data only with service providers and others described in Section 7, or where the law requires.
Overseas processing: We are in India and use tools that may process data in other countries (Section 9).
Your rights: Depending on where you live, you may access, correct, delete, restrict or object to our use of your data, withdraw consent, and complain to a regulator (Section 12).
Contact: janhvi@revloomconsults.com or the WhatsApp chat button on our website. Our Grievance Officer is named in Section 18.
No system is perfectly secure. We use reasonable safeguards but cannot guarantee absolute security.

About this Policy and who we are
Who this Policy applies to, and our roles
Personal data we collect, why, and for how long
Data collected automatically; cookies
Lead-generation and outreach data
How we use personal data and our legal bases
Sharing and disclosure
Use of AI tools
International transfers
Retention
Security and data breaches
Your rights
Children
Marketing communications
Third-party links and platforms
Do Not Track and Global Privacy Control
Changes to this Policy; version history
Contact, Grievance Officer and complaints

1. About this Policy and who we are

1.1 This Policy explains how Revloom ("Revloom", "we", "us", "our") collects, uses, shares and protects personal data, and the choices you have.

1.2 Revloom is the trading name of a sole proprietorship owned by Janhvi Rawat & Company. Our principal address is 20 Bijli Nagar, near Bicholi Hapsi Road, Indore, Madhya Pradesh 452016, India.

1.3 Contact: email janhvi@revloomconsults.com; chat via the WhatsApp button on https://revloom.in. Business registrations: "NOT REGISTERED"; Udyam registration INDO260507SE001040.

1.4 Personal data means information about an identified or identifiable individual. You means anyone whose personal data we handle under this Policy.

1.5 Data Fiduciary (India) and controller (UK/EU and similar laws) mean the party that decides why and how personal data is used. Data Processor and processor (and "service provider" or "contractor" under some US state laws) mean a party that handles personal data on someone else's instructions.

2. Who this Policy applies to, and our roles

2.1 This Policy applies to: (a) visitors to our website; (b) clients and prospective clients and their representatives; (c) newsletter or marketing subscribers [IF ANY]; (d) people who apply to work with us as employees or contractors; and (e) third parties (for example, prospects in a lead list) whose personal data we handle for a client.

2.2 Where we are the Data Fiduciary / controller. We decide the purposes for website operation, enquiries, onboarding, billing, our own marketing, recruitment, security and legal compliance. This Policy is our notice to you for that data.

2.3 Where we are a Data Processor. When we build lead lists, send or manage outreach, or handle prospect or audience data on a client's behalf, the client decides why and how the data is used and is responsible for having a lawful basis and giving you any required notice. We follow the client's documented instructions under a data processing addendum (see Terms, Annex). If you are a prospect and want to exercise a right about data we hold for a client, you may contact us or the client; we will help route and action your request (Section 12).

2.4 Our services are for businesses and professionals, not for personal or household use.

3. Personal data we collect, why, and for how long

3.1 The table below lists what we collect. "Legal basis" applies to UK/EU data protection law. Indian law grounds are explained in Section 6. Periods in square brackets are our standard periods and may be longer where the law or a dispute requires.

Category
Examples
Source
Main purposes
Legal basis (UK/EU)
Retention
Enquiry and contact data
Name, email, company, role, message, WhatsApp number and chat content
You
Respond, prepare quotes, book consultations
Steps before a contract; legitimate interests
24 MONTHS after last contact
Client onboarding and account data
Name, business name, role, address, tax identifiers, brand voice and positioning information

You

Provide services, manage the engagement
Contract
Engagement duration, then 12 MONTHS
Client materials and content
Interview notes, drafts, posts, profile details, comments, analytics screenshots
You; your LinkedIn account if you give us access
Create, edit, schedule and report on content
Contract
12 MONTHS after delivery or engagement end

Account access details

You

Manage the accounts you ask us to manage
Contract; your consent
Only while needed; removed within [7 DAYS] of engagement end (we ask you to change your password)
Payment and invoicing data
Amount, date, payer name, transaction ID, billing address, tax details
You; payment provider
Take payment, issue invoices, tax compliance
Contract; legal obligation

[6 YEARS]

Prospect and lead data (as Processor unless stated)
Name, job title, employer, business email, business phone, LinkedIn URL
Data vendors (e.g., Apollo, LeadFinder, Clay), public sources, the client
Build lead lists, run outreach for a client
Client's legitimate interests (or consent where required)
Delivered list deleted within [90 DAYS] of delivery, unless the client instructs otherwise in writing
Outreach replies and suppression records
Replies, opt-outs, "do not contact" markers
Recipients
Handle replies; honour opt-outs
Legitimate interests; legal obligation
As long as needed to honour your opt-out or objection
Newsletter or marketing data [IF ANY]
Name, email, preferences

You

Send updates you asked for
Consent
Until you unsubscribe, plus [30 DAYS]
Website technical data
IP address, device and browser type, pages visited, referrer
Automatically
Security, performance, analytics
Legitimate interests; consent for non-essential cookies
See cookie table in Section 4
Communications records
Emails, WhatsApp messages, call notes

You; us

Manage the relationship; keep evidence
Contract; legitimate interests
3 YEARS after last contact
Job or contractor applications
Name, CV, contact details, work samples
You
Assess applicants
Steps before a contract; legitimate interests
12 MONTHS after decision

3.2 Sensitive data. We do not ask for special categories of personal data (for example health, religion, political opinions, biometric or financial account data). Please do not send them. Account passwords are treated by Indian rules as sensitive personal data. We collect them only if you choose to give them to us for account management, and only for that purpose.

3.3 Payment card data. Card payments are handled by our payment provider. We do not store full card numbers.

3.4 You may choose not to provide personal data, but we may then be unable to provide some services.

4. Data collected automatically; cookies

4.1 When you visit our website, we and our providers may automatically collect technical data such as IP address, device and browser details, pages viewed and referrer.

4.2 Cookies and similar technologies are small files or scripts stored on or read from your device. We use them as shown in the table below.

Category - Marketing
Purpose - Services and Consulting
Examples - As shown on the home page
Typical duration - Monthly retainers, can go upto 1 year
Consent needed - Signed by the client in NDA
Strictly necessary - Yes
Session to 12 MONTHS - Yes

4.3 How to withdraw or change consent. Use the cookie settings link in the website footer, or change your browser settings. Blocking some cookies may affect how the site works.

4.4 UK/EU visitors. Non-essential cookies are used only with your consent, other than any category that UK or EU law allows without consent. We do not use advertising cookies unless the table says so.

5. Lead-generation and outreach data

5.1 What we use. For client lead lists we use business contact information from reputable data providers (for example Apollo, LeadFinder and Clay) and from publicly available professional sources. We do not buy data from sellers that we have reason to believe obtained it unlawfully, but we rely on each provider's statements about how its data was sourced.

5.2 Purpose and basis. The purpose is B2B outreach for the client. In UK/EU terms the basis is normally legitimate interests, after a balancing assessment, or consent where the law requires it for the channel used. In India the client determines the ground under the Digital Personal Data Protection Act, 2023 ("DPDP Act") once its provisions apply.

5.3 What we do on LinkedIn. Outreach on LinkedIn is done manually by our team and not through bots or automation tools. Automated tools are used only for email outreach, and only after the client has authorised it.

5.4 Opt-out, objection and deletion. Every outreach email includes a working unsubscribe or opt-out option, and we honour opt-out requests received by reply, by email to janhvi@revloomconsults.com or by chat. We keep a suppression record so you are not contacted again. You may object to our use of your data or ask us to delete it at any time; see Section 12.

5.5 Source on request. If you ask where we obtained your data, we will tell you the provider or source, or tell the client so that it can respond.

6. How we use personal data and our legal bases

6.1 We use personal data to: provide and manage services; respond to enquiries; take payment and keep tax and accounting records; communicate with you; protect our systems and prevent fraud or misuse; send marketing where permitted; improve our website and services; comply with law; and establish, exercise or defend legal claims.

6.2 UK/EU. Our legal bases are the ones shown in the table in Section 3: contract (or steps before one), legitimate interests, consent, and legal obligation. Where we rely on legitimate interests, our interests are running and promoting a business, securing our systems, and B2B outreach on behalf of clients; we balance these against your rights and you may object.

6.3 India. Under the DPDP Act, we process personal data on the basis of your consent or for "legitimate uses" recognised by the Act (for example, where you voluntarily provide data for a stated purpose and do not object, or to comply with law). Where consent is the basis, you may withdraw it at any time; withdrawal does not affect earlier processing. Until the DPDP Act's main obligations apply, we also follow the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 to the extent they still apply.

6.4 Other regions. Where local law (for example the UAE federal data protection law, or the DIFC or ADGM regimes) requires a specific legal ground, we rely on consent, contract, legal obligation or our legitimate interests, as that law allows.

6.5 Automated decisions. We do not make decisions about you that have legal or similarly significant effects solely by automated means.

7. Sharing and disclosure

7.1 We do not sell personal data. We share it only as follows:

Service providers (processors and sub-processors) that help us run the business.
Platforms you or we use for the services, such as LinkedIn and email platforms.
Professional advisers, such as accountants and lawyers, under confidentiality duties.
Authorities and legal requirements, where we believe disclosure is required by law, court order or valid legal process, or is needed to protect rights, safety or security.
Business transfer. If the business is sold, merged or transferred, data may be transferred to the successor, which must honour this Policy.
With your direction or consent.

7.2 Main vendor categories (this list may change; the current list is available on request):

Category:

Workspace, storage and email - Google Workspace
Documents, email, file storage- Messaging , WhatsApp (Meta) , Email
Chat and client communication/ Professional network - LinkedIn
Content publishing and outreach - Sales Navigator
Lead data providers - Apollo, LeadFinder, Clay, Others
Payments and invoicing - RAZORPAY / STRIPE / PAYPAL / WISE / BANK TRANSFER, UPI & OTHERS
Design and collaboration - Subjective

7.3 Our team. Employees, freelancers and subcontractors who need access to deliver services or run the business may access personal data under written confidentiality obligations.

8. Use of AI tools

8.1 We may use AI-assisted tools for tasks such as research, drafting support, editing and formatting.

8.2 We do not enter a client's confidential materials or personal data into third-party generative AI tools unless the client has agreed to this (for example in a Service Order or in written messages with us). We do not enter prospect or lead-list personal data into generative AI tools.

8.3 Humans review our deliverables before delivery. We do not use AI tools to make decisions about individuals that have legal or similarly significant effects.

8.4 If you want us not to use AI tools on your work at all, tell us in writing before work starts.

9. International transfers

9.1 We are based in India. Our providers and clients are in many countries, so personal data may be processed in India, the United States, the European Economic Area, the United Kingdom, the UAE and other places where our providers operate.

9.2 From the UK/EU to India or other countries. Where UK or EU law restricts the transfer, we use an approved safeguard such as standard contractual clauses (EU), the UK International Data Transfer Agreement or the UK Addendum to the EU clauses, or an adequacy decision or the EU-US/UK-US Data Privacy Framework where the recipient is certified. India does not currently have an EU or UK adequacy decision, so we do not rely on adequacy for transfers to ourselves. Copies of safeguards are available on request, with commercially sensitive terms removed.

9.3 From India. The DPDP Act allows transfers outside India except to countries the Government restricts by notice. We will follow any restriction notified.

9.4 From the UAE and other GCC countries. Where local law requires a specific condition for sending data outside the country (for example adequacy, a contract with safeguards, or consent), we apply it. Where a client provides GCC-resident data for processing, the client's data processing addendum sets out the safeguards.

9.5 From the US. We do not sell personal information. See Section 12.4.

10. Retention

10.1 We keep personal data only as long as needed for the purposes in this Policy, to meet legal, tax and accounting duties, and to establish, exercise or defend legal claims. Periods are in the table in Section 3.

10.2 We may keep data longer where a dispute, investigation or legal hold is open, or where law requires it. We delete or anonymise data when the period ends. Backups may take up to 90 DAYS to cycle out.

10.3 Client credentials shared for account management are removed as stated in Section 3. Clients should change passwords and remove our access when an engagement ends.

11. Security and data breaches

11.1 We use reasonable administrative, technical and organisational safeguards, such as access limited to people who need it, strong and unique passwords, multi-factor authentication where available, use of reputable providers, and written confidentiality obligations for our team. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

11.2 If a personal data breach occurs, we will investigate, contain it, and notify people and authorities as the law requires. In particular: (a) UK/EU: we notify the supervisory authority within 72 hours of becoming aware where feasible and where the breach is likely to result in a risk to individuals; (b) India: we follow the DPDP Act and Rules once they apply, and report specified cyber incidents to CERT-In within the time the CERT-In Directions require (currently 6 hours of noticing, where those Directions apply to us); (c) US: we follow the breach notification law of the relevant state; (d) UAE/GCC: we follow the applicable local law.

11.3 Where we are a Data Processor, we tell the affected client without undue delay and, where feasible, within 72 hours of becoming aware, so that the client can meet its own duties.

12. Your rights

12.1 How to exercise your rights. Email janhvi@revloomconsults.com with the subject "Privacy request", or use the WhatsApp chat on our website and ask for the privacy contact. Tell us who you are, what you want, and (for prospect or lead data) the email address or LinkedIn profile at which we may have your data.

12.2 Verification. We may ask for information to confirm your identity or, if someone acts for you, their authority. We use that information only to handle your request.

12.3 Timelines. We acknowledge requests within 48 hours and respond within 30 days, or within any longer period that the applicable law allows. If we need more time or cannot comply, we will tell you why. We do not charge a fee unless the law allows one for manifestly unfounded or excessive requests.

12.4 United States.

12.4.1 Residents of states with comprehensive privacy laws (for example California, Virginia, Colorado, Connecticut, Texas and others) may have rights to know or access, correct, delete, obtain a portable copy, and opt out of the sale or sharing of personal data, targeted advertising and certain profiling, and not to be discriminated against for exercising rights. Residents of some states may also limit use of sensitive data. We consider requests in good faith and will apply these rights as far as is practicable even where we are below a law's thresholds.

12.4.2 Sale and sharing. We do not sell personal information and we do not share it for cross-context behavioural advertising. In the past 3 years, we have not sold or shared personal information.

12.4.3 Categories collected (past 12 months). Identifiers (name, email, IP address); commercial information (purchases, enquiries); internet or network activity (site usage); professional information (job title, employer); and information you give us in messages and content. We collect these for the purposes in Section 6 and disclose them to the recipient categories in Section 7.

12.4.4 California. California's "Shine the Light" law lets California residents ask which personal information we shared with third parties for their direct marketing. We do not share it for that purpose.

12.4.5 Appeals. If we decline a request, you may appeal within 30 days by replying with the word "Appeal" and your reasons. We respond to appeals within 45 days or any shorter period the law requires. You may also contact your state attorney general.

12.5 United Kingdom and European Economic Area. Subject to conditions, you have the right to be informed, to access your data, to have it corrected or erased, to restrict or object to processing (including an absolute right to object to direct marketing), to data portability, to withdraw consent at any time, and not to be subject to certain solely automated decisions. You may complain to a supervisory authority (Section 18).

12.6 India. Under the DPDP Act, once the relevant provisions apply, you have the right to: obtain a summary of your personal data and the processing we do and the parties we have shared it with; correct, complete or update your data; have it erased when no longer needed for its purpose or the law; use our grievance redressal mechanism; and nominate another person to exercise your rights if you die or become incapacitated. You may also withdraw consent. You also have duties: to comply with applicable law, not to impersonate another person, not to suppress material information when giving data, not to file false or frivolous grievances, and to furnish only verifiably authentic information when exercising your rights. We offer these rights now, ahead of the legal start date, as a matter of practice.

12.7 UAE and other GCC countries. Depending on where you live and the law that applies (for example the UAE federal data protection law, the DIFC or ADGM data protection rules, or the laws of Saudi Arabia, Qatar, Bahrain, Oman or Kuwait), you may have rights to information, access, correction, erasure, restriction, objection, portability and to withdraw consent. We will handle your request using the process above and apply the rights that your local law gives you.

12.8 If you are unhappy with our response, please first contact our Grievance Officer (Section 18). You can also complain to a regulator at any time.

13. Children

13.1 Our services and website are not directed to anyone under 18, and we do not knowingly collect personal data from anyone under 18. We do not knowingly collect data from children under 13 (COPPA).

13.2 If we learn that we hold personal data of a person under 18 without valid verifiable parental consent, we will delete it. If you believe this has happened, contact us at janhvi@revloomconsults.com.

14. Marketing communications

14.1 We send our own marketing emails or messages only where you have asked for them or where the law permits, and each one tells you how to opt out. You can opt out at any time by using the unsubscribe link, emailing janhvi@revloomconsults.com or telling us in chat. We act on opt-outs within 10 BUSINESS DAYS and sooner where the law requires.

14.2 We comply with the rules that apply to the channel and the recipient, including CAN-SPAM (US: accurate sender details, a physical postal address, an unsubscribe mechanism), the UK Privacy and Electronic Communications Regulations (consent rules, including for sole traders and partnerships), and Indian telecom commercial-communication rules where they apply to calls and SMS.

14.3 Service messages for example invoices and project updates are not marketing and may still be sent.

15. Third-party links and platforms

15.1 Our website and communications may link to or use third-party sites and platforms, such as LinkedIn, WhatsApp, Google and payment providers. Those parties have their own privacy policies and terms, and we are not responsible for their practices. Please read them.

15.2 When we work in your LinkedIn account, LinkedIn's own terms and privacy policy continue to apply to you and to your account.

16. Do Not Track and Global Privacy Control

16.1 Our website does not currently respond to "Do Not Track" browser signals, because there is no common standard for them.

16.2 Where we set non-essential cookies or any tracking technology, we treat a valid Global Privacy Control signal as a request to opt out of sale or sharing and of non-essential tracking for that browser, as far as our tools allow.

17. Changes to this Policy; version history

17.1 We may update this Policy. We will post the new version here with a new date. If a change is material, we will give notice by email to our clients and by a notice on the website, and where the law requires consent we will ask for it again. Older versions are available on request.

17.2 Version history:

Version - Latest

Date - 2nd November 2026

18. Contact, Grievance Officer and complaints

18.1 Revloom (sole proprietorship - Janhvi Rawat & Company - 20 Bijli Nagar, near Bicholi Hapsi Road, Indore, Madhya Pradesh 452016, India. Email: janhvi@revloomconsults.com. Chat: WhatsApp button on https://revloom.in.

18.2 Grievance Officer / privacy contact (India and others): Janhvi Rawat, Founder - Revloom ; email janhvi@revloomconsults.com. We acknowledge grievances within 48 hours and aim to resolve them within 30 days.

18.3 Complaints to authorities. You may complain to the regulator in your country, including: India: the Data Protection Board of India (once the DPDP complaint process applies, normally after you have used our grievance process); United Kingdom: the Information Commissioner's Office (ico.org.uk); EU/EEA: the supervisory authority in your country of residence, work or the place of the alleged infringement; United States: your state attorney general and the Federal Trade Commission; UAE: the UAE Data Office, or the DIFC Commissioner of Data Protection or the ADGM Office of Data Protection if the matter falls in those zones; Saudi Arabia: the Saudi Data and AI Authority (SDAIA); other GCC countries: the competent national data protection authority.

18.4 This Policy is governed by Indian law, without limiting any mandatory rights you have under the law of the place where you live. Disputes about our services are governed by our Terms and Conditions.

18.5 Jurisdiction and Dispute Resolution. Any disputes, claims or legal proceedings arising out of or in connection with this Policy, our services, or our business relationship with you shall be subject to the exclusive jurisdiction of the competent courts in Indore, Madhya Pradesh, India, including the High Court of Madhya Pradesh, Bench at Indore, wherever applicable. All such disputes shall be governed by the laws of India, subject to any mandatory consumer protection or data protection rights applicable in your country of residence.

Contents