Privacy Policy

1. Overview

Rivr Software, Inc. (“Rivr,” “we,” “us,” or “our”) operates a legal document management platform (the “Service”). This policy describes how we collect, use, and protect information when you use the Service. Where Rivr processes customer content on behalf of a customer, we do so according to that customer’s instructions and the terms of our agreement with them. We collect only what we need to provide the Service to you.

2. Information we collect

We collect the following categories of information:

• Account information: name, email, organization, and authentication information (such as hashed passwords or authentication tokens).

• Customer content: documents and metadata you upload or import, including - where Box is connected - Box account identifiers, folder IDs, file IDs, filenames, file metadata, and OAuth tokens used to access authorized folders.

• Usage data: logs of actions taken in the Service for security and support.

3. How we use information

We use information to:

• Provide, maintain, and improve the Service.

• Process documents through automated extraction and classification pipelines on behalf of the customer.

• Communicate with you about your account and the Service.

• Detect and prevent fraud, abuse, and security incidents.

4. Document processing & AI

Rivr uses third-party large language models (LLMs) to classify documents. Document content may be transmitted to these providers for processing. We do not authorize our LLM providers to use your content to train their models. See Section 7 for a list of our key subprocessors.

5. Data storage & security

Customer content is stored encrypted at rest and in transit. Access to customer content is restricted to authorized personnel and only as needed for support or as required by law.

6. Data sharing

We do not sell your data. We share data only with subprocessors necessary to operate the Service under appropriate contractual safeguards, or as required by law.

7. Subprocessors

We use the following key subprocessors to operate the Service:

• Supabase - database and file storage

• Google - LLM document classification (Gemini)

• Anthropic - LLM document classification (Claude)

• OpenAI - LLM document classification

• Modal - serverless compute for document processing

• Resend - transactional email delivery

We use subprocessors under terms intended to restrict use of customer data to the purpose for which it was shared.

8. Data retention

We retain customer content for the duration of the customer relationship unless deleted earlier upon request or as otherwise agreed in writing. After termination, we may retain customer content for up to 90 days for backup, legal, security, or operational purposes, after which it is deleted or de-identified in accordance with our standard retention practices.

9. Your rights

You may request access to, correction of, export of, or deletion of personal information we hold about you. Contact support@rivr.build to exercise these rights. California residents should also see Section 11 below.

10. Cookies

We use session cookies necessary to maintain your authenticated session. We do not use third-party analytics or advertising cookies.

11. California residents

California residents may have rights regarding their personal information under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), where applicable.

Categories of personal information collected: identifiers (name, email); professional information (organization); internet or network activity (usage logs); and customer content (documents you upload or import).

Purposes for collection: to provide and improve the Service, process documents on behalf of the customer, communicate with you, and detect fraud and security incidents.

We do not sell or share personal information for cross-context behavioral advertising.

Where applicable, California residents may have the right to:

• Know - request disclosure of the categories and specific pieces of personal information we have collected about you.

• Delete - request deletion of personal information we have collected, subject to certain exceptions.

• Correct - request correction of inaccurate personal information.

• Non-discrimination - we will not discriminate against you for exercising any of these rights.

To submit a request, email support@rivr.build with the subject line “California Privacy Request.” We will respond within 45 days.

12. Children’s policy

The Service is not directed to children under 13 and we do not knowingly collect personal information from minors. If you believe a minor has provided us personal information, contact us at support@rivr.build and we will delete it promptly.

13. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email, in-app notification, or another reasonable method before taking effect where required by law or contract.

14. Contact

Privacy questions or requests can be directed to:

Rivr Software, Inc.
169 Madison Ave, STE 58274
New York, NY 10016
support@rivr.build