Privacy Policy

The data controller is DISRUPTIVE LABS, S.L. (“Reversa”), with Tax ID B21866249 and registered address at Calle Valle de la Fuenfría 10, P1, 6ºC, 28034 Madrid.

Data protection contact: santiago@reversa.ai.

For the purposes of this privacy policy, the following terms shall have the meaning set out below: (i) “Platform”: the regulatory intelligence technology platform developed and operated by Reversa, accessible in SaaS mode through the Reversa website, including any updates, improvements or successive versions; and (ii) “Policy”: this Privacy Policy, together with any amendments or updates made in accordance with section 10.

Reversa undertakes to observe the following principles in the processing of personal data: (i) it will not request personal information unless strictly necessary for the provision of the contracted services; (ii) it will not share users’ personal data with third parties, except in the cases provided for in this Policy, in order to comply with legal obligations or where there is express authorization from the data subject; and (iii) it will not use personal data for purposes other than those expressly set out in this Policy.

This Policy governs the processing of personal data of: (i) representatives and designated users of clients who access the Platform; (ii) contact persons of potential clients; (iii) visitors to the Reversa website; and (iv) persons named in the official public records the Platform monitors. Accessing and using the Platform or any means that entails processing of personal data through it implies acceptance of this Policy, as well as of the provisions contained in the Legal Notice. References in this Policy to the Platform and the Reversa website shall be interchangeable and shall be understood jointly.

3.1 Contract management and access to the Platform

Data: identification and contact data of the client’s representative and users (name, surname, position, email, telephone, IP address, access credentials); professional data and employment details; financial data (billing data); and Platform browsing and usage data (sections visited, session times, IP address, device type and browser).

Purpose: performance of the service provision contract and management of access.

Legal basis: performance of a contract to which the data subject is a party (art. 6.1.b GDPR).

Retention period: for the term of the contract and, once terminated, for the time necessary to address any legal liabilities and, in any case, subject to the blocking regime regulated in art. 32 LOPDGDD.

3.2 Commercial communications and pre-contractual relationship

Data: identification and contact data of representatives of potential clients.

Purpose: management of requests for information and, where there is a prior contractual relationship and for similar services, sending commercial communications about the Platform.

Legal basis: legitimate interest of Reversa (art. 6.1.f GDPR) or, where applicable, consent (art. 6.1.a GDPR). Consent, where obtained, shall be freely given, specific, informed and unambiguous, and provided separately for each purpose.

Retention period: until the consent is withdrawn or the right to object is exercised. The data subject may object at any time in a simple and free-of-charge manner by communication to the address provided.

3.3 Platform technical and usage data: key distinction

Two categories of data generated during the use of the Platform are distinguished:

(a) Confidential Client interaction data

These are the documents, queries, outputs and any information that the Client or its users upload, enter or generate in the Platform in the exercise of their professional activity and which are directly linked to their specific operational context.

• This data is the exclusive property of the Client.
• Reversa will process it solely as data processor, in the name and on behalf of the Client, subject to the data processing agreement (DPA) entered into between the parties.
• It shall not be used to train, fine-tune or improve artificial intelligence models or agents, whether Reversa’s or its providers’.

(b) Aggregated and anonymized technical and usage data

These are performance data, system logs, usage metrics (response times, aggregated types of query, technical errors) and interactions that have been subject to an irreversible anonymization process, such that they do not allow the Client or any user to be identified. Reversa may process this aggregated and anonymized technical and usage data to operate, maintain and improve the Service, without identifying the Client or its end users.

3.4 Cookies and similar technologies

For the use of cookies or storage technologies on the user’s terminal that are not strictly necessary for the provision of the service, Reversa will obtain the user’s prior informed consent, providing clear and complete information about their use and purposes. Neither strictly necessary technical cookies nor the anonymous, aggregated audience measurement of the website reversa.ai, carried out under the conditions of the Spanish Data Protection Agency's guide on audience measurement tools, require consent. Full details are set out in the Cookie Policy available on the Platform.

3.5 Source of the personal data

The personal data processed by Reversa comes from the following sources: (i) data provided directly by the data subject or by the Client by filling in forms, sending communications or any other means of contact with Reversa; (ii) data generated as a result of the user’s navigation and use of the Platform; (iii) data generated as a result of the development, handling and maintenance of the contractual relationship between the Client and Reversa; (iv) third-party data provided by the Client or its users in the context of the use of the Platform; and (v) official public sources, as set out in section 3.8.

3.6 Product analytics within the Platform

Within the Platform (app.reversa.ai), when the user uses the Platform, our servers record product analytics events to understand usage and improve the Service, and send them to a product analytics provider with servers located in the European Union. These events are linked to the identified user’s account. No cookies or similar technologies are stored on the user’s device for this purpose. This processing is based on our legitimate interest (Art. 6(1)(f) GDPR). It is not used for advertising purposes or to process the Client’s confidential content, and it does not feed the training of our models.

3.7 Connecting AI assistants (MCP connector)

A user whose organization has the connector enabled can connect an AI assistant of their choice (such as Claude, ChatGPT or Microsoft Copilot) to the Platform through Reversa’s Model Context Protocol server (mcp.reversa.ai). The user signs in with their Reversa account and chooses the organization the assistant may use.

Data: the user’s account identifier and the chosen organization; the authorization granted (the assistant connected, the permissions accepted, and when it was granted and last used); and a log of the requests: the function called, its result (success, error or refusal), its duration, and the identifiers of the records returned. The log does not keep the text of the requests or of the answers, except the description a user chooses to send when reporting a missing function. When the assistant marks a change with a request identifier, the answer to that change is kept for 24 hours, so that the same request sent again gets that answer instead of applying the change twice.

Purpose: to authenticate the user, apply their permissions in the Platform and the limits set by their organization, provide the information or make the changes requested, protect the security of the service and handle data protection requests.

Legal basis: performance of the contract (art. 6.1.b GDPR) and, for the security of the service, legitimate interest of Reversa (art. 6.1.f GDPR).

Recipients: the information the Platform returns is sent to the AI assistant the user connected, on the user’s instruction. The provider of that assistant processes it under its own terms and privacy policy, agreed with the user or the Client; Reversa does not control that processing.

Retention period: access tokens expire after 15 minutes and renewal tokens after 30 days without use; an authorization ends after 180 days, or earlier if it is revoked. The request log is kept as set out in section 3.1.

User controls: the connector is off until the Client enables it. The assistant can only make changes while the organization allows them, which its administrators can switch off at any time, and if the user accepts them when connecting; it never deletes data or changes settings. The user can revoke the connection at any time, from the Platform or from the assistant, and access stops immediately.

3.8 Personal data in official public records

The Platform monitors official public records so that Clients can follow regulatory and legislative activity. These records name people in connection with their public activity, such as members of parliament, public officials, the authors of amendments and questions, and the participants in meetings with public bodies.

Data: the name, position, political group and institution of these persons, and their public activity as it appears in the records: interventions, questions, amendments, votes, meetings, appointments and court decisions. Depending on the source, it may also include the contact details, photograph, biography, career and mandates, office staff and declarations of interests that the institution publishes, and summaries and figures derived from their public activity. Spanish DNI and NIE numbers recognized in the text are masked automatically.

Sources: official journals and gazettes, parliaments and European Union institutions, transparency and interest registers, courts and regulators, and the agendas and press releases that institutions and political parties publish.

Purpose: to provide Clients with regulatory and legislative monitoring through the Platform and the AI assistants they connect to it.

Legal basis: legitimate interest of Reversa and its Clients in knowing the regulatory and legislative activity that affects them (art. 6.1.f GDPR). The data relates to public activity and was made public by the bodies that publish it. Where it reveals political opinions (political group or party, and votes cast in public office), it was manifestly made public by the data subject in the exercise of that office (art. 9.2.e GDPR).

Recipients: the users of Clients, in the Platform or in the AI assistant they connect to it (section 3.7).

Retention period: the data is kept for as long as the record is part of the regulatory monitoring the Platform provides.

Rights: any person named in these records may exercise the rights set out in section 6, including the right to object to this processing (art. 21 GDPR), by writing to santiago@reversa.ai.

Reversa does not use the Client’s interactions, content or personal data to train, fine-tune or improve artificial intelligence models or agents, and contractually requires its artificial intelligence model providers not to use them for that purpose. Aggregated and anonymized technical and usage data is processed only as described in section 3.3(b).

Reversa will not transfer personal data to third parties except in the following cases: (a) to comply with legal obligations or when applicable law so requires in good faith; (b) through data processors (technology providers, sub-processors) acting under Reversa’s instructions and with appropriate contractual safeguards; (c) where there is express authorization from the data subject; (d) at the request of government authorities in the context of ongoing investigations; (e) to verify or enforce the terms of use or other applicable policies; (f) to detect and protect against fraud or technical or security vulnerabilities; (g) to respond to emergency situations; or (h) to protect the rights, property or safety of Reversa, its clients or the general public.

We share data with data processors in the following categories:

• Cloud infrastructure and hosting providers
• Web and product analytics providers
• Artificial intelligence processing providers
• Payment and billing providers
• Email and communications providers

We maintain an up-to-date list of specific providers available upon request at info@reversa.ai.

Where providers located outside the European Economic Area are used, transfers shall be protected by the appropriate safeguards provided for in Chapter V of the GDPR (adequacy decision, standard contractual clauses or other equivalent safeguards).

Data subjects may exercise the following rights, directly or through a representative, by means of a request addressed to santiago@reversa.ai:

• Right of access: the data subject may ascertain whether Reversa is processing personal data concerning them and, where applicable, obtain information on the purposes, categories of data, recipients and applicable retention periods.
• Right of rectification and erasure: the data subject may request the rectification of their data where it is inaccurate or incomplete, as well as its erasure where they consider that it is no longer necessary for the purposes for which it was collected.
• Right to object: the data subject may object to the processing of their data, unless there are compelling legitimate grounds or it is necessary for the exercise or defense of possible claims, in which case Reversa will keep the data duly blocked for the corresponding periods.
• Right to restriction of processing: the data subject may request the restriction of processing while the contestation of the accuracy or lawfulness of the data is verified, or during the exercise or defense of possible claims.
• Right to portability: the data subject may request the transmission of their data to another controller in a structured, commonly used and machine-readable format, in the circumstances provided for by applicable law.
• Where there is processing for profiling purposes with legal or similarly significant effects, the data subject shall have the right to object to automated individual decisions.

The exercise of the above rights is free of charge.

Data subjects also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or other competent authority.

Reversa maintains the levels of security required by current regulations to protect personal data against accidental loss and unauthorized access, processing or disclosure, taking into account the state of technology, the nature of the data stored and the risks to which it is exposed. The measures aimed at ensuring a level of security appropriate to the risk shall include, where applicable: (i) the pseudonymization and encryption of personal data; (ii) measures capable of ensuring the ongoing confidentiality, integrity, availability and resilience of processing systems and services; (iii) measures capable of restoring the availability and access to personal data in a timely manner in the event of a physical or technical incident; (iv) a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing; (v) the periodic assessment of the risk of accidental or unlawful destruction, loss or alteration of personal data; and (vi) measures to ensure that any person acting under the authority of Reversa and having access to personal data processes it only on Reversa’s instructions.

Upon termination of the contractual relationship, Reversa may delete the Client’s data in accordance with its policies, unless there is a legal obligation to retain it.

In particular: (i) where there is a contract or any type of legal relationship that binds the data subject to Reversa, the data will be kept for the time necessary to fulfill the contractual relationship and, in any case, for the limitation periods required by applicable legislation, being subsequently deleted unless it is necessary to keep it to comply with any legal provision or administrative or judicial requirement; (ii) contact data will be processed for the time necessary to attend to and manage the queries made and, in the case of sending information about Reversa’s services, for as long as the data subject does not object to such sending; and (iii) personal data processed as a result of navigation on the Platform will be retained as long as the data subject does not revoke their consent and, in any case, for a maximum period of one (1) year.

Where deletion is appropriate, the data will be blocked in accordance with art. 32 LOPDGDD, remaining reserved exclusively for being made available to judges, the public prosecutor’s office or competent authorities during the limitation period of the corresponding actions, after which they will be destroyed.

Reversa reserves the right to update this Policy. Amendments will be notified with reasonable advance notice through the Platform or by email. Continued use of the Platform after due notification will imply acceptance of the updated version, except in those cases in which applicable law requires the express consent of the data subject.

The user shall be solely responsible in the event of completing forms with false, inaccurate, incomplete or outdated data.

The user and, where applicable, the Client, warrant to Reversa that the personal data provided through the Platform or by any other means has been obtained lawfully and that they have all the authorizations, consents and legal bases legally required for its communication and processing by Reversa in accordance with the purposes set out in this Policy. In particular, where the user or the Client provides personal data of third parties, they warrant that they have previously informed such third parties of the content of this Policy and have obtained their consent or another valid legitimizing basis for the communication of their data to Reversa. The user and the Client shall hold Reversa harmless against any claim, penalty or liability that may arise from the breach of the obligations set out in this section.