Privacy Policy

Virtukart Technology Pvt Limited ("Virtukart", "we", "us", or "our"), with its registered office at 1st Floor, HQ Dwara Pride, Madhapur, Hyderabad, India, operates the Instagram automation platform branded as Rivako(the "Service").

Rivako is available through our website at rivako.app and our web application at my.rivako.app (together, the "Platform").

This Privacy Policy explains how we collect, use, store, disclose, and safeguard personal data when you access or use Rivako. By using the Platform, you agree to the practices described here. If you do not agree, please do not use the Service or create an account.

This Policy is designed to comply with applicable Indian law, including the Information Technology Act, 2000 and related rules, and the Digital Personal Data Protection Act, 2023 ("DPDP Act"), where applicable.

This Privacy Policy applies to personal data we process relating to:

• Users of Rivako (creators, businesses, and agencies)
• End users who interact with automations you configure through Rivako
• Visitors to our marketing website
• Newsletter subscribers and prospective customers
• Support contacts and business partners

When Rivako processes Instagram messages, comments, contacts, or leads on your behalf, we act as a data processor and you act as the data controller. You are responsible for having a lawful basis to collect and process data about your audience, including compliance with Meta's Platform Terms and Instagram's policies.

a. Information you provide directly

• Account registration details (name, email, phone number, business name)
• Connected Instagram and other social accounts you authorize
• Automation configuration, message templates, and content you create
• Support requests, emails, chats, and feedback
• Forms submitted on our website or within the app

b. Information collected automatically

• Device and browser information (operating system, browser type, language)
• IP address, log data, and usage activity within the Platform
• Feature interaction data and session metadata
• Cookies and similar tracking technologies (see our Cookie Statement when published)

c. Information from third parties

• Payment confirmation from payment gateways (e.g., Razorpay). We do not store full card details.
• Social platform data from integrations you explicitly connect (e.g., Instagram via Meta APIs)
• Analytics and infrastructure service providers

• Account information: name, email, profile details, linked social accounts
• Payment information: transaction ID, payment status, billing references
• Communication data: support tickets, emails, and in-app messages with us
• Usage and technical data: logs, IP address, device identifiers, app activity
• Customer content: comments, DMs, contacts, leads, and responses processed through your automations
• Marketing data: newsletter preferences and campaign engagement, where applicable

Please do not upload sensitive personal data (such as Aadhaar numbers, health information, biometric data, or religious or political information) through Rivako.

Rivako connects to Instagram using Meta's official APIs. When you authorize a connection, we may receive data permitted by your OAuth scopes, such as account identifiers, profile information, comments, and direct messages needed to operate automations you configure.

Rivako's use and transfer of information received from Meta APIs adheres to Meta Platform Terms and Policies. We do not use Meta-sourced data for unrelated advertising purposes.

You can disconnect your Instagram account at any time from within Rivako. Revoking access may limit or stop automations that depend on that connection.

We use personal data for the following purposes:

• To create, authenticate, and manage user accounts
• To provide and operate Rivako features (comment replies, DMs, follow-ups, shop, forms, inbox)
• To process subscriptions and payments
• To communicate service updates, security notices, and support responses
• To improve platform performance, reliability, and security
• To comply with legal and regulatory obligations
• To prevent fraud, abuse, or unauthorized activity
• To send marketing communications where permitted by law (you may opt out anytime)

We do not sell your personal data. We may share data with affiliates and service providers only as described in this Policy and where required by law.

We may share personal data in the following circumstances:

a. Service providers

Third-party vendors who help us operate Rivako, including cloud hosting, payment processing, analytics, email delivery, and customer support tools. These providers are bound by confidentiality and data protection obligations.

b. Platform integrations

Data may be exchanged with services you explicitly connect, such as Instagram (Meta), payment gateways, and other authorized integrations.

c. Legal and compliance

When required by law, court order, or government authority, or to protect our rights, users, or the public.

d. Business transfers

In connection with a merger, acquisition, restructuring, or sale of assets, personal data may be transferred as part of the transaction.

Depending on applicable law, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete information
• Request deletion of your data
• Withdraw consent where processing is consent-based
• Object to certain processing activities
• Request data portability, where feasible
• Lodge a complaint with a supervisory authority

To exercise your rights, contact us at privacy@virtukart.com or support@virtukart.com. We may verify your identity before fulfilling a request.

End users of our customers: If your data was collected through an automation created by a Rivako user, please contact that user directly. They control how your data is used in their workflows.

We process personal data in accordance with the DPDP Act, 2023 and other applicable Indian privacy and data protection laws. Where we act as a data processor on your behalf, we process data according to your instructions and our agreement with you.

We retain personal data:

• While your account is active and as needed to provide the Service
• As required by applicable laws, tax, or accounting obligations
• As necessary to resolve disputes or enforce our agreements

After account closure, we delete or anonymize data within a reasonable period (typically up to 180 days), unless a longer retention period is required by law. Deletion requests are processed within 7 to 30 business days where applicable.

Your data may be stored or processed in India or in other countries where we or our service providers operate. By using Rivako, you consent to such transfers subject to applicable law. We take reasonable steps to ensure appropriate safeguards are in place.

Rivako is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors.

If we learn that we have collected personal data from a user under 18 without appropriate consent, we will delete it promptly. Please contact privacy@virtukart.com if you believe we hold such information.

We implement reasonable technical and organizational measures to protect personal data, including encrypted communication, access controls, and secure cloud infrastructure.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, but we work to reduce risk and investigate suspected incidents promptly.

If a data breach occurs that materially affects users, we will notify impacted users and authorities as required by applicable law.

For visitors and customers in the EEA or UK, we process personal data based on:

• Performance of a contract with you
• Legitimate business interests (such as improving and securing the Service)
• Compliance with legal obligations
• Your consent, where required

California residents may have rights under the CCPA/CPRA, including the right to know what personal information is collected, request deletion, and not be discriminated against for exercising privacy rights. Submit requests to privacy@virtukart.com.

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated "Last updated" date and, where appropriate, notified via the app or email. Continued use of Rivako after changes take effect constitutes acceptance of the updated Policy.

For privacy-related questions, requests, or complaints:

• Company: Virtukart Technology Pvt Limited
• Product: Rivako
• Address: 1st Floor, HQ Dwara Pride, Madhapur, Hyderabad, India
• Privacy: privacy@virtukart.com
• Support: support@virtukart.com
• Website: rivako.app