Privacy Policy

1. Overview

Ryva, Inc. ("Ryva," "we," "us," or "our") operates the Ryva platform ("Service"). This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using the Service, you agree to the practices described here.

We reserve the right to update this Privacy Policy at any time. When we make material changes, we will update the "Last updated" date above and, where required by law, notify you via email or an in-app notice at least 14 days before the changes take effect. Continued use of the Service after the effective date constitutes your acceptance of the revised policy.

2. Information We Collect

2.1 Information You Provide

• Account data: name, email address, password (hashed), profile photo.
• Workspace & project data: team name, projects, user stories, documents, PRDs, epics, and any content you create within the Service.
• Billing data: payment method details are collected and stored by our payment gateway; we store only a tokenized reference.
• Communications: messages you send us via email or support channels.

2.2 Information Collected Automatically

• Usage data: pages visited, features used, click events, and interaction logs.
• Device & log data: IP address, browser type, operating system, referring URLs, and timestamps.
• Cookies & similar technologies: session cookies for authentication, preference cookies, and analytics identifiers. You can control cookies via your browser settings.

2.3 Information from Third Parties

• Slack integration: webhook configuration and notification preferences — only when you explicitly configure Slack notifications.

3. How We Use Your Information

• To provide, operate, and improve the Service.
• To authenticate you and manage your account.
• To process payments and manage subscriptions.
• To power AI features (user story generation, PRD drafting, etc.) using your content strictly within the scope of delivering the Service to you.
• To send transactional emails (account notifications, billing receipts).
• To send product updates and marketing communications (you may opt out at any time).
• To monitor for abuse, security threats, and compliance with our Terms of Service.
• To analyze aggregated, anonymized usage trends to improve the product.

We do not sell your personal data. Information about how content is handled by AI providers is published only when it has been verified against the active service configuration and provider terms.

4. Data Sharing & Disclosure

We may share your information with:

• Service providers: Firebase (cloud infrastructure & database), our payment gateway, and analytics providers — all bound by data processing agreements.
• AI model providers: to generate AI outputs on your behalf, subject to their data-handling commitments.
• Legal authorities: when required by law, court order, or to protect the rights and safety of Ryva, Inc. or others.
• Business transfers: in connection with a merger, acquisition, or sale of assets; you will be notified via email prior to any such transfer.

We do not share your data with advertisers or data brokers.

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. After account deletion, we will delete or anonymize your personal data within 90 days, except where longer retention is required by applicable law or for legitimate business purposes (e.g., fraud prevention, dispute resolution).

6. Security

We implement industry-standard technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. For details, see our Security Policy. However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security and disclaim all liability for breaches beyond our reasonable control.

7. Your Rights & Choices

Depending on your location, you may have the right to:

• Access: request a copy of the personal data we hold about you.
• Correction: update inaccurate or incomplete data via your account settings or by contacting us.
• Deletion: request deletion of your account and associated personal data.
• Portability: request your data in a machine-readable format.
• Opt-out: unsubscribe from marketing emails via the link in any email or by contacting us.
• Restriction / Objection: restrict or object to certain processing activities under applicable law (e.g., GDPR).

To exercise any of these rights, email us at hello@ryva.io. We will respond within 30 days.

8. International Transfers

Ryva, Inc. is based in the United States. If you are accessing the Service from outside the US, your data may be transferred to and processed in the US or other countries. We take steps to ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses for EU users).

9. Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, contact us at hello@ryva.io and we will promptly delete it.

10. Limitation of Liability

To the fullest extent permitted by applicable law, Ryva, Inc. shall not be liable for any indirect, incidental, special, or consequential damages arising from unauthorized access to or disclosure of your data. Our total liability for any privacy-related claims is limited as set out in our Terms of Service.

11. Contact

For privacy questions or requests, contact our privacy team at: hello@ryva.io
Ryva, Inc., United States.