Privacy Policy

1. Who we are

Rivlo is operated by Rivlo Financial Inc. (the "Company", "we", "us"), based in Ontario, Canada. Our service is for people in Canada and the United States.

This policy covers the Rivlo app and our website, rivlofinancial.com, including its early-access waitlist and rough money check-up.

2. Who is responsible for your privacy

We have a Privacy Officer, who is responsible for how we protect your personal information and for our compliance with this policy and with Canadian privacy law.

You can reach the Privacy Officer at info@rivlofinancial.com with any question, complaint, or request about your personal information.

3. What we collect

We collect only what we need to provide the service:

• Account information: email address, display name (optional), authentication identifiers from Apple Sign-In or Google Sign-In if you use those providers.
• Financial data from banks you connect through Flinks (see "Connecting your bank through Flinks" below): for each account you choose, its name, type and balances, and up to 365 days of its transactions, depending on your bank.
• Financial data from statements you import: account names, balances, and transactions from statement files (CSV) you choose to import.
• Receipts you add, if you turn on receipt reading: the file as you chose it, and what Rivlo reads from it: the store, date, total and items. Pharmacy and health item names are stored as "Health item".
• Accounts and transactions you add by hand, such as cash: what you type.
• App usage and error reports: which screens you open, which features you use, and reports when something goes wrong. These are linked to a random identifier, not to your name or email. We do not include financial amounts, balances, merchant names, or transaction descriptions in any analytics event or error report (see "Analytics and error reports" below).
• Device information: OS version, app version, device type — used only for compatibility and debugging.

4. What we do NOT collect

• Your bank login credentials. You sign in through your bank or through Flinks, never on a Rivlo screen, and we never see them.
• Your full bank account numbers or the account holder’s contact details. Flinks sends these with your account details; we keep only the last 4 digits of each account number, to tell your accounts apart, and discard the rest.
• Your Social Insurance Number, date of birth, government IDs, or any other identifier not required to provide the service.
• Your device's location.
• Contacts, calendar, microphone, camera, photos — unless you specifically grant the permission for a feature (e.g., adding a profile photo or scanning a receipt).

5. How we use your information

• To provide and operate the service (connect your accounts, categorize transactions, compute your dashboard, generate insights, read receipts you add).
• To communicate with you about service-related matters (account, security, important updates).
• To improve the product, using the usage and error information described below.

We do not: use your data for advertising; sell your data to anyone, for any purpose, ever; or share your data with marketers, data brokers, or affiliated companies.

6. Connecting your bank through Flinks

Connecting a bank is optional. Importing statement files works without any connection.

Who provides the connection. Flinks Inc. ("Flinks") provides bank connections for us. Before you sign in, Flinks shows its own consent screen, and the Flinks Services Privacy Statement covers what Flinks itself does with your information.

Your agreement first. Before anything is shared, we show you what we will receive and ask you to agree.

Signing in. Where your bank offers it, you use your bank's own secure sign-in. Otherwise you sign in on Flinks' screen with your online-banking login; some banks' agreements ask customers not to share their login, so check yours if you're unsure. In that case Flinks stores your login securely so it can update your accounts when you ask, and never shares it with us. We never see your bank password.

Which accounts. Flinks shows us every account you hold under that login, and you pick which ones to bring in. You can add or remove accounts later.

What we receive and keep. For each account you pick, we receive and keep its name, type and balances (available, current and, where your bank provides one, the limit), and its transactions: up to 365 days, depending on your bank (some give about 90). Flinks also sends the account holder's name, address, email and phone number, and full account, transit and institution numbers. We keep only the last 4 digits of each account number and discard the rest.

Updating. You can update your accounts when you ask. Your bank may ask for its usual verification code when you do.

Disconnecting. You can disconnect a bank at any time. We ask whether you want to keep the history we already have or delete it. Either way, we ask Flinks to delete the connection and the data it holds for it. You can also contact Flinks directly at privacy@flinks.com.

7. Smart categories: AI provider and web search

Smart categories sorts your transactions into categories for you. During setup we ask whether you want it on or off; nothing is chosen for you. You can change your choice at any time in Settings.

What is sent. Rivlo first sorts what it can on its own, using our list of known businesses, your bank's transaction codes and the choices and rules you have made. For a transaction it still can't place, Smart categories sends the business name from your statement to an AI service, with the account type (for example, chequing or credit card) and whether money came in or went out.

For a purchase whose business is still unknown, Smart categories may also look the business up on the web. The lookup sends the same details, plus the city or town printed on your statement, but only when it is a known place name: one on our list of Canadian cities, towns and other populated places, cities elsewhere with 15,000 or more people, and a few resort areas. Text that is not a known place name is not sent.

What is never sent: amounts, balances, dates, account numbers, your name or email, or the full description from your statement. E-Transfers and other payments we recognize as going to or from a person are never sent. Requests carry no identifier of you or your account.

Who processes it, and where. Two companies process these requests for us, and may do so outside Canada:

• OpenAI sorts business names into categories. We send these requests with OpenAI's option to store them turned off.
• Google runs the web lookups, using its Gemini AI model with Google Search. We use Google's paid API service for them.

Under their terms for business customers, neither company uses these requests to train its AI models, and each keeps them only for a limited time, for example to detect abuse.

What we keep. The answers that come back, such as a business's category and, for a looked-up business, its type and website, are saved so a business doesn't have to be sent each time it appears. Saved answers hold nothing about you: they are stored by business name, account type and place, are not linked to your account, and are shared by everyone who uses Rivlo. Each one expires after at most a year, or sooner when nothing was found: after 30 days, then 90, then 180 for a business that is still not found. After it expires, the business may be sent again, and the answer is deleted within 30 days. We may also send a business again when we improve how Smart categories sorts.

Because saved answers are not your data, deleting your account or clearing your data does not remove them. Deleting your account removes your Smart categories consent with the rest of your data; clearing your data resets it, so we ask again before anything more is sent.

Turning it off. You can turn Smart categories off at any time in Settings. Sending stops within a minute, and nothing more is sent until you turn it back on. Categories already placed stay as they are, and transactions we can't place are left for you to sort.

If we change who processes these requests or what is sent, we will tell you in the app and ask again before anything more is sent.

Our list of known places is adapted from GeoNames (geonames.org) data, used under the Creative Commons Attribution 4.0 licence (CC BY 4.0).

8. Receipt reading: AI provider

Receipt reading is optional and off until you turn it on. When it is on, Rivlo reads the receipts you add (a photo, a scan or a PDF), looks for the charge each one belongs to, and can split that charge by what you bought.

When you add a receipt, Rivlo sends that file to Anthropic, which reads it for us.

Only the receipt is sent. Your bank data, your name and your account names never are.

The file as you chose it is stored privately in Canada until you delete it.

Pharmacy and health items keep their amounts, but their names are stored as "Health item".

Anthropic may process receipts outside Canada.

You can turn reading off, or delete every receipt, in Settings.

Entries you type by hand, such as cash purchases, are never sent to an AI service. Only a receipt you add for reading is, as described above.

9. How Rivlo works out your numbers

Rivlo's own software sorts the transactions it recognizes, finds recurring bills and pay, pairs transfers between your accounts, and calculates your plan, check-up and suggestions. None of this uses an outside AI service. There are two exceptions, both optional and described above: Smart categories sends business names to OpenAI, and sometimes to Google for a web lookup, and receipt reading sends a receipt you add to Anthropic. Each runs only if you've seen what it shares and chosen to turn it on.

10. Analytics and error reports

In the app, we plan to use usage analytics (which screens and features are used) and error reports (what went wrong and where) to improve it and fix problems. We have not chosen the app's providers yet. Before we turn either on, we will name the provider and where it processes your information in this policy, and tell you in the app. How our website counts visits is described in "Our website, waitlist and check-up".

Whichever app providers we choose, each event will be linked to a random identifier, not to your name or email, and before anything leaves your device we will remove amounts and balances, merchant names and transaction descriptions, and email addresses.

11. Where your data is stored and processed

Your data is stored in Canada, in the ca-central-1 region of our cloud provider (Supabase, which runs on AWS), and our servers process it there.

Some information is processed outside Canada: the details that Smart categories sends to OpenAI and Google (see the Smart categories section above), the receipts you choose to have read, which Anthropic may process outside Canada (see "Receipt reading" above), and, for US users, bank-connection data, which Flinks keeps in the United States. Flinks keeps Canadian users' bank-connection data in Canada. Our website's visit counts (Cloudflare Web Analytics, described in "Our website, waitlist and check-up") may also be processed outside Canada. If the app's analytics or error-report providers process information outside Canada, we will say so here before we turn them on.

Emails we send you (sign-in, password reset and waitlist emails) are delivered by Resend, in the United States. It receives your email address and the message, and for the waitlist your first name if you gave one.

If you live in the United States, the information we keep about you is stored and processed in Canada, and Canadian law applies to it.

Our website is served by Cloudflare from the location nearest you. What you type into the waitlist form passes through Cloudflare on its way to our servers in Canada.

12. How long we keep your data

• Active accounts: as long as you have an account with us.
• Deleted accounts: all of your personal information is removed from our active systems within 30 days. Backups expire on a rolling 30-day window thereafter.
• Bank connections: when you disconnect a bank or delete your account, we ask Flinks to delete the connection. If you choose to delete a bank's history when you disconnect it, we delete it within 30 days.
• Receipts: until you delete them or your account. Deleting a receipt, or every receipt, removes the file and what Rivlo read from it.
• Usage and error information: only as long as we need it to improve and fix the app.
• Demo mode: demo data lives only on your device. Closing the app or quitting demo mode discards everything.

13. How we protect your data

• Encryption in transit (TLS 1.2+) and at rest (AES-256, provider-managed).
• Row-level security policies ensure your data is only accessible to your account.
• An app lock with Face ID or Touch ID, on by default where your device supports it. You can turn it off in Settings.
• Access to production systems is limited to founders and protected by 2FA.
• A security review of each significant new feature that handles your data, before it launches.

14. Your rights

Wherever you live, you have the right to:

• Access the personal information we hold about you.
• Correct any inaccurate or incomplete information.
• Delete your account and all associated personal information. The app provides a self-serve delete option in Settings.
• Export your financial data — accounts, transactions, goals, and your money plan — as a portable JSON file from Settings, or ask us to send your information, in a structured format, to another organization you name.
• Withdraw consent for a feature: turn off Smart categories or receipt reading, delete your receipts, or disconnect a bank at any time. You can also withdraw your consent altogether by deleting your account.

To exercise any of these rights, email info@rivlofinancial.com. We answer within 30 days.

If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, if you live in Québec, to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

15. Our website, waitlist and check-up

Our website does not connect to your bank and does not collect financial account data, balances or transactions. If you join the early-access waitlist:

• We collect your email address, your first name if you choose to give it, and which button on our website you used to sign up.
• We email you when your spot opens and, now and then, about what's new. Every email lets you unsubscribe.
• To prevent abuse of the signup form, we store a salted, irreversible hash of your IP address. We never store the IP address itself, and the hash is used only to rate-limit and protect the form.

Our rough money check-up works out its answer in your browser. The figures you type never leave your device.

To see how our website is used, we count visits with Cloudflare Web Analytics. It records which page was viewed, the site that linked to it, the visitor's country, device and browser type, and how fast the page loaded. It uses no cookies or other storage in your browser and doesn't identify you, and Cloudflare discards your IP address instead of storing it. Cloudflare may process this information outside Canada.

Our website doesn't track you across other sites, uses no advertising cookies, and doesn't let others track you through it. Because there is no cross-site tracking to turn off, browser "Do Not Track" signals don't change how the site works.

Waitlist information is stored with Supabase in Canada. Our website is hosted by Cloudflare, our emails are delivered by Resend, and a small number of other service providers process data on our behalf under appropriate agreements.

We keep waitlist information until you ask us to remove it or until the early-access program ends, after which it is deleted. Deleting a Rivlo account also removes a waitlist signup made with the same email address.

16. Children

Our service is not directed to anyone under 18. We do not knowingly collect personal information from minors. If you become aware that a minor has provided us with personal information, contact us and we will delete it.

17. Changes to this policy

Rivlo has not launched yet, and this policy may change before it does as we finish building the service and complete our legal review.

We will post any changes to this policy on our website and email registered users about material changes before they take effect.

18. Contact

For any privacy question or to exercise your rights:

Privacy Officer · info@rivlofinancial.com · Rivlo Financial Inc.