Privacy Policy

Last updated: July 28, 2026

Rivet (“we”, “us”) builds AI customer service tools for ecommerce. This policy explains what data we collect, why we collect it, and the choices you have. We designed Rivet to collect the minimum needed to provide accurate, real-time answers.

1. Data we collect

We process four categories of data:

Merchant account data

When you sign up: your email address, (optionally) a password hash, and the product catalog you upload (names, prices, stock levels, descriptions). We use this to power your chatbot.

Visitor chat data

Messages your customers send to the Rivet widget, and the responses generated. This includes emails submitted via the “Contact sales” feature. We store this to provide the service and to show you lead summaries.

Google OAuth data

If you sign in with Google, we receive your Google account email and a unique Google ID. We do notaccess your Google contacts, emails, or any other Google data beyond what's needed to sign you in.

AI processing data

To generate responses, visitor messages are sent to our AI provider (Zhipu GLM). The provider processes these messages solely to return a reply, under their own data terms. We do not use your data to train AI models.

2. Why we process your data

  • To provide the Rivet service — answering your customers' questions using your live data.
  • To create and manage your account.
  • To generate aggregated, anonymous analytics about service usage.
  • To comply with legal obligations.

Our legal bases under GDPR: contract performance (providing the service), legitimate interest (service improvement), and consent (where you opt in).

3. Data retention

We retain your data for as long as your account is active. Visitor chat transcripts are retained for 90 days by default. If you delete your account, we remove your data within 30 days, except where retention is required by law.

4. Data sharing

We share data only with:

  • Our AI provider (Zhipu GLM) — to process chat messages and generate replies.
  • Infrastructure providers — hosting and email delivery services, under data processing agreements.
  • Legal authorities — only when compelled by valid legal process.

We never sell your data. We never share it for advertising.

5. Your rights (GDPR / CCPA)

Depending on your location, you have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate data.
  • Delete your data (“right to be forgotten”).
  • Export your data in a portable format.
  • Object to or restrict certain processing.
  • Withdraw consent at any time.

To exercise any of these rights, email privacy@rivetchat.net. We respond within 30 days.

6. Security

We use industry-standard measures: encrypted passwords (bcrypt), signed session tokens, HTTPS for all traffic, and field-level data masking that lets you control what your chatbot can reveal. However, no system is 100% secure, and we cannot guarantee absolute security.

7. International transfers

Your data may be processed in countries other than your own (including the United States and China, where our AI provider operates). Where required, we use appropriate safeguards such as Standard Contractual Clauses.

8. Children's privacy

Rivet is not directed at children under 16, and we do not knowingly collect their data. If you believe we have, please contact us.

9. Changes to this policy

We may update this policy. Material changes will be notified by email or in-app notice at least 30 days before taking effect.

10. Contact

Questions about privacy? Email privacy@rivetchat.net. For data protection inquiries, you also have the right to lodge a complaint with your local supervisory authority.