Privacy Policy
Last updated 26 September 2026
The short version
- We collect what we need to run your account: who you are, how you sign in, what you pay for and how you use the dashboard.
- Data inside the apps and databases you deploy belongs to you. We process it on your behalf and don’t look at it without a reason.
- We don’t sell your data and we don’t show ads.
- Your apps and databases run in Mumbai. A few providers we rely on, such as GitHub, are based outside India.
Who we are
Riven Deploy (“Riven”, “we”, “us”) is a sole proprietorship run by Aakash Mistry in Maharashtra, India. Under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”), we are the Data Fiduciary for the personal data described in this policy. Our registration details are on the business details page.
What this policy covers
This policy covers personal data about you as a Riven user or visitor: your account, billing, support conversations, and your use of rivendeploy.com and the dashboard.
It does not cover data inside the applications and databases you deploy, including personal data about your own users. For that data, you are the Data Fiduciary and we act as your Data Processor, under our Data Processing Agreement.
What we collect
- Account details: your name, email address, and the profile name and photo from the sign-in method you choose (GitHub, Google, or email and password). If you sign up with email, we store your password only as a salted hash with argon2.
- Repository access: the GitHub repositories you grant access to, and the commit details needed to build and deploy them.
- Workspace data: workspace names, members, roles, invitations and audit log entries.
- Billing details: your plan, payment status, Razorpay transaction references, invoices, and any billing name, company or address you enter.
- Usage and technical data: IP address, browser and device type, sign-in times, deploy history, and resource use such as CPU, memory and bandwidth.
- Support messages: what you send us by email, Discord or WhatsApp, including your phone number if you contact us on WhatsApp.
What we don’t collect or do
- We never see your card number, UPI PIN or bank login. Razorpay handles payment details directly.
- We don’t read the contents of your apps or databases, except to give support you ask for, to keep the platform secure and stable (for example, stopping a service that is crashing repeatedly or being used for abuse), or when Indian law requires it.
- We don’t sell personal data, show ads, or share data with advertisers.
How we use your data
- To create your account, build and run your deploys, and show you logs and metrics.
- To bill you and issue invoices.
- To send service emails: failed or suspended deploys, billing, security alerts and changes to our policies. These are part of running your account, so you can’t opt out of them while the account is open.
- To detect and stop fraud, abuse and security threats.
- To answer support requests.
- To improve Riven, using usage data in aggregate.
- To meet legal obligations, such as keeping tax records.
Product updates and newsletters go only to people who opt in, and every one has an unsubscribe link.
We process your personal data with your consent, which you give when you create an account, and for the legitimate uses the DPDP Act allows, such as meeting legal obligations. You can withdraw consent at any time by deleting your account. Withdrawal doesn’t affect processing already done, and we keep the records the law requires us to keep.
Where your data is stored
The apps and databases you deploy run on AWS in Mumbai (ap-south-1) and stay in India. Account and billing records are stored with the providers listed above, in the locations shown.
Some providers, mainly for sign-in and email delivery, process data outside India. Any such transfer follows the DPDP Act, including any restrictions the Government of India places on transfers to particular countries.
How long we keep it
| Data | How long |
|---|---|
| Account and workspace data | While your account is open |
| Account data after you delete your account | Removed from active systems within 30 days |
| Database backups | Deleted automatically when your plan’s backup retention period ends |
| Invoices and payment records | 8 years, as Indian tax law requires |
| Build, runtime and access logs | Kept for a limited period for debugging and security, then deleted |
| Support conversations | As long as needed to help you, then up to 2 years |
If Riven ever shuts down, you get at least 60 days’ notice by email and your data stays available for export for that whole period, as set out in our Terms.
How we protect it
The Security page has the full picture, including what we don’t have yet. In short: all traffic uses HTTPS, environment variables are encrypted at rest, each workspace runs in its own isolated namespace, roles are enforced on every route, and important actions are recorded in audit logs.
Riven is run by one person on a single-server setup, and we don’t hold certifications such as SOC 2 or ISO 27001. We’d rather you know that now.
If something goes wrong
If we confirm a personal data breach that affects you, we will email you without undue delay and within 72 hours of becoming aware of it, explaining what happened, what data was involved and what we are doing about it. We will also report the breach to the Data Protection Board of India as the DPDP Act requires.
Your rights
Under the DPDP Act, you can ask us to:
- Give you a summary of the personal data we hold about you, how we use it, and who we have shared it with.
- Correct, complete or update your personal data.
- Delete your personal data, except records the law requires us to keep.
- Stop processing that depends on your consent, by withdrawing it.
- Act on the instructions of a person you nominate, if you die or can no longer act yourself.
Email [email protected] from the address on your account. We acknowledge requests within 48 hours and resolve them within 30 days. If you’re not satisfied with our response, you can complain to the Data Protection Board of India.
Age
You need to be 18 or older to create a Riven account. We don’t knowingly collect personal data from anyone under 18. If we learn that we have, we delete it.
Changes to this policy
When we make a material change, we email account holders at least 15 days before it takes effect. The date at the top of this page always shows when the policy last changed.
Contact and grievance officer
Aakash Mistry, Proprietor and Grievance Officer, Riven Deploy, Maharashtra, India.
- Privacy requests: [email protected]
- Everything else: [email protected]
- WhatsApp: +91 8669026894
- Discord: Riven community
We reply within 24 hours, Monday to Friday (IST). This policy is governed by the laws of India, and disputes follow the process in our Terms.