Privacy Policy

1. Introduction

Rivet Software (Pty) Ltd ("Rivet", "we", "us", or "our") operates the Rivet platform, a WhatsApp-first business automation solution for small and medium-sized businesses (SMBs) across Africa. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services.

By accessing or using Rivet, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of our services.

2. Information We Collect

2.1 Information You Provide

• Account registration details (name, email address, business name, phone number)
• Payment and billing information processed through our payment partners
• WhatsApp Business Account credentials and authorisation tokens obtained via Meta's Embedded Signup
• Business configuration data including automation flows, templates, and catalogue information
• Communications and support requests you send to us

2.2 Information Collected Automatically

• Usage data including pages visited, features used, and actions taken within the platform
• Device information including browser type, operating system, and IP address
• Log data including access times, error logs, and API request metadata
• Cookies and similar tracking technologies to maintain sessions and improve user experience

2.3 Information from Third Parties

• WhatsApp Business Account data obtained from Meta's Graph API upon your authorisation
• Customer data processed on your behalf through WhatsApp messaging (processed as a data processor)
• Integration data from connected platforms such as WooCommerce or Shopify

3. How We Use Your Information

We use the information we collect for the following purposes:

• Providing, maintaining, and improving the Rivet platform and its features
• Processing transactions and managing your subscription
• Sending operational communications including service updates, security alerts, and support responses
• Sending marketing communications where you have provided consent
• Analysing usage patterns to improve product functionality and user experience
• Complying with legal obligations and enforcing our Terms of Service
• Detecting, preventing, and addressing fraud, security incidents, and technical issues

4. WhatsApp and Meta Data

Rivet integrates with the WhatsApp Business Platform via Meta's official APIs. By connecting your WhatsApp Business Account to Rivet, you authorise us to:

• Access your WhatsApp Business Account ID (WABA ID) and associated phone number(s)
• Send and receive WhatsApp messages on your behalf as directed by your automation configurations
• Access message delivery and read receipts for operational purposes

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your information with:

• Service providers who assist in delivering our platform (hosting, payment processing, analytics) under data processing agreements
• Meta Platforms, Inc. as required to facilitate WhatsApp Business API services
• Legal authorities where required by applicable law, court order, or government regulation
• Successor entities in the event of a merger, acquisition, or sale of assets, with prior notice to you

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide our services. We retain certain data for longer periods where required by law or for legitimate business purposes such as resolving disputes or enforcing agreements.

Message logs and automation data are retained for a default period of 90 days unless you configure a longer retention period within the platform. Upon account termination, we will delete or anonymise your data within 30 days, subject to legal retention obligations.

7. Data Security

We implement industry-standard technical and organisational measures to protect your information, including:

• Encryption of access tokens and sensitive credentials at rest using AES-256
• TLS encryption for all data in transit
• Role-based access controls limiting employee access to customer data
• Regular security reviews and vulnerability assessments

No method of transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to protecting your information to the best of our ability.

8. Your Rights

Subject to applicable law, including the Protection of Personal Information Act (POPIA) of South Africa, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal information, subject to legal retention obligations
• Object to or restrict certain processing of your information
• Lodge a complaint with the Information Regulator of South Africa

9. Cookies

We use cookies and similar technologies to maintain your session, remember your preferences, and analyse platform usage. You may configure your browser to refuse cookies, but this may affect the functionality of the platform.

10. International Transfers

Rivet is incorporated in South Africa and primarily processes data within South Africa. As we expand operations across Africa, data may be transferred to and processed in other jurisdictions. We ensure appropriate safeguards are in place for any such transfers in accordance with POPIA and applicable local laws.

11. Children's Privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a prominent notice on the platform. Your continued use of Rivet after changes are posted constitutes acceptance of the updated policy.

13. Contact Us