Privacy Policy

Revora Cash Recovery · Effective October 1, 2026

Revora Cash Recovery is a product of Revora Labs LLC, a Texas limited liability company.

What Revora is

Revora Cash Recovery helps commercial specialty contractors find the invoices that are stuck and decide what to do next. It reads accounts-receivable data that you upload (CSV exports and customer lists) or connect (QuickBooks Online), and, if you choose, email from your accounts-receivable mailbox. Everything is stored in a tenant that belongs to your organization.

Data we collect from QuickBooks Online

• Customers and sub-customers (name, email domain, one accounts-payable contact, terms)
• Invoice headers (number, dates, amounts, open balance, memo)
• Payment headers and which invoices they were applied to
• Company name

Revora never writes to QuickBooks, never moves money and never sends email on your behalf.

Data you upload

• Open-invoice exports (customer, invoice number, dates, amounts, open balance, memo, project)
• Customer lists (customer names, contact names, email addresses and phone numbers)

Email and Google user data

An organization can let Revora read its accounts-receivable email in one of two ways. With Google Workspace, the organization's administrator authorizes Revora for named mailboxes with one read-only Gmail permission (gmail.readonly). Or the organization forwards messages to its own Revora address, which gives Revora no access to the mailbox at all. Revora never sends, changes, labels or deletes mail.

What we access. Revora searches a connected mailbox only for messages about the organization's receivables: messages to or from its customers' email domains or known customer contacts, or that mention its open or recently paid invoice numbers, project codes or billing terms such as "past due" or "certificate of insurance", from the last 180 days. Promotions, social mail and no-reply senders are excluded. After that, Revora checks each new message against the same criteria; a message that does not match is discarded and nothing from it is kept. Mail forwarded to the organization's Revora address is kept whether or not it matches, because the organization chose to send it.

What we store. For matching messages: the sender, recipients, date and subject, and the message text with quoted history trimmed. When a reply is very short, we also keep the untrimmed text, because the useful part is often in the quoted history. Attachments are stored only when they are a certificate of insurance, lien waiver, W-9, pay application or rejection notice. We never store the raw message.

How we use it. To link each message to the customer and invoice it is about, to show your team what the customer last said and when, and as an input to the fixed rules that rank invoices (for example, whether a customer has replied). We use it only to provide these features to your organization. When AI analysis is on, we also use it to find which invoice a message is about, what is holding up a payment and whether the customer has promised to pay, and to write a short status note for each open invoice, the summary of the Daily Recovery Brief and, when someone on your team asks for one, a suggested follow-up email.

Who receives it. Only the providers that run the service: Vercel (hosting), Supabase (database and file storage), Resend (receiving forwarded mail, and sending the Daily Recovery Brief and the monthly report notice to your own team members who have not unsubscribed) and, when AI analysis is on, OpenAI (AI analysis). We do not sell it, use it for advertising, or transfer it to anyone else except to comply with the law or, with notice, as part of a merger or sale of our business. We do not use it to develop, improve or train artificial-intelligence or machine-learning models, and our OpenAI account is set so that OpenAI does not use it to train its models.

AI analysis. When AI analysis is on for your organization, Revora sends messages between your team and your customers that are about your receivables to OpenAI through its API: the sender, recipients, date and subject, the message text shortened to about 6,000 characters, short excerpts of up to five earlier messages in the thread, and the related customer, contact and invoice details. OpenAI's answer is used to decide which invoice a message is about, what is holding up a payment and whether the customer has promised to pay, and to write a two- or three-sentence status note for each open invoice. When someone on your team asks Revora to write a follow-up email, Revora sends OpenAI the details of the invoice or invoices it is about and your company's name, their open blockers and promises with the sentences they came from, the most recent message about them with short excerpts of up to five earlier ones, the contact's name, and any note the person adds. The answer is a suggested email that your team reads, edits and sends from its own mailbox. Revora adds your signature and payment instructions itself, never sends them to OpenAI, and never sends the email. For the Daily Recovery Brief, Revora sends OpenAI the brief's own figures (customer names, invoice numbers, amounts, dates, the day's actions and their one-line reasons, recent changes and expected payments) to write the brief's summary, which shows that AI wrote it; the actions and their order stay the ones Revora's fixed rules chose. The email text is sent as marked, untrusted data, every answer must fit a fixed format, and the AI cannot send, change or delete anything. It never sets an invoice's priority or ranking; fixed rules do. Every blocker, promise or match the AI finds shows the sentence it came from, and your team can confirm or dismiss it. OpenAI may keep requests for up to 30 days to monitor for abuse, unless the law requires longer, and then deletes them. In the copy of each request that we keep, we mask numbers that look like Social Security, employer identification, payment card or telephone numbers. An administrator can turn AI analysis off at any time on the AI settings page.

Who can read it. Revora staff do not read your email unless your organization has agreed in writing to a specific request, it is necessary for security purposes, or the law requires it.

Limited Use. Revora's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

How to stop it. An administrator can disconnect a Workspace mailbox on the Integrations page at any time, which stops all reading, and can remove Revora's access in the Google Workspace admin console (Security → API controls → Domain-wide delegation). To stop forwarded mail, remove the forwarding rule or stop copying the Revora address. Email already stored stays with your organization until you ask us to delete it or delete the organization; we complete deletion within 30 days.

Emails we send

Revora sends two kinds of email, both only to members of your own organization: the Daily Recovery Brief, on weekday mornings, to members who have it turned on, and a notice that the monthly recovery report is ready, on the 1st of the month, to owners and administrators who have it turned on. Both come from brief@revoracash.app through Resend, carry no attachments and have a one-click unsubscribe link; each member can also turn them off on their account page. Revora never emails your customers or anyone outside your organization.

Free scans

Free scans. A company that asks for a free A/R Recovery Scan sends us its open-invoices export and may forward email threads about specific invoices to an address we create for that scan. We use them only to prepare that company's report. Forwarding a thread asks us to read it, so our staff read those messages at the company's written request; when the company has also agreed to AI analysis, the messages are analysed as described under AI analysis. A scan's data is kept in its own organization and is never used for anyone else. The scan is open for 14 days, and we delete its data 30 days after that unless the company becomes a customer.

How we protect it

• Every record is isolated to your organization with database row-level security.
• QuickBooks connection tokens are encrypted (AES-256-GCM) and readable only by server-side jobs; they never appear in the app or in logs.
• Workspace mailbox access uses a service account whose key is held only on our servers; Revora stores no Google password or mailbox token for it.
• Every change is written to an append-only audit log.

Retention and deletion

Data stays as long as your organization uses Revora. Stored email and documents are kept on the same terms. Disconnecting QuickBooks deletes the connection tokens immediately and stops all syncing; you can ask us to remove synced records or delete the whole organization at any time, and we complete deletion within 30 days.

Contact

privacy@revorahq.com

We will post any change to this policy on this page and update the effective date.