Revlos is an Australian-built appointment engine for Australian motor dealerships. It works a dealership's own past-customer database: it scores those records for buying signals, sends outreach under the dealership's brand and its salesperson's name, holds the reply conversation as a disclosed virtual assistant, and books the appointment into the dealership's diary.
This document answers the five questions a dealership's legal counsel or an OEM compliance contact asks before the first message goes out. It is written to be forwarded.
Status: pending legal review. Every legal position stated here is the position Revlos holds and has asked Australian counsel to confirm. It is a description of how the product is built and what Revlos commits to — it is not legal advice, and it is not a substitute for the dealership's own advice on its own data. Two passages are specifically flagged for review and are marked where they appear.
1. Where is the data?
Primary storage is in Australia. The application database, including every end-customer record, message, conversation and appointment, is held in Supabase on AWS Sydney (ap-southeast-2). Storage is encrypted at rest (AES-256) and every connection is encrypted in transit (TLS 1.3).
Dealerships are isolated by the database, not by the application. Every table carries a dealership_id and every table has PostgreSQL row-level security enabled against it. A query issued on behalf of one dealership cannot return another dealership's rows even if application code asks it to. There is no shared pool, no cross-dealership matching, and no product feature that reads one rooftop's data to serve another.
Credentials get a second layer. Calendar OAuth tokens (Google and Microsoft) are encrypted with a separate application key before they are written, so storage-level encryption is not the only thing standing between a database copy and a dealership's diary.
Raw source files are transient. A DMS export uploaded through the secure upload portal is purged 30 days after it has been ingested. The forensic record of the upload — who, when, what file, what checksum — is append-only and permanent; the file itself is not kept.
Voice is retention-limited. Call recordings are held for 90 days by default and then deleted unless the dealership asks otherwise. Transcripts are retained as text.
End-customer data is never used to train models. Not ours, and not a sub-processor's. Data is processed to serve the dealership that uploaded it, and for nothing else.
Sub-processors
Revlos is a small number of well-known services rather than a long tail. The current list, what each one does, and where it processes:
- Supabase — primary database and authentication. AWS Sydney, Australia.
- Vercel — application hosting and content delivery. Global edge; the customer database is not held here.
- Anthropic — generates message and conversation text. United States. Content is processed to produce a message and is not retained for training.
- Twilio — SMS delivery and inbound handling. United States, with Australian carrier routing.
- Resend — email delivery and inbound handling. United States.
- ElevenLabs — voice synthesis and the telephony agent, where a dealership has enabled voice. United States.
- Stripe — payment processing for the dealership's own subscription. United States. No end-customer data reaches Stripe.
- Google and Microsoft — calendar availability and event creation, only where a dealership connects its own calendar, and only within that dealership's own tenancy.
Where a sub-processor processes outside Australia, that processing is limited to what the function requires — generating a message, delivering a message, synthesising speech — and the record of record stays in Sydney. Revlos's position is that this is a cross-border disclosure under APP 8 for which reasonable steps have been taken, and it is disclosed in the Privacy Policy rather than buried.
Sub-processor changes are published on this page and notified to dealerships before they take effect.
2. What is the lawful basis for contacting these customers?
This is the first of the two passages flagged for legal review.
The dealership is the sender. At law the commercial electronic message is sent by the dealership, under its brand, from its relationship, about its stock. Revlos is the dealership's processor and does not send on its own account. That is not a disclaimer — it is the structure the whole product is built around, and it is why the consent position is the dealership's to hold.
The position is inferred consent from an existing business relationship. Under the Spam Act 2003 (Cth), consent to receive a commercial electronic message can be express or inferred, and Schedule 2 allows consent to be inferred from an existing business relationship and the conduct of the parties. A dealership contacting a person who bought a car from it, or has that car serviced by it, is the paradigm case that limb contemplates. Revlos is designed for that case and no other.
That position depends on three conditions holding. Revlos supplies the mechanics for all three; the dealership holds the position.
(a) The relationship must be the dealership's own, and recent enough that the recipient would reasonably expect to hear from them. Revlos only ever works records the dealership uploads from its own DMS. Revlos does not sell, buy, rent, append or supply lists; there is no shared database; and row-level security makes one dealership reading another's records architecturally impossible. If a record is not the dealership's own customer, Revlos has no way to obtain it and no interest in it.
(b) The sender must be accurately identified. Every message identifies the dealership and the salesperson it comes from. Every first message identifies the sender as that salesperson's virtual assistant — not as the salesperson. The disclosure is hardcoded, validated before the message can be dispatched, and cannot be disabled by configuration on any tier. If a customer asks at any point whether they are talking to a person, the assistant says what it is and offers to connect them to the salesperson. This is a Spam Act sender-identification requirement and, more importantly, an Australian Consumer Law s18 requirement: a message that let a customer believe a human wrote it would be misleading conduct, and Revlos treats that as the single largest legal risk in the product.
(c) There must be a functional unsubscribe in every message, honoured promptly. There is, in every message, on every channel, on every tier — and it is honoured immediately rather than within the five working days the Act allows. Section 3 sets out exactly what happens.
Voice sits under a separate regime and gets stricter treatment. Inferred consent does not override registration on the Do Not Call Register. Every outbound voice call is washed against the Australian Do Not Call Register before it connects, and where that check cannot be completed the call is not placed — the system fails closed. Voice is also rate-limited to one call per customer per seven days, will not cold-call, and is not available at all to a dealership still in draft-and-approve mode.
Contact hours are enforced server-side, for every channel. Monday to Friday 9am–8pm, Saturday 9am–5pm, no Sunday, no national public holiday — the Telecommunications (Telemarketing and Research Calls) Industry Standard 2017 window. Revlos applies it to SMS and email scheduling as well as to calls, which is more conservative than the Standard requires, because a 9pm text from a car dealer is a complaint whether or not it is lawful.
What Revlos does not do. It does not warrant the provenance of the records in a dealership's DMS, because it cannot see how they were collected. The dealership warrants under the Revlos Terms of Service that it has lawful authority to hold those records and to send marketing to them. What Revlos provides is the mechanics that make the position defensible — identification, opt-out, contact hours, frequency caps — and the evidence that they operated.
3. How does someone opt out?
Every channel, one action, immediately. A reply of STOP or any of its ordinary variants on SMS; the unsubscribe link in any email; "stop" or keypress 9 on a call; or a word to the dealership, entered by staff. Any one of those does the whole job.
Opt-out attaches to the person, not to the record and not to the channel. Every DMS export ever produced contains the same customer twice. A system that silenced the row the inbound happened to match would keep texting that person from the second record, from the same number they had just told to stop. Revlos resolves the identity set — every record sharing that phone number or email address in that dealership — and silences all of them, across SMS, email and voice at once.
Work already in flight is cancelled, not merely paused. In the same operation: queued campaign recipients, pending messages, sequence enrolments and scheduled voice calls for that person are all cancelled, and every cancellation is checked rather than assumed. A scheduled message that went out after someone said stop is the failure mode this is built to prevent.
The evidence is written before anything is changed, and cannot be edited afterwards. Each opt-out writes a row to an append-only table — database triggers reject UPDATE and DELETE outright — recording:
- the customer's own words, verbatim and untruncated, not a reason string the software composed;
- which matching rule fired and on what expression, so a disputed match is arguable rather than mysterious;
- every customer record silenced by that event;
- exactly what was cancelled, per collection;
- both when the customer sent it and when Revlos acted on it, as separate timestamps — the gap between those two is the number a regulator asks about, and a single timestamp cannot answer it.
Reversal takes the customer, not a staff member. An opt-out can only be lifted by an explicit, customer-initiated re-consent, recorded the same way as the opt-out. Nobody clears the flag from a browser.
Separately from opt-out, there is a frequency cap. A customer contacted in a campaign is not eligible for another campaign for a window the dealership sets between 60 and 90 days, and the band is enforced in the database so it cannot be set to three. A customer who replies is governed by conversation state instead, because someone who is talking to you should not be made to wait seventy-five days.
The dealership can prove all of this. A complete communication and compliance log — every message, call, opt-out, blocked send and the reason it was blocked — is exportable for any date range, in minutes, in a form an ACMA enquiry can read.
4. What happens to the data when a dealership leaves?
Month to month. No exit fee, no lock-in, no data ransom.
Export. On request, the dealership receives a structured export of its data: customers with the fields as uploaded plus everything Revlos derived, the full message and conversation history, appointments and outcomes, and the compliance log.
Deletion. End-customer personal information is deleted from Revlos systems within 30 days of termination. That includes conversation content and any voice recordings still inside their retention window.
The one carve-out, stated plainly: opt-out records and compliance logs survive deletion.
The reason is not convenience. The obligation to not contact somebody outlives the commercial relationship that created it. If a dealership left and Revlos deleted the record that a person had said STOP, then two things would break at once: the only proof that the person ever asked would be gone, and if that dealership ever returned, or re-uploaded the same DMS export, the person who opted out would be contacted again. Deleting a suppression record is not privacy — it is the mechanism by which the same person gets texted a second time.
So the opt-out event, the compliance log and the audit trail are retained for seven years, consistent with the retention period in the Revlos Privacy Policy. They hold the minimum needed to keep the promise and to answer a complaint. Everything else goes.
An individual who wants their record erased entirely, including their suppression entry, can ask — and the consequence of granting it, which is that nothing then prevents future contact, is explained to them before it is actioned.
5. What happens if something goes wrong?
Revlos operates under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth).
Assessment. Where there are reasonable grounds to suspect an eligible data breach, Revlos assesses it. The statutory maximum for that assessment is 30 days; Revlos's internal target is 5 business days, because a breach that takes a month to characterise has already been a month of exposure.
Notification. Where the assessment finds an eligible data breach — unauthorised access to, unauthorised disclosure of, or loss of personal information, likely to result in serious harm, and not remediated so that serious harm is no longer likely — Revlos notifies the Office of the Australian Information Commissioner and the affected individuals as soon as practicable, with what happened, what information was involved, and what those individuals should do.
The dealership hears first. The dealership, not Revlos, holds the relationship with the affected individuals and carries its own obligations as an APP entity. Revlos therefore notifies the affected dealership without waiting for the assessment to conclude, with a target of 24 hours from confirming that a breach touches that dealership's data, so the dealership can start its own clock. Where both entities hold the same information, a single joint notification can be agreed under s 26WM rather than the individual receiving two.
The dealership's own obligations are not displaced. Revlos being a processor does not make the dealership's breach somebody else's problem, and this document does not say otherwise.
Contact point. privacy@revlos.com.au, monitored by the founder. Security matters are answered within 24 hours by a person who can act on them, not by a ticket queue. A written incident report follows every confirmed incident: what happened, what data, whose customers, what was done, what changed so it does not recur.
Insurance. Certificates of currency for professional indemnity and cyber liability cover are provided on request. If a certificate is not attached to this document, that cover has not yet been bound — ask, and you will get a straight answer about where it is up to rather than a form of words.
6. Also asked: what will the AI actually say to our customers?
This is the second of the two passages flagged for legal review.
It never claims to be a person. Every first message opens as "[Salesperson]'s virtual assistant from [Dealership]". Asked directly whether it is a bot, it says yes, immediately, and offers a human.
There is a hard boundary around money, and it is in the code rather than in a policy document. The assistant will not:
- state a dollar valuation as a fact — a trade-in figure is described as an estimate, subject to inspection, and internal valuation fields are structurally prevented from reaching outbound copy;
- quote a monthly payment;
- discuss interest rates, finance terms, comparison rates, approvals or eligibility;
- agree a price, a discount or a deal structure;
- make a warranty or guarantee claim about a vehicle.
Why that boundary sits where it does. Two reasons. Australian Consumer Law s 18 is the first: an automated message that quoted a payment a dealership would not honour is misleading conduct, and the dealership wears it. The credit regime is the second: Revlos holds no Australian Credit Licence and is not a credit representative of anyone, so credit assistance is out of scope by construction rather than by restraint. Any enquiry that touches finance is handed to the dealership's own licensed people, which is where it belonged anyway.
How the boundary is enforced. Internal-only fields cannot be referenced in outbound templates, and a test in the build pipeline fails the build if they are. Conversations escalate to a human after six exchanges without a booking, and immediately on legal, complaint or frustration signals — a customer who writes "lawyer", "ACMA", "harassment" or "already said no" stops the automation and reaches a person. New dealerships start in draft-and-approve, where a human presses send on everything, and autonomy is earned rather than switched on.
The assistant's job is one job. Start a conversation, and book a time. It does not negotiate, close, or commit the dealership to anything.
Document control
- Issued by: Revlos (registered entity name pending) - ABN: registration in progress
- Registered address: Available on request — email legal@revlos.com.au
- Version 1.0, last updated 19/08/2026.
- Status: pending legal review. The two passages flagged for an Australian solicitor's review are Section 2 (the inferred-consent framing) and Section 6 (the AI-and-finance-talk boundary). This document will not be marked reviewed by anybody other than the solicitor who did it.
- The current version always lives at revlos.com.au/compliance. If the version number on the copy you are holding is lower than the one on that page, you are holding a stale copy — the page will tell you what changed.
- Questions on privacy and data handling: privacy@revlos.com.au. Questions on contracts and terms: legal@revlos.com.au.
- This document is a description of how Revlos is built and what Revlos commits to. It is not legal advice and does not create rights beyond the Revlos Terms of Service and Privacy Policy, which govern.