Privacy policy

riverz is an omnichannel support and CRM platform that lets merchants and companies centralize and respond, from a single inbox, to their customers' conversations on WhatsApp, Instagram, Messenger, Mercado Libre and email. The service is provided through riverz.co. For any privacy-related questions, write to us at info@riverzai.com.

We process two types of information:

• Merchant data (our customer): name, email, account and company details, and the access tokens of the accounts they connect (WhatsApp, Facebook Pages, Instagram accounts, Mercado Libre, Shopify and email — Gmail and Outlook). Tokens are stored encrypted.
• Data of the merchant's end customers: when a merchant connects their accounts, we process on their behalf the messages, comments, questions and post-sale messages, public profile name, user identifiers and conversation metadata that those people send them, in order to display them in the inbox and allow replies.

As the platform operator, riverz technically stores and processes the data of all the accounts that merchants connect (the —encrypted— tokens and the conversations), because it is essential to provide the service. However, each merchant can only see and manage THEIR OWN accounts: data is isolated per merchant and no merchant accesses another merchant's data. Our staff access this data only when strictly necessary to operate the service, provide support or comply with the law, under confidentiality obligations.

We use the data solely to provide the service: receive and display messages and comments, allow the merchant to respond, offer AI-assisted replies when the merchant enables them, generate support statistics and maintain system security. We do not sell personal data nor use it for third-party advertising.

riverz uses Meta's APIs (WhatsApp Business, Messenger Platform and Instagram). When a merchant connects their Facebook Page or Instagram account, we access their messages and comments only on the accounts they themselves authorize, and exclusively so they can manage them from riverz. Our use of information obtained from Meta complies with the Meta Platform Policies. We do not access third-party accounts that the merchant has not connected.

When a merchant connects their Mercado Libre account, we access only the data of THEIR OWN store that they authorize —questions, post-sale messages, orders and the necessary identifiers— and solely so they can manage it from riverz. Each seller authorizes access to their own account through the Mercado Libre login, and the resulting token only grants access to that seller's data. Our use of information obtained from Mercado Libre complies with its API terms. We do not access stores or accounts the merchant has not connected.

We rely on providers that process data on our behalf, under contract and only to operate the service:

• Meta Platforms (WhatsApp, Messenger and Instagram APIs).
• Supabase (database and storage).
• Render (application hosting).
• Anthropic (AI models, only when the merchant enables the assistant).
• Shopify (when the merchant connects their store).
• Mercado Libre (when the merchant connects their account).
• Google and Microsoft (Gmail and Outlook email, when the merchant connects their inbox).

We retain data for as long as the merchant's account is active and the data is necessary to provide the service. When an account is deleted, or when a valid deletion request is received, we erase or anonymize the associated data within a reasonable period.

You can request access to, correction of, or deletion of your data. If you are a user who interacted with a merchant that uses riverz, you can request the deletion of your data at any time.

Learn how at riverz.co/eliminar-datos. Automatic requests from Meta (when the app is removed) are processed through our data deletion callback.

We encrypt access tokens, verify the signature of incoming webhooks and apply per-account access control. Even so, no system is 100% foolproof; we work to protect your information continuously.

If a public authority or law-enforcement body requests personal data from us (for example, in connection with national-security or law-enforcement requests), we apply the following policies:

• We carry out a required review of the legality of each request before responding.
• We have provisions for challenging requests that we consider unlawful, overbroad or unfounded.
• We apply a data-minimization policy: we disclose only the minimum information strictly necessary.
• We document these requests, our responses, and the legal reasoning and actors involved.

riverz operates from the United States and relies on providers located primarily there (see the subprocessors section). If you use the service or contact us from outside the United States —for example from the European Union, the United Kingdom, Latin America or another region— your data may be transferred to and processed in the United States and in other countries where our providers operate, whose data-protection laws may differ from those of your country. Where applicable law requires it, we rely on recognized safeguards for these transfers, such as the European Commission's Standard Contractual Clauses. By using the service you agree that your data is processed in accordance with this policy.

If you are located in the European Economic Area, Switzerland or the United Kingdom, the GDPR (and the UK GDPR) grant you the following rights over your personal data:

• Access: obtain confirmation of whether we process your data and a copy of it.
• Rectification: correct inaccurate or incomplete data.
• Erasure («right to be forgotten»): request that we delete your data where applicable.
• Restriction and objection: restrict or object to certain processing.
• Portability: receive your data in a structured, commonly used format.
• Withdraw consent at any time, without affecting the lawfulness of prior processing.
• Lodge a complaint with your data-protection authority.

To exercise these rights, write to us at info@riverzai.com. Where we act as a processor on behalf of a merchant, we may forward your request to the merchant acting as controller. We process data to perform our contract with you, to comply with legal obligations, or with your consent, as applicable.

If you are a California resident, the CCPA (as amended by the CPRA) grants you specific rights:

• Know what personal information we collect, for what purposes, and with whom we share it.
• Request deletion of your personal information.
• Request correction of inaccurate information.
• Not be discriminated against for exercising your rights.
• We do not sell or share your personal information for advertising purposes, so we do not engage in a «sale» under the CCPA.

To exercise these rights, write to us at info@riverzai.com. We will verify your identity before responding. You may designate an authorized agent to submit requests on your behalf.

If you enable voice agents, we process the phone number and the audio/transcript of calls (inbound and outbound) to provide the service. Calls may be recorded when the merchant turns it on; in that case a spoken recording disclosure is played at the start. Audio is processed through sub-processors (telephony and voice/AI model providers, e.g. LiveKit, Telnyx, Deepgram, ElevenLabs, Modal and the language-model provider) solely to run the call. Recipients can ask not to be called ("Do not call") and the merchant must respect calling hours and local calling regulations. We do not use call content for advertising.

We may update this policy. We will publish any changes on this page along with their update date.

Questions? Write to us at info@riverzai.com.