01The short version
In plain language
Your financial figures never reach us. Everything you enter into Rivu — your income, expenses, goals, timelines and plan — is stored in your own browser on your own computer. It is not transmitted to our servers, and we could not read it even if we wanted to.
What we do hold is minimal: your email address, your account login, and a payment reference from our gateway. We never ask for your PAN, your Aadhaar, your bank login, your broker credentials or your portfolio holdings.
This Privacy Policy explains what we collect, why, how long we keep it, and what rights you have. It applies to our website at rivu.in and the Rivu application at app.rivu.in. It is issued by Rivu ("we", "us", "our"), the data fiduciary for the purposes of India's Digital Personal Data Protection Act, 2023.
02What we collect
| What | Why we have it | Where it lives |
|---|---|---|
| Email address and any name you give us | To create your account, send your purchase receipt, deliver the free guide if you requested it, and provide support | ZeptoMail (email) and Supabase (authentication) |
| Account credentials | To let you sign in and access what you paid for | Supabase, passwords stored only in hashed form |
| Payment reference, amount, date and status | To confirm your purchase, issue receipts, handle refunds and meet tax and accounting obligations | Razorpay, plus our own records |
| Support correspondence | To answer your question and keep a record of what was resolved | ZeptoMail |
| Your goals, income, expenses, timelines and plan | To calculate and display your plan to you | Your browser only. Never transmitted to us |
03What we never collect
We want to be specific, because in this category the exceptions matter more than the rules:
- No PAN, Aadhaar or KYC documents. Rivu does not need your identity documents and does not ask for them.
- No bank, broker or demat credentials. Rivu never connects to your accounts, never asks you to log in to a financial institution, and has no account-aggregator integration.
- No card, UPI PIN or net-banking details. These are entered directly with our payment gateway and are never visible to us.
- No holdings or transaction history. We do not read, import or store what you actually own.
- No selling of data. We do not sell, rent or trade personal information to anyone, and we do not share it with fund houses, insurers, distributors, lead brokers or advertisers.
04How your plan data works
Rivu stores your plan in your browser's local storage. In practice this means:
- Your figures stay on the computer you entered them on.
- They are not backed up by us, not synced across your devices, and not visible to our team or to any third party.
- If you clear your browser data, use incognito mode, switch browsers or change computer, your plan will be gone. We cannot recover it, because we never had it.
We flag this trade-off plainly at purchase and again at first use. Export anything you want to keep.
05Cookies and similar technologies
We use only essential cookies and equivalent browser storage:
- Essential — to keep you signed in and to store your plan locally. The Service cannot function without these.
We do not currently run any analytics, advertising or tracking cookies. You can block or delete cookies through your browser settings, but blocking essential cookies will prevent Rivu from working, including saving your plan.
06Who we share information with
We share the limited data described above only with service providers who help us run the business, and only to the extent they need it:
Payments
Razorpay Software Private Limited — processes your payment and holds the payment instrument data we never see.
ZeptoMail (Zoho Corporation) — sends receipts, the free guide, and product emails.
Hosting
Netlify — serves the website and application.
Sign-in
Supabase — manages your account and login credentials.
We may also disclose information where we are legally required to — for example in response to a valid order from a court, regulator or law enforcement agency — or where necessary to establish, exercise or defend a legal claim.
Some of these providers may process data on servers outside India. Where that happens, we rely on the provider's contractual data protection commitments and transfer only what is necessary.
07How long we keep it
- Account and email data — for as long as your account is active, and for up to 24 months after you ask us to close it or after prolonged inactivity.
- Payment and invoice records — for the period required by Indian tax and accounting law, currently up to 8 years, regardless of account closure.
- Support correspondence — up to 24 months from the last message.
- Your plan data — held by your browser for as long as you keep it there. Deleting it is entirely within your control.
08Your rights
Under the Digital Personal Data Protection Act, 2023, you have the right to:
- Access — ask what personal data we hold about you and how it is being used.
- Correction — have inaccurate or incomplete data corrected or completed.
- Erasure — ask us to delete your personal data, subject to records we are legally obliged to retain.
- Withdraw consent — for example by unsubscribing from our emails, using the link in any email we send.
- Grievance redressal — raise a complaint with us, and escalate to the Data Protection Board of India if you are not satisfied with our response.
- Nominate — nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
To exercise any of these, write to support@rivu.in. We will respond within 30 days. We may ask you to verify your identity before acting on a request.
09Security
We use encryption in transit (HTTPS), access controls, and reputable infrastructure providers to protect the limited data we hold. Passwords are stored hashed, never in plain text.
The strongest security measure here is structural rather than technical: the most sensitive data — your actual financial figures — is never in our custody at all, so it cannot be exposed by a breach of our systems.
That said, no method of transmission or storage is completely secure. If a breach affecting your personal data occurs, we will notify you and the Data Protection Board of India as required by law.
10Children
Rivu is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
11Changes, and how to contact us
We may update this policy as the product or the law changes. The current version and its effective date are always at the top of this page; material changes will be notified by email or an on-site notice.
To raise a complaint about how we have handled your personal data, email support@rivu.in with "Grievance" in the subject line. We respond within 30 days. If our response does not resolve the matter, you may escalate to the Data Protection Board of India under the DPDP Act, 2023.