This policy explains what personal data Rivtor collects when you use rivtor.com, the dashboard, the API, the MCP server and the CLI, and what we do with it. We collect what we need to run the service and keep it safe, and nothing for advertising.

Who we are

Rivtor (“we”, “us”) operates from India and is the data fiduciary (controller) for the account data described here. For the data inside the apps you deploy, you are the controller and we process it on your behalf, only to host and run your app.

What we collect

Account data

When you sign in with GitHub or Google we receive your name, email address and avatar, and for GitHub your username and account creation date (we use account age to prevent abuse). If you verify a phone number, we store it.

Billing data

Payments are handled by Stripe and Razorpay. They collect your card or UPI details directly; we never see or store full card numbers. We keep your plan, billing country, invoices, tax details you provide (such as a GSTIN) and the payment status.

Usage data and logs

We record deploys and their build logs, runtime logs from your apps, request and bandwidth counts, resource usage, the tool calls made through the API and MCP server, and security events. Requests to your apps pass through Cloudflare, which processes visitor IP addresses to route traffic and block attacks.

Your code and app data

We receive the source you deploy, the environment variables you set and the data your apps store in Postgres, Redis and R2. We process it only to build, run, back up and secure your app (for example, scanning deploys for phishing kits). We do not read it for any other purpose, sell it or use it to train models.

How we use it

• To create your account, sign you in and run the service you asked for.
• To bill you, send invoices and meet tax and accounting obligations.
• To send service email: deploy failures, limit warnings, trial reminders, security notices and changes to these policies.
• To detect and stop abuse, fraud and attacks, and to respond to abuse reports.
• To understand how the product is used in aggregate so we can improve it.

Legal bases and consent

Under India's Digital Personal Data Protection Act, 2023, we process your personal data on the basis of your consent, given when you create an account, and for legitimate uses the Act allows, such as complying with the law and responding to security incidents. You can withdraw consent at any time by deleting your account; this does not affect processing that already took place.

If you are in the European Economic Area or the United Kingdom, we rely on performance of our contract with you, our legitimate interests in securing and improving the service, your consent where we ask for it, and our legal obligations. Transfers outside your region use appropriate safeguards such as standard contractual clauses.

Where data is stored

Your apps, databases, Redis data and build artefacts are stored and run in India, on Microsoft Azure. Our control-plane database, which holds account, project and billing records, is hosted by Supabase in its Mumbai region (ap-south-1). Static sites and files in R2 object storage are stored and cached on Cloudflare's global network so they load fast everywhere. Backups are kept in Azure storage in India.

Service providers

We share data with these providers only as needed for them to do their job for us:

We may also disclose data when the law requires it, to protect people from harm, or as part of a merger or sale of the business, in which case this policy continues to apply.

How long we keep it

• Account data: for as long as your account is active.
• Build and runtime logs: about 30 days.
• Database backups: for the point-in-time window of your plan (7 to 30 days).
• Billing records: as long as tax and accounting law requires.
• When you delete your account, we delete your projects, databases, files and personal data within 30 days, except what the law requires us to keep.

Cookies

rivtor.com uses only essential cookies to keep you signed in. They are host-only __Host- cookies, so they are never sent to the apps hosted on *.rivtor.com, and we never set a cookie on .rivtor.com. We use no advertising or cross-site tracking cookies. Apps you deploy may set their own cookies; that is between the app's owner and its visitors.

Security

• Every app runs in its own gVisor sandbox, with its own network, and cannot reach other customers' apps.
• Each app has its own Postgres database and role, with no access to any other database.
• Secrets and environment variables are encrypted at rest, injected only at runtime, and never written to images, logs or tool responses.
• Databases have no public endpoint. Traffic reaches our servers only through Cloudflare.
• Team access to production uses single sign-on and hardware keys, and admin actions are logged.

If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

Your rights

You can ask us to:

• Give you a summary of the personal data we hold about you and how we use it.
• Correct or update inaccurate data.
• Delete your data, or delete your account from the dashboard.
• Export your data. Your database can be exported at any time with rivtor db export.
• Withdraw consent, or object to or restrict processing where the law gives you that right.
• Nominate another person to exercise your rights if you die or become incapacitated.

Write to legal@rivtor.com from the email on your account. We respond within 30 days. You can also complain to the Data Protection Board of India or your local data protection authority.

Children

Rivtor is not meant for anyone under 18 without the consent of a parent or guardian. We do not knowingly collect data from children; if you believe a child has signed up without consent, contact us and we will delete the account.

Changes

We will post updates here and change the date at the top. For material changes we email account holders before they take effect.

Contact and grievances

Our Grievance Officer can be reached at legal@rivtor.com. We acknowledge grievances promptly and resolve them within 30 days. Security or abuse concerns go to abuse@rivtor.com or the report form.