Privacy Policy

This policy explains what Rivett collects, why, and what you can do about it. It covers the Rivett web application and the API behind it.

1. What we collect

Account information. Your name, email address and role within your workspace, supplied when you register or when an administrator invites you. Authentication is handled by Auth0; we receive your profile from them and never see your password.

Workspace data. Everything you enter into the product — parts, locations, stock levels, movement history, bills of materials, and the names, reasons and timestamps attached to each inventory movement.

Billing information. Your plan, subscription status and billing history. Card details go directly to Stripe; we never receive or store them.

Technical data. Standard server logs, and — when something breaks — error diagnostics that may include your user and workspace identifiers. We use privacy-friendly analytics that do not track you across other websites.

2. Why we process it

• To operate the service and show you your own data.
• To authenticate you and enforce who may see which workspace.
• To take payment and manage your subscription.
• To send transactional email you have asked for or that the service requires — team invitations, low-stock alerts, billing notices, and notice of price or terms changes.
• To diagnose faults, prevent abuse, and keep the service secure and available.

We do not sell your data, share it with advertisers, or use your workspace data to train machine learning models.

3. Cookies

We set a session cookie to keep you signed in, and a small preference cookie remembering whether your sidebar is open. We also store a small amount of preference and session data in your browser, such as which onboarding steps you have finished and where to return you after a payment. All of it is strictly necessary to how the application works. We do not use advertising or cross-site tracking cookies.

4. Who else processes your data

We use the following processors. Each is bound to handle your data only on our instructions, and we share with them only what they need to do their job.

• Auth0 (Okta, Inc.) — Authentication. Holds your email address, name and login credentials.
• Stripe, Inc. — Subscription billing and payment processing. Holds your billing details. We never see or store your card number.
• Vercel Inc. — Hosting for this web application, and privacy-friendly traffic analytics.
• Managed PostgreSQL hosting — Stores your workspace data — parts, locations, stock levels and movement history.
• Resend — Delivers transactional email such as team invitations and low-stock alerts.
• Functional Software, Inc. (Sentry) — Error monitoring. Receives technical diagnostics when something breaks, which may include your workspace and user identifiers.

We may also disclose data where the law requires it, or to establish or defend a legal claim. If Rivett is ever acquired, your data may transfer as part of that business, and this policy continues to apply to it until you are given notice of a replacement.

5. Where your data is held

Your data is stored and processed in the United States. It is encrypted in transit and at rest, and backed up nightly.

6. How long we keep it

• While your account is open: as long as you keep it. We do not expire your workspace data, and a lapsed subscription makes it read-only rather than deleting it.
• After you close your account: we delete your workspace data within 30 days, except where we must keep records — invoices and payment history — to meet a legal or tax obligation.
• Error diagnostics and server logs: retained for up to 90 days.

7. Your rights

• Export. Download your parts, inventory and movement history as CSV from the Import & Export screen, any day, on any plan.
• Correct. Edit your own profile, and your workspace data, in the product.
• Delete. Ask us to close your account and delete your data, and we will do so within 30 days.
• Access and object. Ask what we hold about you, or object to a particular use of it, by writing to us.

If your workspace is administered by your employer, they control your access to it and may hold your data independently of us. Requests about workspace data should usually go to them first.

8. Children

Rivett is a business tool and is not directed at anyone under 16. We do not knowingly collect data from children.

9. Changes to this policy

If we make a material change we will notify account administrators by email before it takes effect. The effective date at the top of this page always reflects the current version.

10. Contact

Privacy questions, and any request under section 7, go to hello@rivett.io. Our terms of service cover the commercial relationship.