Rev

GDPR overview

Rev claims GDPR compliance explicitly: the security page states "We are GDPR compliant and maintain PCI compliance as a merchant". The Data Processing Addendum of 4 August 2026 incorporates the EU Standard Contractual Clauses (Decision 2021/914) and the UK SCCs, includes the docking clause (Clause 7), uses Clause 9 option 2 for general subprocessor authorization, and selects Irish law and Irish courts; the Irish Data Protection Commission is named as competent supervisory authority. The Privacy Policy of 3 February 2026 carries a section for EU, Swiss and UK residents listing the legal bases, contract, legitimate interest, legal obligation and consent, and the rights of access, rectification, erasure, portability, restriction, objection, withdrawal of consent and complaint. Two gaps: no Article 27 EU representative and no data protection officer are named. Requests go through support@rev.com or the Austin postal address. Rev is established in the United States.

Who owns the data?

Rev's Terms of Service, effective 15 May 2026, are explicit in their intellectual property section: as between Customer and Rev, the customer owns all rights, title and interest in and to its Customer Content. Rev owns the other side of the equation: the platform, the software, its proprietary ASR model and the APIs. Under the Data Processing Addendum, Rev acts as processor and the customer as controller, so instructions over the personal data stay with the customer. The security page adds that Rev never uses customer content to train external AI models. Uploading a file therefore transfers no ownership, but the same Terms allow that content to be analyzed by, and used to train, Rev's own models.

Reuse rights

The customer keeps its content and reuses it without asking anyone: transcripts, clips and documents are exported to Word or PDF and used freely. The nuance sits in the other direction. The Terms of 15 May 2026 state that if you subscribe to Rev's speech-to-text services, your Customer Content "will be analyzed by our ASR models and other Rev artificial intelligence models and may be used for continuous training of those models". Those models belong to Rev, are maintained in-house and are not shared with third parties. The same clause adds that Customer Content "will not be used for any generative AI model training", and the home page states that nothing uploaded is sold or used to train third-party LLMs (OpenAI, Anthropic, Google). Read precisely: yes to training Rev's own ASR and AI models, no to generative models, no to third-party LLMs. The Privacy Policy of 3 February 2026 covers the ordinary purposes, providing, maintaining and improving the services, communicating with users, legal grounds and merger or acquisition operations, and states there is no profiling producing significant legal effects and no sale of data for monetary consideration, though advertising "sharing" in the CCPA sense may occur. Subprocessors are named in Annex III of the DPA of 4 August 2026: AWS, Microsoft Azure, Google LLC, Recall.ai (Hyperdoc), CoreWeave, Braintrust Data, Speechmatics, eClerx and Slack, with Linear Orbit, OpenAI OpCo, Anthropic PBC, Vercel and Supabase used for SmartDepo.law only.

Data retention & training

Hosting summary

Rev is a US company and the hosting follows. The Privacy Policy of 3 February 2026 states that "Rev is located in the United States" and that data may be stored in, or accessed from, several countries including the United States, with Rev able to access data from other locations for support purposes. Data is encrypted in transit with TLS 1.2 and 1.3 and at rest through Amazon S3 server-side encryption (AES), and backups of critical system data are taken several times a day. The named infrastructure subprocessors are Amazon Web Services, Microsoft Azure, Google LLC and CoreWeave, all under US jurisdiction, with Speechmatics (US and UK) and eClerx Services Limited (India) outside it. The Data Processing Addendum states that the customer "may select the geographic region in which Personal Data is housed", but for certain Rev Services only and without ever naming a region, while Annex I describes a "transfer to and from the U.S. from the originating jurisdiction of the data exporter". In short, the United States is the only hosting country the site makes explicit, and no EU region is named anywhere.