How Rivulet handles your data

Rivulet (“Rivulet”, “we”, “us”) operates the website getrivulet.io, the web application app.getrivulet.io and the Rivulet add-on for Adobe Express. Rivulet is the data controller for the personal data described in this policy. Our infrastructure runs in the European Union (AWS Frankfurt region) and we apply the EU General Data Protection Regulation (GDPR) to all users.

You can reach us about anything in this policy at hello@getrivulet.io.

Account data. When you create an account we store your email address, a user id, the sign-in method you used, and the date you registered. If you sign in with Google or Microsoft we also receive your name and profile picture URL from that provider. If you sign in with an email code, we store only your email address.

Content you upload or create. The images you upload, the text and CSV files you attach to text steps, watermark files, the workflows you build (step types and their settings), and the results that each workflow run produces. We also keep a log of each run: when it started and finished, which steps ran, their status and any error messages.

Billing data. Payments are handled by Stripe. We store your plan, subscription status, billing period and a Stripe customer reference. We never see or store your full card number.

Usage data. Which pages and features you use, button clicks, errors, approximate location derived from your IP address, browser type and screen size. We collect this through PostHog to understand how the product is used and to fix bugs.

Technical data. IP address, device and browser information, and server logs generated when you use the service.

Communications. Emails you send us and, if you book a call with us, the details you provide to the scheduling tool.

This section describes exactly how Rivulet accesses, uses, stores, shares, retains and deletes Google user data when you sign in with Google. “Sign in with Microsoft” works the same way with the equivalent Microsoft profile data.

Data accessed

When you choose “Continue with Google” we request only the basic sign-in scopes openid, email and profile. Through them we receive your Google account email address, your name, your profile picture URL and a Google account identifier. We do not request or receive access to Google Drive, Gmail, Photos, Calendar, Contacts or any other Google data, and we never ask for additional scopes later.

Data usage

We use this data for one purpose: to create your Rivulet account, sign you in on later visits and show your name and avatar in the app. Your email address is also used to send you service emails (sign-in codes, receipts, important notices) and to link your subscription to your account. Google user data is not used for advertising, is not used to train AI models and is not combined with data from other sources for profiling.

Data sharing

We do not sell Google user data and we do not transfer it to third parties except the service providers that are necessary to operate Rivulet, acting on our instructions:

• Supabase hosts our authentication service and database, where your email, name, avatar URL and account identifier are stored.
• Stripe receives your email address when you start a paid subscription, to create your customer record and send receipts.
• PostHog (EU hosting) receives your account identifier and email address so that usage analytics and error reports can be tied to your account for support and product improvement.

Your name and profile picture are never shared with AI providers, webhook destinations or anyone else. We may disclose data if required by law. Rivulet's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Humans at Rivulet do not read Google user data except to answer a support request you make, for security investigation, or to comply with the law.

Data storage and protection

Google user data is stored in our Supabase Postgres database in the European Union, encrypted at rest, and transmitted only over TLS. We store only the fields listed above; we never receive or store your Google password, and OAuth tokens issued by Google are used once to complete sign-in and are not retained for later API access. Access to the database is restricted to the people operating the service and protected by row-level security so one account cannot read another's data.

Data retention and deletion

We keep your Google-derived account data for as long as your Rivulet account exists. You can delete your account at any time by emailing hello@getrivulet.io from the address on the account; we delete the account, its Google-derived profile data, your images and results within 30 days and confirm by email. You can also revoke Rivulet's access from your Google account permissions page; after that you can still sign in with an email code if you wish.

• To create your account, sign you in and keep your session secure.
• To run the workflows you build: store your images, process them step by step, store the results and show them to you.
• To bill you for your plan and enforce plan limits.
• To send you service emails such as sign-in codes, receipts and important changes to the service. We do not send marketing emails without your consent.
• To understand how the product is used, prioritise features and fix bugs, using aggregated and per-account usage data.
• To prevent abuse, protect the service and comply with legal obligations.

We do not sell your personal data and we do not use your images or content to train AI models.

• Contract: account, content, billing and service emails are needed to provide the service you signed up for.
• Legitimate interests: usage analytics, security monitoring and product improvement, balanced against your privacy.
• Consent: optional communications and any analytics cookies that are not strictly necessary.
• Legal obligation: keeping invoices and tax records.

We share data only with providers that help us run Rivulet, each bound by a data processing agreement and only for the purposes below.

• Supabase — authentication, database and real-time updates (account data, workflows, run logs).
• Amazon Web Services (Frankfurt, EU) — image storage and the serverless functions that process your images.
• Cloudflare — hosting and delivery of the website and web app.
• Stripe — payments and subscription management.
• PostHog (EU hosting) — product analytics and error tracking.
• Google and Microsoft — sign-in, when you choose those options.
• AI providers (OpenAI, Adobe Firefly, Google) — only when you add an AI step to a workflow; see the next section.
• Adobe — if you use Rivulet inside Adobe Express, Adobe processes your data under its own privacy policy.

Most steps (resize, crop, watermark, text overlay, background removal, licence-plate blurring) run entirely on our own infrastructure. If you add an AI generation or AI transform step, the image and the prompt for that step are sent to the AI provider you selected (OpenAI, Adobe Firefly or Google) to produce the result. They receive only the data needed for that request, process it under their API terms and do not receive your account details. Workflows without AI steps never send images to third parties.

Webhook and API upload steps send results to URLs that you enter. You control which data goes there and who receives it. Please make sure you have the right to send images and data to those destinations, as they are outside our control and covered by the recipient's own policies.

• Account data: for as long as your account exists.
• Images, results and run logs: until you delete them in the app, or until your account is deleted. Free plans may have shorter retention for results, as stated on the pricing page.
• Account deletion: email us at hello@getrivulet.io and we will delete your account, images and results within 30 days. Data in encrypted backups is overwritten on their normal rotation cycle.
• Billing records: kept as long as tax and accounting law requires.
• Analytics: identifiable usage events are retained by PostHog for at most 12 months.

All traffic is encrypted in transit with TLS and data is encrypted at rest by our storage providers. Every image is stored under a path scoped to your account, and it can only be read or written with short-lived signed links issued to your authenticated session. Access to production systems is limited to the people who operate the service. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and the relevant authority as required by law.

Your account data and images are stored in the European Union. Some providers, such as Stripe, Google, Microsoft and the AI providers, may process data in the United States or elsewhere. Where that happens we rely on the European Commission's Standard Contractual Clauses or an adequacy decision such as the EU-US Data Privacy Framework.

We use strictly necessary cookies and browser storage to keep you signed in and remember preferences such as your theme. These do not require consent.

We use PostHog to measure how the website and app are used, including page views, feature usage and errors. PostHog is hosted in the EU and we do not use advertising cookies or share analytics with ad networks.

If you visit from the European Union, the European Economic Area, the United Kingdom or Switzerland, analytics only runs with your consent: nothing is sent to PostHog until you choose “Accept” in the cookie banner, and choosing “Reject” is just as easy and does not affect the service. Elsewhere analytics is on by default, no banner is shown, and you can turn it off at any time (see below). We determine your region from your IP address through our hosting provider (Cloudflare) and keep only the two-letter country code, for one day, in a cookie named rvl_geo; when the region cannot be determined we ask for consent.

Your choice is stored for six months in a cookie named rvl_consent on getrivulet.io, so it applies to both this website and the app. You can change it at any time via “Cookie settings” in the footer of this website or under Profile → Privacy in the app. Turning analytics off stops collection and clears the analytics cookies.

Under the GDPR and similar laws you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• have your data deleted;
• receive a copy of your data in a portable format;
• object to or restrict processing based on legitimate interests;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with your local data protection authority.

To exercise any of these rights, email hello@getrivulet.io. We will respond within 30 days.

Rivulet is intended for professionals and businesses and is not directed at children under 16. We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.

We may update this policy as the product evolves. The date at the top shows the latest version. For significant changes we will notify you by email or with a notice in the app before they take effect.

Questions, requests or complaints about privacy: hello@getrivulet.io. We will answer as quickly as we can and within the legal deadlines.