Privacy policy

Rivo (me.rivo.day) is a “founder’s command centre” service: money, payment plan, liabilities, investments, password vault, calendar, AI assistant, contacts, documents — in a single instance, delivered in three ways. The operator’s legal entity (or sole proprietorship) is in the process of registration; until then, the contact for all matters, including data processing, is [email protected]. As soon as registration is complete, the company details will appear in this section.

Rivo is one and the same product delivered in three ways, and they affect privacy differently.

• Self-host. You install Rivo on your own server. All data — money, vault passwords, documents, assistant history — stays there and never reaches our servers. The only exchange with us is the daily license key check by the license server (see section 4): only the key itself and the instance ID are transmitted.
• Managed VPS. The instance runs on a dedicated virtual machine on our Proxmox infrastructure, but SSH root access is yours. Technically your data is stored on our hardware, but we do not log in to your VM or read the contents of the database in normal operation; access is used only to administer the host (updates, infrastructure backups, incident response) and at your request to support.
• Cloud. A multi-tenant instance on a shared cluster: you have your own isolated database schema (`t_<slug>`), but it physically resides in a shared DBMS under our management. We provide isolation between customers at the schema level and technical operation (backups, updates, security), and we do not use the contents of your data for anything other than providing the service to you.

• Account and payment (license server, all plans). Email, license key history, subscription status, USDT payment records (the address and transaction hash of our own watch-only wallet — no third-party payment processor is used, and we neither receive nor store bank or card data).
• Cloud waitlist. If you asked to be notified when Cloud launches: email, the selected plan, an optional note, the referral source (utm tags and the external referrer) and a hash of the IP address — for abuse protection only, the address itself is not stored. Without confirmation by code the entry is deleted after 7 days. We use it once — to write to you about the launch; you can have the entry deleted by writing to the address in section 14.
• Instance contents (Managed VPS and Cloud only). What you yourself enter into the product: transactions and accounts, liabilities, vault records (encrypted, see section 5), documents, conversations with the assistant, contacts.
• Technical logs. Standard web server and API logs (IP, request time, response code) for operation and security, rotated automatically.
• Google account data (with your consent). See section 4 separately.

The calendar module in Rivo can sync with your Google Calendar: show events, create and edit meetings, add Google Meet, and process bookings via a public booking page. This works only if you connect the account yourself via Google OAuth in the settings — there is no access without your explicit consent.

• We request only the calendar (events) access required for the listed features — not access to mail, Drive or other Google services.
• The access token is stored encrypted on the instance you connected it to (on your server for Self-host, on our infrastructure for Managed VPS and Cloud) and is used only for requests made on your behalf through your own actions in the product.
• Calendar data is not passed to advertising networks or data brokers and is not used to train models.
• You can revoke access in two ways: in the Rivo settings (“Disconnect Google”) or directly in your Google Account → Security → Third-party apps with account access.

Rivo’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The vault works in one of two modes, and you choose the mode. A new instance starts with a server-side key: the secret fields of entries are stored encrypted, but the server can decrypt them — on Managed VPS and Cloud that server is on our infrastructure.

End-to-end encryption can be turned on in the vault settings. Then the key to your passwords exists only on your devices: it is derived from the master password and never leaves the device, and the server stores passwords, logins, notes, 2FA codes and hidden fields only in encrypted form and cannot read them. What stays open: entry titles, website addresses, tags, dates, field names and non-hidden field values, the access log and the “weak”, “breached” and “reused” badges (without the passwords themselves), as well as service entries — bot and integration keys you yourself marked as service entries: the server reads them in order to hand them out without you. After the switch the server keeps a snapshot of the vault from before the migration — for rollback; it holds logins and notes in plain text and passwords under the server key. What is said above about end-to-end encryption fully applies once that snapshot is deleted.

The assistant runs either on your own LLM provider key (BYOK — requests go from you directly to the provider and we do not see them) or through our proxy by subscription — in that case the request text and the related context (for example, the `fin/summary` digest) are passed to the selected LLM provider to obtain a response and are not used by us for anything other than that request.

The me.rivo.day website and the customer account do not use cookies or third-party analytics trackers. The colour theme and the customer account access token are stored in your browser’s localStorage and are not sent to the server automatically. Referral tags (utm, the external referrer) are kept in sessionStorage until the tab is closed and are sent to the server only if you yourself leave your email on the Cloud waitlist.

We do not sell or pass your data to advertising networks or data brokers. Data may be shared only with: infrastructure providers that supply hosting (for the Managed VPS and Cloud plans), services you connect to from the product yourself (Google, Telegram, your LLM provider), and upon a direct lawful request — should one arrive.

In Cloud and on Managed VPS: Settings → Account and data → “Build archive”. The ZIP archive is built in the background; when it is ready you get a notification (and an email in Cloud). Inside is everything you entered: dashboard data (tasks, contacts, leads, events, projects), the finance block — the transaction ledger, accounts, liabilities, plan and envelopes (CSV and JSON), bookings, documents, uploaded files. The archive is kept for 24 hours and can be downloaded once via a one-time link, after which it is deleted; while it waits to be downloaded it is stored on the server encrypted. No more than 3 exports per day. Export works even when the subscription has ended and the instance has switched to read-only mode.

• The account password, sessions, device and API tokens, passkeys and integration keys (banks, Google, Telegram, LLM) are not included in the archive: they are access credentials, not data.
• The vault — only if you ticked it when exporting. An end-to-end encrypted vault goes into the archive as is — as ciphertext that only your master password can open. A vault encrypted by the server goes into the archive in plain text and only after confirmation (Touch ID / Face ID or PIN) — with a warning about it.
• On Self-host export works the same way and the data goes nowhere — your server builds the archive.

In Cloud: Settings → Account and data → “Delete account” (you need to enter the instance address and confirm sign-in). Deletion takes effect after 7 days — until then everything works as before, a reminder is shown above the sections, an email is sent, and deletion can be cancelled in the same place. After 7 days the instance database, files and export archives are deleted, access to connected services (Google) is revoked, the address <slug>.me.rivo.day is released, the subscription is closed, and you receive an email confirming the deletion. Backups (the final one and scheduled ones) are kept for no longer than 63 days solely in case of a technical failure, are accessible only to us and are then deleted. A deleted account cannot be restored on request.

An unpaid Cloud instance is deleted the same way — after 30 days in read-only mode, with warnings 7 days and one day before; its backups are likewise kept for no more than 63 days. On Managed VPS deletion is by email to [email protected]: the virtual machine and its disks are deleted together with the data. On Self-host, deleting data is entirely in your hands — the data is on your server. The license-server record (email, key and payment history) remains after the instance is deleted for payment accounting; you can have it deleted by writing to the address in section 14.

Connections use HTTPS/TLS, and sensitive fields (vault, tokens, uploaded files, scheduled Cloud backups) are stored encrypted.

The service is not intended for persons under 16, and we do not knowingly collect their data.

If the policy changes materially, we will update the date at the top of the page and, where appropriate, notify you by email. Continued use of the service after an update means acceptance of the new version.

For any questions about data processing, including a deletion request or withdrawal of consent: [email protected].