Privacy Policy

Last updated: April 20, 2026

Chrome Extension — Data Handling Disclosure

This disclosure explains exactly how the Revflow browser extension (Chrome Web Store listing "Revflow — Creator Analytics", item ID pikonflmhdpgdibfjanleeghjphmpbkl) collects, processes, stores, and shares user data, in compliance with the Chrome Web Store Developer Program Policies and the Chrome Web Store Limited Use requirements.

Single Purpose

The extension has a single purpose: to securely link your creator platform account to your Revflow workspace so that revenue analytics can be synchronized on your behalf. The extension performs no other function.

What Data the Extension Collects

The extension collects only the data strictly required to establish the secure link between your creator account and your Revflow workspace:

Session cookies from the creator platform you are already logged into, read one time during the linking action
Authentication headers (specifically x-bc and user-agent) required by the creator platform's private API, read one time during the linking action
Your Revflow agency identifier, stored locally in the browser via chrome.storage so the extension remembers which workspace to link into

The extension does NOT collect: browsing history, page contents from any website, personal messages, photos or media files, payment card information, health data, financial account details, or any data from websites other than the connected creator platform and your Revflow workspace.

How the Extension Processes Data

Data collected by the extension is used exclusively to authenticate the server-side data synchronization between your creator account and your Revflow workspace. The extension does not analyze, profile, display advertisements, perform credit checks, determine creditworthiness, or transmit data for any purpose other than establishing the account link. Once the secure link is established, the extension's processing role is complete. Collected data is never used to train generalized AI or machine learning models.

How the Extension Stores Data

Authentication tokens captured by the extension are transmitted to the Revflow backend over HTTPS (TLS 1.3) and stored encrypted at rest in our managed PostgreSQL database hosted by Supabase (EU region). All stored records are scoped to your own Revflow workspace under PostgreSQL Row Level Security (RLS) policies — no other user, agency, or third party can access them. Your Revflow agency identifier stored via chrome.storage remains local to your browser and is not uploaded anywhere except when needed to complete the link action.

How the Extension Shares Data

Revflow does not sell user data. Revflow does not share user data with advertisers, marketing partners, analytics brokers, or any third party for advertising or resale purposes. Authentication data collected by the extension is shared only with the sub-processors strictly required to operate the Service: Supabase (encrypted database storage, EU region), Railway (backend sync infrastructure), Vercel (website hosting), and Paddle (payment processing, which does not receive extension data). Each sub-processor is contractually bound by a data processing agreement. No other third parties receive data.

Permission Justifications

cookies: read the session cookies you already hold on the connected creator platform so the backend can authenticate the secure data sync
webRequest: read the authentication request headers (x-bc, user-agent) required by the creator platform's private API
scripting: inject a one-line notification into your already-open Revflow tab to signal that the link has succeeded
storage: persist your Revflow agency identifier in the browser so repeat linking is frictionless
tabs: locate your already-open Revflow tab in order to return the link result to the correct page
host permissions (onlyfans.com, revflow.team, Revflow backend): scope all reads strictly to the connected creator platform and your Revflow workspace. No other websites are accessed.

Data Retention and Deletion

Authentication tokens are retained only for as long as your Revflow subscription is active and the linked account is in use. When you uninstall the extension via chrome://extensions, all browser-local permissions are revoked immediately. To delete data already stored on Revflow's servers, contact privacy@revflow.team — we will delete or anonymize your personal data within 30 days of your verified request.

No Remote Code, No Background Tracking, No Adult Content

The extension does not use remote code execution. It does not track your browsing outside of the connected creator platform and your Revflow workspace. It does not display, host, render, or process adult content of any kind. It does not sell, share, or resell your data to any party outside the sub-processors listed above.

Contact for Privacy Questions

RHLM Group LLC · Email: privacy@revflow.team

1. Introduction

This Privacy Policy describes how RHLM Group LLC ("Company", "we", "us", or "our") collects, uses, and protects your personal information when you use the Revflow platform, including our website, applications, and browser extension (collectively, the "Service").

We are committed to protecting your privacy and handling your data responsibly. By using the Service, you consent to the practices described in this policy.

2. Data Controller

The data controller for the personal data processed through the Service is:

RHLM Group LLC
State of New Mexico, USA
Email: privacy@revflow.team

3. Information We Collect

3.1 Account Information

When you create an account, we collect your email address, name, and authentication credentials.

3.2 Agency and Creator Data

When you connect creator accounts to the Service, we read and interpret performance analytics, revenue data, subscriber metrics, and operational data that you authorize us to access. This data is used solely to provide the analytics, payroll, and management features of the Service.

We do not own, store permanently, or claim any rights over the underlying creator data or revenue. We provide an analytical interpretation of data from third-party platforms. All original data remains the property of the respective platform and account holders.

3.3 Authentication Credentials

Our browser extension collects session cookies and authentication tokens from connected creator platforms. These credentials are transmitted securely (via HTTPS) to our servers and are used exclusively to synchronize data on your behalf. We do not share these credentials with third parties.

3.4 Usage Data

We automatically collect information about how you interact with the Service, including pages visited, features used, and timestamps. This data is used to improve the Service and troubleshoot issues.

3.5 Payment Information

Payment processing is handled by our payment provider (Paddle). We do not store your credit card information. Please refer to Paddle's privacy policy for details on how they handle payment data.

4. Legal Basis for Processing (GDPR)

We process your personal data under the following legal bases as defined by Article 6 of the GDPR:

Contract performance: Processing necessary to provide the Service you subscribed to (account management, data synchronization, analytics generation)
Legitimate interest: Processing necessary for service improvement, security, and fraud prevention
Consent: Where required, such as for marketing communications

5. How We Use Your Information

Provide, maintain, and improve the Service
Generate analytics, reports, and performance insights
Process payroll calculations and financial management features
Synchronize data from connected creator accounts on your behalf
Communicate with you about your account, updates, and support
Detect, prevent, and address technical issues and security threats
Comply with legal obligations

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Upon account deletion, we will delete or anonymize your personal data within 30 days, except where we are required to retain data for legal, accounting, or reporting obligations.

Creator performance data and analytics are retained for the duration of your subscription. Historical data may be retained in aggregated, anonymized form for statistical purposes.

7. Data Sharing and Sub-Processors

We do not sell your personal data. We share data only with the following service providers who process data on our behalf:

Supabase

Database hosting and authentication (EU region)

Paddle

Payment processing and subscription management

Vercel

Website hosting and deployment

Railway

Backend infrastructure and data synchronization

Each sub-processor is bound by data processing agreements and processes data only as necessary to provide their services.

8. International Data Transfers

Your data may be transferred to and processed in the United States. For transfers of personal data from the European Economic Area (EEA) to the United States, we rely on the EU-U.S. Data Privacy Framework and standard contractual clauses where applicable.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you
Rectification: Request correction of inaccurate data
Erasure: Request deletion of your personal data
Portability: Request your data in a portable format
Restriction: Request restriction of processing
Objection: Object to processing based on legitimate interest
Withdraw consent: Where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, contact us at privacy@revflow.team. We will respond within 30 days.

10. California Privacy Rights (CCPA)

If you are a California resident, you have the right to:

Know what personal information is collected, used, shared, or sold
Delete personal information held by us
Opt-out of the sale of personal information
Non-discrimination for exercising your privacy rights

We do not sell your personal information.

To exercise your California privacy rights, contact us at privacy@revflow.team.

11. Cookies

We use cookies and similar technologies to maintain your session, remember your preferences, and improve the Service. The cookies we use include:

Essential cookies: Required for the Service to function (authentication, session management)
Analytics cookies: Help us understand how the Service is used to improve it

You can control cookies through your browser settings. Disabling essential cookies may prevent the Service from functioning properly.

12. Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit (TLS/HTTPS), secure credential storage, and access controls. However, no method of transmission over the internet or electronic storage is 100% secure.

12a. Browser Extension

The complete data-handling disclosure for the Revflow browser extension — including what data is collected, how it is processed, how it is stored, how it is shared, permission justifications, uninstall instructions, and deletion rights — is provided in the Chrome Extension Data Handling Disclosure section at the top of this page.

13. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If we learn that we have collected data from a minor, we will take steps to delete it promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and, where appropriate, by email. Your continued use of the Service after changes constitutes your acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:

RHLM Group LLC
Email: privacy@revflow.team