Privacy policy

riverz is an omnichannel support, sales and CRM platform that lets merchants and businesses centralize and answer, from a single inbox, their customers' conversations on WhatsApp, Instagram, Messenger, TikTok, Mercado Libre, the chat on their own website and email; it also connects their online store and places and answers phone calls with voice agents. The service is provided through riverz.co. For any privacy-related questions, write to us at info@riverzai.com.

We process two types of information:

• Merchant data (our customer): name, email, phone, account and company details, and the access tokens of the accounts they connect: WhatsApp, Facebook Pages, Instagram accounts, TikTok, Mercado Libre, their store (Shopify, Tiendanube or WooCommerce), their payments account (Mercado Pago) and their email (Gmail and Outlook). Tokens are stored encrypted.
• Data of the merchant's end customers: when a merchant connects their accounts, we process on their behalf the messages, comments, questions and post-sale messages, the conversations from the chat on their website, call audio and transcripts, public profile name, user identifiers, their order data and the conversation metadata that those people send them, in order to display them in the inbox and allow replies.

As the platform operator, riverz technically stores and processes the data of all the accounts that merchants connect (the tokens, encrypted, and the conversations), because it is essential to provide the service. However, each merchant can only see and manage THEIR OWN accounts: data is isolated per merchant and no merchant accesses another merchant's data. Our staff access this data only when strictly necessary to operate the service, provide support or comply with the law, under confidentiality obligations.

We use the data solely to provide the service: receive and display messages and comments, allow the merchant to respond, offer AI-assisted replies when the merchant enables them, generate support statistics and maintain system security. We do not sell personal data nor use it for third-party advertising.

riverz uses Meta's APIs (WhatsApp Business, Messenger Platform and Instagram). When a merchant connects their Facebook Page or Instagram account, we access their messages and comments only on the accounts they themselves authorize, and exclusively so they can manage them from riverz. Our use of information obtained from Meta complies with the Meta Platform Policies. We do not access third-party accounts that the merchant has not connected.

When a merchant connects their Mercado Libre account, we access only the data of THEIR OWN store that they authorize, questions, post-sale messages, orders and the necessary identifiers, and solely so they can manage it from riverz. Each seller authorizes access to their own account through the Mercado Libre login, and the resulting token only grants access to that seller's data. Our use of information obtained from Mercado Libre complies with its API terms. We do not access stores or accounts the merchant has not connected.

We rely on providers that process data on our behalf, under contract and only to operate the service:

• Meta Platforms (WhatsApp, Messenger, Instagram and advertising APIs).
• TikTok (when the merchant connects their account, to read and reply to the comments on their posts).
• Supabase (database and storage).
• Render (application hosting).
• AI model providers (Anthropic, Google, OpenAI, Groq and Cerebras), only when the merchant enables the agent or the voice agents.
• Telephony and voice providers (Telnyx, LiveKit, Deepgram, Cartesia, ElevenLabs and Fish Audio), only when the merchant enables the voice agents.
• Store platforms (Shopify, Tiendanube and WooCommerce), when the merchant connects theirs.
• Mercado Libre (when the merchant connects their account).
• Mercado Pago (payment links and payment notifications, when the merchant connects their account) and Stripe (billing for riverz plans). Card data is handled by the payment processor and never passes through our servers.
• Google and Microsoft (Gmail and Outlook email, when the merchant connects their inbox).
• Resend (delivery of the emails riverz sends: verification, account recovery and notices).

We retain data for as long as the merchant's account is active and the data is necessary to provide the service. Call recordings and transcripts are kept while the merchant leaves that option on and does not delete them. When an account is deleted, or when a valid deletion request is received, we erase or anonymize the associated data within a reasonable period.

You can request access to, correction of, or deletion of your data. If you are a user who interacted with a merchant that uses riverz, you can request the deletion of your data at any time.

Learn how at riverz.co/data-deletion. Automatic requests from Meta (when the app is removed) are processed through our data deletion callback.

We encrypt access tokens, verify the signature of incoming webhooks and apply per-account access control. Even so, no system is 100% foolproof; we work to protect your information continuously.

If a public authority or law-enforcement body requests personal data from us (for example, in connection with national-security or law-enforcement requests), we apply the following policies:

• We carry out a required review of the legality of each request before responding.
• We have provisions for challenging requests that we consider unlawful, overbroad or unfounded.
• We apply a data-minimization policy: we disclose only the minimum information strictly necessary.
• We document these requests, our responses, and the legal reasoning and actors involved.

riverz operates from the United States and relies on providers located primarily there (see the subprocessors section). If you use the service or contact us from outside the United States, for example, from the European Union, the United Kingdom, Latin America or another region, your data may be transferred to and processed in the United States and in other countries where our providers operate, whose data-protection laws may differ from those of your country. Where applicable law requires it, we rely on recognized safeguards for these transfers, such as the European Commission's Standard Contractual Clauses. By using the service you agree that your data is processed in accordance with this policy.

If you are located in the European Economic Area, Switzerland or the United Kingdom, the GDPR (and the UK GDPR) grant you the following rights over your personal data:

• Access: obtain confirmation of whether we process your data and a copy of it.
• Rectification: correct inaccurate or incomplete data.
• Erasure («right to be forgotten»): request that we delete your data where applicable.
• Restriction and objection: restrict or object to certain processing.
• Portability: receive your data in a structured, commonly used format.
• Withdraw consent at any time, without affecting the lawfulness of prior processing.
• Lodge a complaint with your data-protection authority.

To exercise these rights, write to us at info@riverzai.com. Where we act as a processor on behalf of a merchant, we may forward your request to the merchant acting as controller. We process data to perform our contract with you, to comply with legal obligations, or with your consent, as applicable.

If you are a California resident, the CCPA (as amended by the CPRA) grants you specific rights:

• Know what personal information we collect, for what purposes, and with whom we share it.
• Request deletion of your personal information.
• Request correction of inaccurate information.
• Not be discriminated against for exercising your rights.
• We do not sell or share your personal information for advertising purposes, so we do not engage in a «sale» under the CCPA.

To exercise these rights, write to us at info@riverzai.com. We will verify your identity before responding. You may designate an authorized agent to submit requests on your behalf.

If you enable voice agents, we process the phone number and the audio/transcript of calls (inbound and outbound) to provide the service. Calls may be recorded when the merchant turns it on; in that case a spoken recording disclosure is played at the start. Audio is processed through sub-processors (telephony and voice/AI model providers, e.g. Telnyx, LiveKit, Deepgram, Cartesia, ElevenLabs, Fish Audio and the language-model provider) solely to run the call. Recipients can ask not to be called ("Do not call") and the merchant must respect calling hours and local calling regulations. We do not use call content for advertising.

The website chat is a widget the merchant installs on their own site. When a visitor opens it, we process on the merchant's behalf the messages they write, a browser identifier so the same conversation can continue if they come back, and the page they wrote from. Contact details are only collected if the visitor types them. The merchant is the controller of that data, and it is the merchant who must disclose it in the privacy notice of their own site.

If the merchant turns it on, riverz reports to Meta the sales that started in conversations so they can measure how their ads perform. We send the fact of the purchase and its value, along with hashed contact identifiers; we do not send conversation content. The merchant enables it and the merchant must disclose it in their own privacy policy. riverz does not sell personal data and does not use it for our own advertising.

We only use the cookies the service needs to work: the one that keeps you signed in, the one that protects forms against forged requests, and the one that remembers your chosen language. We do not use advertising or cross-site tracking cookies, which is why you will not see a banner asking permission to set them.

We may update this policy. We will publish any changes on this page along with their update date.

Questions? Write to us at info@riverzai.com.