Draft
This page summarizes the Data Processing Agreement ("DPA") available to organizations using Rivvol. For any paying customer, a signed DPA, not this summary, is the governing document. Contact us to execute one.
The customer organization is the data controller for its employees' data. Rivvol, Inc. acts as data processor, handling that data only to provide the service and only on the organization's instructions.
Account and profile data, Preference Profile responses and support settings (including any optional note to a manager), Check-in responses, Support Pings, workload information from the organization's own systems, a home address (only if the employee adds one, used only to estimate commute and only if they opt in), and, only where the organization enables it, compensation data used for internal risk calculations. Home addresses are never shown to managers or HR, compensation is never shown to managers, and neither is ever included in an AI prompt.
For schools in the education pilot, student and family data is governed by a separate, signed student data privacy agreement. See section 8 of the Privacy Policy.
Rivvol uses these sub-processors to operate the service: database hosting (Supabase), an AI model provider (Anthropic) that writes Suggestions, email delivery, and, once billing launches, payment processing. To estimate commute for employees who opt in, Rivvol also sends home addresses to the U.S. Census Bureau's public geocoder to turn them into map coordinates. A current list is available on request and will be published here once finalized.
Row-level tenant isolation enforced at the database layer, role-based access control, audit logging on administrative actions, and encryption in transit. Full technical and organizational measures are detailed in the signed DPA.
Rivvol will assist the controller in responding to data subject access, correction, and deletion requests within the timeframes the signed DPA specifies.
Where applicable, transfer mechanisms (such as Standard Contractual Clauses) will be specified in the signed DPA.
Contact support@rivvol.com to request and execute a Data Processing Agreement for your organization.