Privacy Policy

Riviot LLC ("Riviot", "we", "us") is a Delaware limited liability company with a registered office at 16192 Coastal Hwy, Lewes, DE 19958, USA. We operate the Riviot Vio Vetting Platform (the "Platform"), a curated network for elite critical infrastructure professionals.

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the rights you have over it.

• Account details: name, email address, password (hashed), authentication metadata.
• Profile data you provide: location, time zone, LinkedIn URL, years of experience, availability, engagement preferences, rate expectations.
• Headshot, if you upload one (optional, with explicit consent before exposure to employers).
• Vetting evidence: certifications, vendor experience ratings, project records, written assessment answers, scenario response.
• Communications with Riviot reviewers and platform-generated audit events.
• Technical data: IP address, browser, device, session cookies necessary for authentication.

• Account details for organisation administrators and hiring managers.
• Organisation details: legal name, type, industry, headquarters, billing information processed by Stripe.
• Job postings, requirements, pipeline activity, internal notes.

If you sign in with Google, we receive your name, email, profile picture, and verified-email status from Google. We do not access any other Google data.

• Performance of a contract: to operate the platform you signed up for — vetting, matching, scoring, talent profiles, pipelines, billing.
• Legitimate interests: to maintain audit logs, prevent fraud, secure the platform, and improve the matching engine.
• Consent: to display your headshot to employers (you opt in explicitly), to send you marketing-style updates (you opt in), and to use cookies beyond strictly necessary.
• Legal obligation: to retain billing records for tax and accounting law.

• Vetted Riviot client organisations you have explicitly consented to be matched with. We never share your contact details until you authorise an introduction.
• Riviot reviewers (our internal team) who validate your assessment.
• Service providers acting under written instruction:
  • Vercel (US) — application hosting
  • Neon (EU/UK regions available) — managed PostgreSQL database
  • Vercel Blob (US) — file storage for headshots
  • Anthropic PBC (US) — AI scoring; we send pseudonymised assessment data and never your direct contact details
  • Stripe (US/IE) — payment processing for employer subscriptions and placement fees
  • Resend (US) — transactional email delivery
  • Google LLC (US) — optional SSO authentication
• Authorities when legally compelled, with notice to you where lawfully possible.

Where service providers are outside the EEA/UK, we rely on the EU Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum.

• Active candidate profiles: retained while your account is active. You may delete the account at any time.
• Inactive candidate profiles: deleted after 24 months of inactivity unless you request earlier deletion.
• Audit logs: retained for 7 years for compliance and dispute resolution.
• Billing records: retained for 7 years per US/EU tax regulations.
• Backups: rolling 30-day point-in-time backups via Neon; cleared on schedule.

Under UK and EU GDPR, you have the right to:

• Access a copy of the personal data we hold about you. Use the in-product export at Account → Download my data or email us.
• Rectify inaccurate data. Most fields are editable in your account.
• Erase your data. Use the in-product delete at Account → Delete my account. Some audit data is retained for legal compliance.
• Restrict processing in specific circumstances.
• Port your data to another provider in machine-readable JSON.
• Object to processing based on legitimate interests.
• Withdraw consent at any time, including the photo-display consent and visibility settings.
• Lodge a complaint with your local data protection authority (e.g. the Irish Data Protection Commission, the UK ICO).

[TODO before EU launch] Riviot LLC is established outside the EU and processes EU personal data. We will appoint an Article 27 EU representative before commencing material EU operations. The representative's name and contact details will be published here.

We use only strictly necessary cookies:

• riviot_session — your authentication session (httpOnly, SameSite=Lax)
• riviot_oauth_state — short-lived CSRF protection during Google sign-in
• riviot_oauth_intent — short-lived signup-intent flag during Google sign-in

We do not use advertising or third-party analytics cookies. If we add product analytics in future, you will see a consent banner.

The Platform is not directed at anyone under 18. We do not knowingly collect data from minors.

We will update this page when our practices change. Significant changes will be notified by email to active accounts at least 30 days before they take effect.

For privacy questions, requests, or complaints:

• Email: privacy@riviot.com
• Postal: Riviot LLC, 16192 Coastal Hwy, Lewes, DE 19958, USA