DevRev

GDPR overview

Implementation is concrete rather than declarative. A data protection officer is appointed and reachable at dpo@devrev.ai. An Article 27 EEA representative is named in full: DevRev, razvoj programske opreme, d.o.o., Ljubljana, Slovenia, with its registration and VAT numbers. The controller is identified as DEVREV, inc., Palo Alto, company registration 4656646. A data processing agreement drafted against Article 28 is downloadable and supplied at sign-up, carrying the EU standard contractual clauses and the UK International Data Transfer Addendum; transfers to the United States rely on the EU-U.S. Data Privacy Framework and its UK extension. Access, erasure, objection and consent-withdrawal rights are documented with a 45-day response commitment, the Slovenian Information Commissioner is named as supervisory authority, and data on people under 16 is not knowingly processed. The policy has been in force since 21 May 2026.

Who owns the data?

Section 7.1 of the terms of service leaves ownership of Customer Data entirely with the customer: everything you, your employees or your end users upload stays yours, along with sole responsibility for its accuracy, legality, correction and deletion. Section 7.3 reserves to DevRev all rights in the service, the software and the transactional and performance data it generates. The data processing agreement casts DevRev as processor under Article 28 of the GDPR and each customer as controller. DevRev says it keeps human oversight of its AI technologies, but section 10.4 places the duty of reviewing and validating any output before business use on the customer alone.

Reuse rights

Because customers keep title to their own data, they may use, export, correct or delete it without asking DevRev for permission. What DevRev itself may do is narrower than usual: the privacy policy states in plain terms that user and customer data is not used to develop, improve or train generalised AI or machine-learning models, and version 2.1 of the policy extended that clarification to data reached through Google Workspace APIs. Sub-processors operate under data processing agreements or standard contractual clauses and may not repurpose the data; the list of them is published on the site. Marketing email runs on consent that can be withdrawn at any time. Product usage data is analysed to improve the service, and anonymised or aggregated analytics may be kept for longer statistical work.

Data retention & training

Hosting summary

DevRev publishes no hosting country and no hosting region for customer data, which is a notable gap for a platform sold to regulated enterprises. What the documents do establish is jurisdiction: DevRev describes itself as a US-based organisation, and transfers from the EEA and the UK to the United States rely on the EU-U.S. Data Privacy Framework and its UK extension, certified with the Department of Commerce. Outside that framework, the company uses the European Commission's standard contractual clauses and the UK International Data Transfer Addendum. Many sub-processors are registered in the United States or other third countries, and the list is published. The trust centre records AWS Partner status alongside ISO/IEC 27001:2022, SOC 2 Type 2, HIPAA, CCPA and GDPR compliance, with penetration test and vulnerability reports available on request. One location is stated explicitly, but it concerns an internal tool: meeting transcripts and summaries produced by Granola are stored on servers in the United States. The funding announcement refers to a multi-region platform without naming a region.