Privacy Policy

Scope

This Privacy Policy explains how Revecorp Inc. (“Revecorp,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information in connection with:

• The Revecorp website at revecorp.com and the MAQS product website at maqs.io, along with any linked pages we control (together, the “Websites”).
• Revecorp’s products and mobile applications, including the MAQS platform, the TransitCheck application, and the VINTerpreter℠ application, together with their related services and web portals (together, the “App”).

Revecorp builds, owns, and operates both the Websites and the products, which is why a single policy covers all of them. Where a practice applies to only one service, this Policy identifies it. If any part of this Policy conflicts with a service-specific notice presented inside a product or Website, the service-specific notice will govern for that service. A current list of all active service-specific notices is maintained on our Websites and within the App under Settings > Privacy.

Who We Are and How to Contact Us

Revecorp Inc. owns and operates the Websites and the App. For any privacy request, including exercising your rights, asking questions, or filing a complaint, you can reach us below.

For users subject to the GDPR, UK GDPR, or PIPEDA, our designated Data Protection Officer can be reached at privacy@revecorp.com.

Information We Collect

On the Websites, we collect the information you submit through contact and inquiry forms and when you place an order, such as your name, business name, email address, phone number, and billing or shipping address, along with standard server log data. Orders on the Websites are placed by purchase order, and we do not collect or process credit card or bank account numbers on the Websites.

Across our products, we collect personal information directly from you, automatically from your device, from your employer or organization if it authorizes your App use, and from service providers that assist us. The categories include:

• Identifiers. Name, user ID, email address, phone number, postal address, IP address, online identifiers, and device identifiers including Android ID.
• Device and technical data. Device make and model, operating system version, screen resolution, app version, crash and performance logs, and telemetry from interactions with our web services.
• Internet or network activity. Log data for the Websites and App, pages viewed, session duration, referrers, and actions taken within the App or portal.
• Geolocation data. When location permissions are enabled in the App, including precise GPS data while the App is open or running in the background if your organization requires continuous tracking.
• Multimedia and content. Photos, videos, and voice recordings that you choose to upload for documentation.
• Transaction and account data. Orders, subscriptions, job or asset records created in the App, support requests, and audit logs.
• Professional or employment information. When the App is used for inspections or other work tasks.
• Sensitive personal information. As defined by applicable laws, which may include precise geolocation, biometric templates if enabled, and government-issued identifiers captured in photos or forms. We do not intentionally collect Social Security numbers or financial account numbers through the App or Websites.

Sources

We receive personal information from four sources: directly from you; automatically from your device; from your employer or authorizing organization; and from service providers including hosting and cloud infrastructure, customer support tools, payment or purchase-order processing, and delivery and logistics partners.

App Permissions

Our products may request the following device permissions, which you can manage in your device settings. Some features may not work without them. These permissions apply to our mobile products and do not apply to browsing the Websites.

• Camera. To capture photos or video for documentation.
• Microphone. For voice notes or speech-to-text.
• Location. For GPS data while a product is open or running in the background. When background location tracking is active, a persistent notification will appear on your device. You may disable background location at any time through your device settings.
• Phone and network. To send data between the device and the web portal.
• Storage. To temporarily store data until upload completes.

How We Use Your Information

We use personal information for the purposes listed below. For users subject to the GDPR, UK GDPR, or similar frameworks, the corresponding legal basis is identified for each purpose.

You can opt out of marketing messages at any time. For background geolocation and biometric processing, your individual consent is required, and employer authorization alone is not sufficient.

Cookies and Tracking Technologies

On the Websites, we use only the cookies that are necessary for the sites to function, such as the cookies that keep your shopping cart and checkout session working and standard WordPress session cookies.

We do not use third-party advertising pixels, cross-context behavioral advertising, or third-party marketing analytics on the Websites. We do not use the Meta pixel or similar tools to share your browsing activity with advertising networks. We do not sell or share your personal information.

Within our products and web portals, we use cookies and software components that are needed to sign you in, keep the service secure, and operate core features. We do not use them for cross-context behavioral advertising.

Global Privacy Control

We honor Global Privacy Control (GPC) signals as a valid opt-out request under the CCPA and CPRA. Because we do not sell or share personal information, the practical effect of a GPC signal is to confirm our default practice.

Do Not Track

We do not currently respond to browser Do Not Track signals because there is no universally accepted standard for how to interpret them. GPC signals are recognized as described above.

How We Share Information

We disclose personal information in the following circumstances:

• Service providers and contractors that process data under written agreements restricting further use. Examples include hosting, customer support, payment or purchase-order processing, and delivery partners. We contractually prohibit these providers from combining Revecorp user data with data from other sources for their own purposes, including cross-context behavioral advertising.
• Authorized users and your organization when your employer or customer account administrates the App.
• Affiliates within our corporate group for the purposes described in this Policy.
• Business transfers in connection with a merger, acquisition, financing, or sale of assets. The acquiring entity will be bound by the terms of this Policy with respect to personal information collected before the transfer, and we will provide notice to affected users before their data is subject to a materially different privacy policy.
• Legal and safety disclosures. We may disclose personal information in response to a valid subpoena, court order, warrant, or other compulsory legal process; to law enforcement when we have a good-faith belief that disclosure is necessary to prevent imminent harm or illegal activity; or to enforce our terms or protect the rights, property, or safety of our users and the public. We will not voluntarily disclose personal information to government agencies absent compulsory legal process, except where we reasonably believe there is an imminent threat to life or physical safety.

Sale and Sharing

We do not sell or share personal information as those terms are defined by the CCPA as amended by the CPRA. We do not allow third parties to use your data for their own targeted advertising. If this changes in the future, we will update this Policy, provide prominent notice, and honor all applicable opt-out mechanisms including GPC.

Data Retention

We retain personal information only as long as needed for the purposes set out in this Policy, to comply with legal obligations, or to resolve disputes.

We may anonymize data so it is no longer reasonably capable of identifying you and retain the anonymized data indefinitely for analytics.

Security

We use technical and organizational safeguards appropriate to the risks, including encryption in transit (TLS 1.2+) and at rest (AES-256 or equivalent) where feasible, access controls limited to authorized personnel on a least-privilege basis, secure software development practices including code review and vulnerability scanning, and periodic security reviews and audits. No method of transmission or storage is perfectly secure.

Data Breach Notification

In the event of a security breach involving unencrypted personal information that is reasonably likely to cause harm, we will:

• Notify affected California residents in the most expedient time possible and without unreasonable delay, consistent with California Civil Code §1798.82.
• Notify applicable supervisory authorities within 72 hours of becoming aware of a breach where required by the GDPR.
• Provide written notice that includes the categories of information compromised, a description of the incident, the steps we are taking in response, and contact information for follow-up questions.
• Offer identity-theft prevention and mitigation services at no cost where the breach involves Social Security numbers, financial account numbers, or other highly sensitive identifiers.

Children’s Privacy

The Websites and App are not directed to children under 13, and we do not knowingly collect personal information from children under 13, in compliance with the Children’s Online Privacy Protection Act (COPPA). In the European Union and United Kingdom, we rely on the higher local age of consent, up to 16.

If we have actual knowledge that a user is a California resident between the ages of 13 and 17, we will not sell or share their personal information unless the minor has affirmatively opted in, consistent with CCPA §1798.120(c). We will also comply with the California Age-Appropriate Design Code Act to the extent it is in effect.

If we learn we collected data from a child contrary to this section, we will delete it promptly.

International Data Transfers

Your information may be stored and processed in the United States and other countries with different data protection laws. Where required by the GDPR or UK GDPR, we rely on approved transfer mechanisms including:

• European Commission Standard Contractual Clauses (SCCs), as updated in June 2021.
• UK International Data Transfer Agreement or Addendum where applicable.
• Supplementary technical measures such as encryption and pseudonymization.

You may request a copy of the applicable transfer mechanism by contacting privacy@revecorp.com.

Interactive Features and User Content

If you post content in areas visible to others, including forums or feedback channels we operate, your content may be read, collected, and used by others. Do not include personal information in public posts that you would not want to be public.

Notice of Financial Incentive

Revecorp does not currently offer financial incentive programs that require the collection of personal information as a condition of participation. If we introduce such a program in the future, we will update this Policy with a description of the program, the categories of personal information required, the value of the data, and your right to opt in or withdraw at any time.

Updates to This Policy

We may update this Policy from time to time. We will post the updated version with a new effective date on the Websites and, for material changes, provide prominent notice via email or in-product alerts at least 30 days before the changes take effect. Your continued use after the effective date means you accept the changes.

Terms of Use

Your use of the Websites or App is also subject to the Revecorp Terms of Use. If you create an account, place an order, or use a product, you agree to those terms and to this Policy.