1. Who We Are

Rivvun AI Pvt Ltd ("the Company," "we," "us," or "our") is a financial operations technology company incorporated and operating in India. Our principal place of business is G Block, Bandra Kurla Complex, Mumbai, Maharashtra 400051, India.

The Company operates the website riwun.com and provides an autonomous FinOps agent that connects to your accounting data sources - QuickBooks Online, Xero, NetSuite, or CSV exports - and surfaces P&L variance signals in real time. This Privacy Policy explains what personal data and financial data we process, why we process it, and how we protect it.

For privacy enquiries, contact: [email protected].

2. Scope and Applicable Framework

The Company is subject to the Digital Personal Data Protection Act 2023 (DPDP Act) of India. This policy is written to satisfy the information and transparency obligations that apply to us as a Data Fiduciary under the DPDP Act. Where we serve users located outside India, we additionally follow international good-practice data handling standards consistent with those frameworks.

This policy covers personal data collected via riwun.com and through the Rivvun agent service. It does not cover third-party accounting platforms (QuickBooks, Xero, NetSuite) whose own privacy policies govern their data handling.

3. Personal Data We Collect

We collect the following categories of personal data:

  • Account and contact data you provide when requesting early access or registering: name, work email address, company name, role.
  • Authentication data: email address and hashed password used to access the Rivvun platform.
  • Communication content: messages you send to [email protected], support requests, and direct Slack messages sent during the design-partner programme.
  • Usage and technical data collected automatically: IP address, browser type, pages visited on riwun.com, session timestamps, error logs.
  • Financial data processed in-scan: when you connect an accounting data source, the Rivvun agent reads general ledger line items, vendor names, invoice amounts, dates, and cost category labels to detect variance signals. This financial data is processed transiently to generate flags and is not retained beyond the active scan window (see section 6).

The financial data described above includes information about your company's business operations. Where individuals are named in invoice or vendor records (for example, contractor names), that constitutes personal data under the DPDP Act. We treat it accordingly.

4. Purpose and Legal Basis for Processing

We process personal data for the following purposes:

  • Providing the service: to operate the Rivvun agent, deliver variance flags via Slack or email, and generate P&L summary reports for your account. Processing is necessary to perform the contract (or pre-contract steps) between you and the Company.
  • Account management: to authenticate you, manage your subscription, and communicate service updates. Necessary for performance of contract.
  • Design-partner programme: to onboard founding design partners, facilitate direct team access, and incorporate your feedback into the product roadmap. Necessary for performance of contract.
  • Customer support: to respond to your enquiries and resolve issues. Legitimate interests of the Company.
  • Site operation and security: to protect riwun.com from abuse, monitor for errors, and maintain service reliability. Legitimate interests of the Company.
  • Legal compliance: to comply with applicable Indian law and regulatory requirements. Legal obligation.

We do not use your financial data or the content of your accounting records to train machine learning models. P&L data is processed solely to generate variance flags and summaries for your account.

5. Sharing and Disclosure

The Company does not sell personal data.

We share personal data only in the following circumstances:

  • Service providers acting on our behalf: cloud infrastructure, email delivery, and analytics providers under written data-processing agreements. These processors act on our instructions and do not use your data for their own purposes.
  • Legal obligations: where required by applicable Indian law, court order, or lawful request from a competent authority.
  • Business transfers: in the event of a merger, acquisition, or transfer of substantially all assets, personal data may be transferred to the successor entity subject to equivalent protections.
  • With your consent: for any other disclosure not listed above, we will seek your explicit consent in advance.

Financial data read from your connected accounting sources is not shared with any third party except the infrastructure providers necessary to operate the service.

6. Retention

We retain personal data only for as long as necessary for the stated purposes:

  • Account data: retained for the duration of your active account plus 12 months after closure, to allow re-activation and for legal record-keeping.
  • Financial data processed in-scan: general ledger line items read during an active scan cycle are not persisted beyond the detection window. Variance flags generated from the scan (the output, not the underlying transaction detail) are retained for the duration of your account.
  • Communication records: support emails and Slack messages retained for up to 24 months.
  • Technical and usage logs: retained for up to 12 months for security and operational purposes.

7. Security

The Company applies administrative, technical, and physical safeguards designed to protect personal data from unauthorised access, disclosure, alteration, and destruction. All data in transit between your accounting sources, the Rivvun agent, and your notification endpoints is encrypted using industry-standard protocols. The Rivvun agent requests read-only OAuth access to accounting platforms and does not request write permissions.

We operate with India data residency for primary processing. Our cloud infrastructure is selected and configured to keep your data within India or regions with adequate data protection standards.

No security measure is absolute. If you become aware of a potential data security issue involving the Company, please contact [email protected] promptly.

8. Your Rights

Under the Digital Personal Data Protection Act 2023, you have the following rights as a Data Principal:

  • Right to access: you may request a summary of the personal data we hold about you and information about how it is being processed.
  • Right to correction and erasure: you may request correction of inaccurate or incomplete personal data, and erasure of personal data where we no longer have a lawful basis for retention.
  • Right to grievance redressal: you may raise a grievance with us regarding our processing of your personal data. We will acknowledge and address your grievance within a reasonable timeframe.
  • Right to nominate: you may nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.

To exercise any of the above rights, email [email protected] from the address associated with your account. We respond within 30 days. Complex requests may require additional time; we will inform you if so.

If your grievance is not resolved to your satisfaction, you have the right to approach the Data Protection Board of India once it is constituted under the DPDP Act.

9. Cookies

We use cookies and similar technologies on riwun.com. See our Cookie Policy for details on what we use and how to manage your preferences.

10. Children's Data

The Rivvun service is a business-to-business platform intended for use by finance professionals at companies. We do not knowingly collect personal data from individuals under 18 years of age. If you believe we have inadvertently collected such data, contact us immediately at [email protected].

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes, we will provide additional notice to registered users via email or in-product notification. Continued use of the service after the effective date of any update constitutes acceptance of the revised policy.

12. Contact

Rivvun AI Pvt Ltd
G Block, Bandra Kurla Complex
Mumbai, Maharashtra 400051, India
Email: [email protected]
Phone: +91 22 6710 4400