Privacy Policy

1. Who we are and whose data this is

RivX provides customer relationship management software to business-financing brokerages ("Organizations"). Each Organization decides what information about its clients, business owners, lenders and partners it puts into RivX, and controls that information. We process it on the Organization's behalf and under its instructions.

If you're a business owner or another client of an Organization that uses RivX, please contact that Organization about your information. We'll help it respond.

2. Information we collect

• Account information: your name, work email address, phone number, role and Organization, your sign-in history and your two-factor authentication settings.
• Information Organizations enter: details about businesses and their owners, applications, documents, lender submissions and offers, contracts, fundings and commissions. This can include Social Security numbers and bank account numbers. Those are encrypted in our database and shown in full only through actions that are logged.
• Information from our public links: when a business owner fills in an application, approves an offer or signs an agreement through a link an Organization sent, we receive what they enter and upload, and we record the time and IP address when they sign.
• Usage and device information: IP address, browser type, pages visited, times and error logs. We use these for security (for example IP allowlists, session timeouts and audit logs) and to keep the Service working.
• Google user data, only if you connect a Google account (section 4).

Cookies: we use only the cookies needed to keep you signed in and to secure your session. We measure page views with Vercel Web Analytics, which doesn't use cookies, and we remove link tokens from the page addresses it receives. We don't use advertising cookies or trackers.

3. How we use information

• To provide the Service to the Organization: its deal workflow, documents, emails its users send, and payouts.
• To secure the Service: authentication, access controls, fraud and abuse prevention, and audit logs.
• To send service email such as invitations, password resets and notifications.
• To support you when you ask for help, and to find and fix problems.
• To comply with the law.

We don't sell personal information, and we don't use it for advertising.

4. Google user data

You can connect your Google account to RivX so that emails you send from RivX go out from your own Gmail address. When you connect, RivX asks Google for these permissions, and no others:

• Send email on your behalf (gmail.send): so that an email you write or start in RivX, such as a lender submission or a message to a client, is sent from your Gmail address and appears in your Sent folder.
• Your name, email address and profile picture (openid, email, profile): to confirm which Google account you connected and show it to you in RivX.

What RivX can't do. RivX doesn't ask for permission to read your mailbox. It can't read, search, label or delete your email, and it sends only the emails you ask it to send.

How we use it. Only to send the emails you ask RivX to send, to show which account is connected, and to keep a record of each sent email in the deal's history so your team can see what was sent.

How we store it. We store the authorization Google gives us (a refresh token) encrypted with AES-256-GCM, and it's used only on our servers, never in your browser. We also store the connected email address and, for each email sent through Gmail, the message and thread identifiers Google returns.

How we share it. We don't sell Google user data, and we don't transfer it to anyone except to provide this feature: to Google, to send your email, and to the providers that host the Service for us (section 5), under confidentiality and security obligations. We may also disclose it if the law requires it. We don't use Google user data for advertising or to determine creditworthiness or for lending purposes, and we don't use it to develop, improve or train generalized AI or machine-learning models. Google user data is never sent to SuperBroker, RivX's AI assistant. People at RivX don't read it unless you ask us to for support, it's needed to investigate abuse or a security incident, or the law requires it.

Disconnecting and deletion. You can disconnect your Google account at any time in your RivX profile, or remove RivX from your Google Account at myaccount.google.com/connections. When you disconnect in RivX, we revoke the authorization with Google and delete the stored token. Emails already sent stay in the deal history as part of the Organization's records. To have other Google user data deleted, write to support@rivx.io.

RivX's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. How we share information

• Within your Organization: its administrators and users see the information in its account, according to the roles the Organization sets.
• With lenders and partners, as the Organization directs: for example, when a user sends a submission to a lender.
• With service providers that run the Service for us: Supabase (database, sign-in and file storage), Vercel (hosting, branding files and page analytics) and Resend (service email). SuperBroker sends what you type to it through Vercel's AI Gateway to the AI model's provider (OpenAI). Don't type Social Security numbers, card numbers or bank account numbers into it.
• For legal reasons: to comply with the law or a valid legal request, or to protect the rights and safety of our users, the public or RivX.
• In a business transfer: if RivX is merged or acquired, with notice to Organizations.

6. Security

Data is encrypted in transit (HTTPS) and at rest. Social Security numbers, bank account numbers and Google authorization tokens are also encrypted by the application before they're stored. Access is limited by role, two-factor authentication and IP allowlists are available to every Organization, and security-relevant actions are logged. No system is perfectly secure, and we'll notify affected Organizations of a breach as the law requires.

7. How long we keep information

We keep an Organization's information while its account is active and as it instructs. After an account ends, we delete its information within 90 days, unless the law requires us to keep it longer. Security and audit logs are kept as long as needed for security and legal purposes.

8. Your choices and rights

You can see and correct most of your account information in your RivX profile. To ask for a copy of your information, or to have it corrected or deleted, contact your Organization's administrator or write to us. Depending on where you live, for example in California, you may have rights to know, correct and delete personal information, and we won't treat you differently for using them. We pass requests about an Organization's records to that Organization.

9. Children

The Service is for businesses and isn't directed to children. We don't knowingly collect information from children under 16.

10. Where information is processed

RivX is operated from the United States, and information is stored and processed in the United States.

11. Changes to this policy

We'll post any change on this page with a new date. If a change is material, we'll tell Organizations before it takes effect. We won't use Google user data in a new way without asking for your consent first.

12. Contact

RivX Technologies, support@rivx.io. See also our Terms of Service.