Privacy Policy

Last updated: October 28, 2026

This Privacy Policy explains how Rivo Labs LLC ("Rivo Labs", "we", "us"), a limited liability company organized in New Mexico, USA, collects, uses and shares information across our products: Rivo, Rivo AI and inotrack (together, the "Services"). By using the Services you agree to this Policy.

1. Who we are

Rivo Labs LLC, 1209 Mountain Road Pl #10346, Albuquerque, NM 87110, USA. Contact: [email protected]. For users in the EEA/UK, Rivo Labs LLC is the data controller, except for inotrack visitor data as described in §4.

2. Products covered

• Rivo — mobile and web application and related services.
• Rivo AI — AI-powered application and features (ai.rivo.day) that generate responses or content from user inputs.
• inotrack — a business (B2B) click- and traffic-tracking and analytics service.

3. Information we collect (Rivo and Rivo AI)

• Account data: email address, profile and settings; depending on the product and sign-in method, a hashed password, one-time email sign-in credentials, OAuth identity/profile data, session and device records, and optional passkey or two-factor authentication data.
• Content you provide: tasks, notes, calendar entries, contacts, financial records and files you choose to provide. AI features in Rivo and Rivo AI process prompts, instructions, relevant application or conversation context, attachments and generated outputs ("AI Content"). Rivo AI context may include file contents and tool results; published artifacts are available to recipients of their links.
• Purchase data: subscription or license status, orders, amounts and transaction identifiers; cryptocurrency payments also involve receiving addresses, blockchain transaction hashes and balance records. Blockchain transactions are public and cannot be erased by us. Rivo direct card payments use a hosted T-Bank payment page; we do not store full card numbers in our billing system. Any purchases offered through an app store are handled by that store.
• Device and usage data: depending on the feature and deployment, application version, platform, language, IP and browser information, account, instance and device identifiers, push tokens, and operational license, API and resource-usage events. Rivo AI also records account-linked advertising impressions and clicks. Some Rivo AI diagnostic logs remain on the execution device.
• Communications: messages you send us.

3a. AI processing (Rivo AI)

• Your inputs are processed to generate responses and provide the feature. We may use third-party AI model providers as sub-processors to process inputs and return outputs; they act under contract and are listed among our providers.
• We do not use your inputs or AI Content to train third-party public models. We use them to operate the feature and, only in de-identified or aggregated form, to monitor safety and improve quality, unless you give separate consent for more.
• AI output may be inaccurate or incomplete. Do not rely on it as professional (legal, medical, financial) advice, and do not submit others' personal or confidential data without a lawful basis.

4. inotrack data — two roles

• Controller for inotrack customer (account holder) data: name, email, password (hashed), business contact details, license and deployment identifiers, usage totals, security logs, and order and cryptocurrency transaction records. The license purchaser portal uses email sign-in links; tracker accounts may use a hashed password and optional two-factor authentication. Used to provide, bill, secure, support and improve inotrack.
• Processor for end-user/visitor data our customers collect through their tracking links (e.g. IP address, derived location and network information, device/browser signals, referrer, tracking and advertising identifiers, campaign and sub-ID values, click/conversion events, values, timestamps and postback parameters). For that data the customer is the controller and decides the purposes; we process it only on their instructions. Tracking pixels may also collect browser fingerprint signals and existing analytics identifiers. Standard click records store a salted IP hash and truncated network prefix rather than the full IP address. Visitors should consult the privacy policy of the customer whose links they used. Customers are responsible for a lawful basis and for required notices/consents.

5. How we use information

To: provide, maintain and secure the Services; manage accounts; process subscriptions; provide AI features; support users; analyze usage and improve the Services; detect and prevent fraud, abuse and security incidents; and comply with legal obligations.

6. Legal bases (EEA/UK)

Performance of a contract; your consent (where requested — e.g. optional analytics, marketing, or extended AI uses, withdrawable anytime); our legitimate interests (securing and improving the Services); and compliance with legal obligations.

7. Sharing

We do not sell personal data. We share it with: service providers and sub-processors (hosting, cloud storage, analytics, crash reporting, push notifications, AI model providers, payment processing, support) under contract; app stores/payment processors to complete purchases; authorities where required by law or to protect rights and safety; and a successor in a merger, acquisition or asset sale subject to this Policy.

Depending on the features and connections used, recipients include T-Bank, TronGrid or a configured TRON service, Apple push services, browser push services, Google and Telegram integrations for Rivo; and Anthropic, OpenAI, Google Gemini, OpenRouter and its downstream providers, Google/GitHub sign-in, and Apple/Google push services for Rivo AI. Rivo AI can also use local models, installed CLI tools or user-configured endpoints. Rivo AI image generation sends the prompt and, for editing, the source image to Google Gemini. Rivo AI conversation context is sent to the selected model connection; Rivo AI processing and retention may differ between API, gateway, local and CLI connections. Rivo AI is separate from the configured AI gateway used by Rivo. Configured hosting, storage and email services support these features.

For inotrack, customer-configured destinations may include advertisers, Meta, TikTok, Google Ads, Google Analytics, Yandex Metrica, VK advertising, MMP services and custom postback endpoints. Identifiers and conversion data transmitted depend on the integration and customer settings; these recipients are not necessarily our sub-processors. Customers must explain these disclosures and any required choices in their notices.

8. International transfers

We are based in the United States; we and our providers may process data in the US and other countries. Where required, transfers from the EEA/UK rely on Standard Contractual Clauses or another lawful mechanism.

9. Retention

We keep personal data while your account is active and as needed to provide the Services, then delete or anonymize it, unless a longer period is required by law. inotrack visitor data is retained per the customer's settings and deleted or returned on termination.

10. Security

We apply technical and organizational measures (encryption in transit, access controls, logging, backups). No method of transmission or storage is completely secure.

11. Your rights

Depending on your location you may have rights to access, correct, delete, port, restrict or object to processing, and to withdraw consent. EEA/UK (GDPR): you may complain to your supervisory authority. California (CCPA/CPRA): you may request access/deletion and opt out of "sale"/"sharing"; we do not sell personal information. For inotrack visitor data, end users should contact the relevant customer (controller); we assist as processor. To exercise rights, contact [email protected].

12. Children

The Services are not directed to children under 13 (or the minimum age in your country, e.g. 16 in parts of the EEA) and we do not knowingly collect their data. inotrack is a business tool and must not be used to knowingly collect children's data. If you believe a child provided us data, contact us and we will delete it.

13. Changes

We may update this Policy and will post a revised "Last updated" date; where required we will notify you. Continued use after changes means you accept the updated Policy.

14. Contact

Rivo Labs LLC — [email protected], 1209 Mountain Road Pl #10346, Albuquerque, NM 87110, USA.