1. Who is responsible

RIVA is the controller for processing connected with the website, demo, accounts, security and commercial relationship. For documents that a customer company adds to the service, that company determines the purposes and RIVA will normally act as processor.

Controller: Riva Tools S.L.
Spanish tax ID: B63646360
Registered tax address: Carre Bisbe Abad I Lasierra, 35
Privacy contact: privacidad@riva.tools
Data protection officer: No DPO has been appointed because one is not mandatory for the activity described.

2. Account and commercial data

We collect information you provide when registering, configuring your company, inviting other people, requesting help or dealing commercially with RIVA.

Identity and contact details: first and last name, work email and, where relevant, telephone number.
Account and access details: user ID, credentials managed by the authentication provider, invitations, roles, permissions and login activity.
Company and configuration details: legal name, tax number, address, sector, preferences, team, requested plan and workspace settings.
Commercial relationship and support: requests, messages, incidents, consent and billing details when paid subscriptions become available.

3. Documents processed for customers

RIVA organises and compares purchasing documents. They may contain data about employees, sole traders, supplier contacts, customers or other people named in the documents.

Original files uploaded or sent by the customer: purchase orders, delivery notes, invoices, price lists, images and related documents.
Data extracted from those documents: suppliers and other parties, tax numbers, addresses, references, dates, products, quantities, prices, taxes and totals.
Links, corrections, reviews, possible duplicates, discrepancies and decisions confirmed by users in the application.
Intake channel metadata, such as email sender and recipient or WhatsApp identifier and number, if the company enables those channels.

4. Public demo, website and technical data

The demo is designed to minimise data and does not require an account. Reading a document still involves temporarily processing its content and technical data needed to protect the service.

The one-page file and tax number you provide are processed to verify the reading belongs to your organisation and show a limited result; RIVA does not retain them in its database after responding.
The artificial intelligence provider temporarily receives the document to read it. Do not use the demo for special-category data or information you are not authorised to process.
For security and abuse control, status, dates, model, usage and pseudonymised HMAC fingerprints of the IP address and file are stored; the plain IP address, filename and extracted data are not stored.
The browser stores the selected language and free-reading counter locally. Abuse prevention processes technical data about the device and connection.

5. Purposes, legal bases and periods

We apply a legal basis and retention criterion to every use. When the period ends, data is deleted or kept restricted solely to address legal liabilities.

Purpose	Legal basis	Retention
Create and manage accounts, provide RIVA and deliver support.	Performance of a contract or pre-contractual steps (GDPR Art. 6(1)(b)).	While the account or relationship is active and then restricted for the applicable limitation periods.
Process the requested demo and return its result.	Pre-contractual steps requested by the user (GDPR Art. 6(1)(b)).	RIVA does not store the file, tax number or result after responding; technical records are retained only for the period needed for security and abuse control.
Protect the service, prevent fraud, limit abuse and preserve traceability.	Legitimate interest in the security and defence of the service (GDPR Art. 6(1)(f)).	For as long as needed to investigate incidents and establish or defend claims, subject to periodic review and deletion.
Meet accounting, tax and legal obligations and authority requests.	Legal obligation (GDPR Art. 6(1)(c)).	For the period required by each law; where applicable, 4 years for Spanish tax obligations and 6 years for business records.
Send marketing communications about RIVA.	Consent, or legitimate interest where the law permits messages about similar services to existing customers.	Until consent is withdrawn or the recipient objects, then restricted to evidence the request.

6. Recipients and providers

We do not sell personal data. Under contract and only where needed, data may be accessed by hosting, database and authentication providers (Supabase), deployment and network providers (Vercel), AI document-reading services (Anthropic), abuse-prevention services (Cloudflare), and email or WhatsApp providers where the customer enables those channels. We may also disclose data to authorities, courts or advisers when legally required or needed to establish, exercise or defend legal claims.

7. International transfers

Some providers may process data outside the European Economic Area or provide support from other countries. A valid GDPR transfer mechanism is required before they are used.

Depending on the case, safeguards will be a European Commission adequacy decision, the EU–US Data Privacy Framework for participating organisations, or standard contractual clauses with supplementary measures. You may request details of the applicable safeguards from the privacy contact.

8. RIVA as a processor

The customer company is responsible for having a legal basis to upload documents and informing the people concerned. RIVA processes them on its instructions to provide the service, apply security, assist with rights, and return or delete data when the relationship ends.

These duties, subprocessors, assistance, breaches and the fate of data must be set out in the GDPR Article 28 data processing agreement accompanying the service contract.

9. Artificial intelligence and automated decisions

RIVA uses artificial intelligence models to read and structure documents and may flag matches, duplicates or differences. Results can be wrong and must be reviewed. RIVA does not make decisions based solely on automated processing that produce legal or similarly significant effects on people.

10. Security, cookies and local storage

We use risk-appropriate technical and organisational measures, including company- and role-based access, encryption in transit, activity logs, backups and data minimisation. No system is completely infallible. The website uses local storage to remember language and manage the demo and may use strictly necessary security technologies; any additional cookies will be described in the cookie policy and require consent where applicable.

11. Your rights

You may exercise the rights in GDPR Articles 15–22 free of charge. If your request concerns data in a customer company’s documents, we will refer it to that company or assist it as processor.

Access your data and obtain a copy.
Correct inaccurate or incomplete data.
Request erasure or restriction, or object to processing where applicable.
Receive data you provided in portable form where the legal requirements are met.
Withdraw consent at any time without affecting earlier processing.

Send your request, stating the right you wish to exercise and the information needed to identify you, to privacidad@riva.tools.

If you believe the processing is incorrect, you may complain to the Spanish Data Protection Agency at www.aepd.es.

12. Changes to this policy

We will update this policy when the service, providers or law change. We will publish the date of the new version and communicate material changes appropriately. The version published at this URL is the applicable version.

Privacy policy