Data Processing Addendum

These data processing terms (the “DPA”) are between Naveiyra Holdings, Inc. dba Rivyt, a Delaware corporation (“Rivyt”), and each customer that uses the Rivyt service (“Customer”). They apply to every Customer that has not signed a separate data processing agreement with Rivyt, as part of our Terms of Service (Section 18). A Customer that needs a signed DPA, or terms for personal data subject to the EU or UK GDPR, can ask at privacy@getrivyt.com.

1. Scope and precedence

1.1 This DPA forms part of the agreement between Rivyt and Customer for the Service (the “Agreement”): the Terms of Service, or a signed Customer Agreement that refers to it.

1.2 Nothing in the Agreement that permits any use of data overrides a restriction in this DPA. A signed data processing agreement between Rivyt and Customer takes precedence over this DPA.

2. Definitions

2.1 “Applicable Data Protection Law” means every law that applies to the processing of Customer Personal Data under the Agreement, including the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its regulations (the “CCPA”); the other US state comprehensive consumer privacy laws (“US State Privacy Laws”); and US state data security and breach notification laws.

2.2 “Customer Personal Data” means personal data, personal information or equivalent terms as defined in Applicable Data Protection Law, that Rivyt processes on Customer’s behalf in providing the Service. It includes personal data inside Customer Content.

2.3 “Customer Content” means documents, files, text, audio and other material that Customer or its Authorized Users upload to, sync into, or create in the Service, and everything derived from them (extracted text, passages, embeddings, index entries, knowledge graph facts, answers and question history).

2.4 “Authorized User” means an employee or contractor of Customer whom Customer invites to use the Service.

2.5 “Service” means the Rivyt web application at app.getrivyt.com and the Fox phone and voice interface.

2.6 “Subprocessor” means a third party that Rivyt engages to process Customer Personal Data on its behalf. Customer’s own providers (clause 12.5) are not Subprocessors.

2.7 “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data processed by Rivyt or a Subprocessor. It does not include unsuccessful attempts that do not compromise Customer Personal Data, such as blocked sign-in attempts, port scans or denial of service attacks that do not reach data.

2.8 “Business”, “service provider”, “contractor”, “consumer”, “sell”, “share”, “business purpose” and “sensitive personal information” have the meanings given in the CCPA. “Controller”, “processor” and “personal data” have the meanings given in US State Privacy Laws.

3. Roles

3.1 For Customer Personal Data, Customer is the business (CCPA) and the controller (US State Privacy Laws), and Rivyt is Customer’s service provider and processor. To the extent Rivyt is instead a contractor under the CCPA for any part of the processing, every obligation in this DPA that applies to a service provider applies to Rivyt as a contractor.

3.2 If Customer processes some Customer Personal Data as a processor for another controller (for example, a parent company), Customer warrants that its instructions to Rivyt are authorized by that controller.

3.3 Rivyt is a separate business only for the limited account and business contact data it needs to run its own operations (billing, contract administration, security of its own systems, and legal compliance). Rivyt handles that data under its Privacy Policy and never uses it to sell, share or advertise.

4. Instructions and the specified business purposes

4.1 Documented instructions. Rivyt processes Customer Personal Data only on Customer’s documented instructions. The Agreement, this DPA, and Customer’s configuration of the Service (for example, which workspaces exist, who belongs to them, whether voice is enabled, and which Google Drive files are connected) are Customer’s complete instructions.

4.2 Business Purposes. Customer discloses Customer Personal Data to Rivyt only for the following limited and specified business purposes, and Rivyt processes it only for them:

(a) Account and access: creating and administering Authorized User accounts, authenticating them (including multi-factor authentication), and enforcing Customer’s workspace membership and permissions;
(b) Document indexing: receiving Customer’s documents by upload or from Customer’s connected Google Drive, converting them to text, splitting them into passages, creating embeddings, and storing the passages and embeddings in a search index;
(c) Knowledge extraction: using an AI extraction step to build Customer’s knowledge graph (“Rivyt Mind”) of equipment, parts, sites, procedures and similar facts, each tied to the sentence it came from;
(d) Answering questions: receiving an Authorized User’s typed or spoken question, retrieving matching passages, sending the question, those passages and earlier turns of the conversation to an AI model to write an answer with citations, and returning the answer;
(e) Question history: storing each question and answer so that the Authorized User, and Customer’s admins for workspaces they belong to, can review them;
(f) Profile tailoring: using an Authorized User’s profile to tailor answers and suggested questions, where the per-person setting is on;
(g) Voice features, where an Authorized User turns them on: converting recorded speech to text and answer text to speech, without storing audio and without creating a voiceprint;
(h) Knowledge interviews: transcribing an Authorized User’s recorded account of their experience and turning it into claims attributed to their account and role, for review by Customer’s admins;
(i) Decision briefs: assembling comparisons of options from cited sources as decision support, without recommending or choosing;
(j) Inspections, where Customer uses them: recording, wording and sharing the inspections Customer carries out;
(k) Service communications: sending sign-in, invitation, verification and security emails to Authorized Users;
(l) Support: investigating and resolving an issue that Customer or an Authorized User reports;
(m) Security and integrity: detecting, preventing and investigating Security Incidents, abuse, and malicious, deceptive, fraudulent or illegal activity affecting the Service; and
(n) Legal compliance: complying with law, subject to clause 4.4.

4.3 Unlawful instructions. Rivyt will tell Customer promptly if, in its opinion, an instruction infringes Applicable Data Protection Law, and may suspend the affected processing until Customer confirms or changes the instruction.

4.4 Legally required disclosures. If law requires Rivyt to disclose Customer Personal Data to a government authority, Rivyt will (unless the law forbids it) notify Customer promptly so that Customer can seek a protective order, disclose only what is legally required, and first try to redirect the authority to Customer.

5. CCPA service provider and contractor terms

These terms apply whether or not either party is currently above the CCPA thresholds.

5.1 No selling or sharing. Rivyt will not sell or share Customer Personal Data.

5.2 Business Purposes only. Rivyt will not retain, use or disclose Customer Personal Data for any purpose other than the Business Purposes in clause 4.2, or as otherwise permitted by the CCPA and its regulations, including for any commercial purpose other than the Business Purposes.

5.3 Direct business relationship only. Rivyt will not retain, use or disclose Customer Personal Data outside the direct business relationship between Rivyt and Customer.

5.4 No combining. Rivyt will not combine Customer Personal Data with personal information it receives from or on behalf of any other person, except where the CCPA regulations expressly permit it to perform a Business Purpose. The Service keeps each customer’s data in its own organization and workspace scope, and never uses one customer’s documents, knowledge graph or question history to answer another customer’s questions.

5.5 No model training. Rivyt will not use Customer Personal Data or Customer Content to train, fine-tune or evaluate any AI model, its own or anyone else’s. Rivyt uses Customer Personal Data internally only to produce aggregated, de-identified operational measurements (such as latency, error rates and usage counts) that contain no Customer Content.

5.6 Same level of protection. Rivyt will comply with every provision of the CCPA and its regulations that applies to it as a service provider or contractor, and will provide Customer Personal Data the same level of privacy protection that the CCPA requires of businesses, including by cooperating with Customer in responding to consumer requests (clause 10) and implementing reasonable security procedures and practices (clause 8).

5.7 Reasonable steps. Customer may take reasonable and appropriate steps to ensure that Rivyt uses Customer Personal Data consistently with Customer’s obligations under the CCPA, including the information requests in clause 11.

5.8 Notice if Rivyt cannot comply. Rivyt will notify Customer in writing promptly after it determines that it can no longer meet its obligations under the CCPA, its regulations or this DPA.

5.9 Stop and remediate. On notice, Customer may take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data, including directing Rivyt to suspend the processing concerned or to delete the affected data.

5.10 Certification. Rivyt certifies that it understands the restrictions in clauses 5.1 to 5.5 and will comply with them.

5.11 Consumer requests sent to Rivyt. If a consumer sends a request directly to Rivyt about Customer Personal Data, Rivyt will forward it to Customer and either act on Customer’s instructions or tell the consumer that the request has been passed to Customer.

6. US State Privacy Law processor terms

6.1 The nature and purpose of processing, the types of personal data, the categories of data subjects and the duration of processing are set out in clauses 4 and 17.

6.2 Rivyt will adhere to Customer’s instructions and will assist Customer in meeting its obligations under US State Privacy Laws, taking into account the nature of the processing and the information available to Rivyt, including on consumer rights requests (clause 10), on the security of processing and breach notification (clauses 8 and 9), and on data protection assessments (clause 11).

6.3 Rivyt will ensure that each person processing Customer Personal Data is subject to a duty of confidentiality with respect to it (clause 7).

6.4 At Customer’s direction, Rivyt will delete or return all Customer Personal Data at the end of the provision of the Service, unless law requires retention (clause 14).

6.5 On Customer’s reasonable request, Rivyt will make available the information in its possession necessary to demonstrate its compliance with its obligations under US State Privacy Laws and this DPA, and will cooperate with reasonable assessments by Customer or Customer’s designated assessor (clause 11).

6.6 Rivyt will engage a Subprocessor only after giving Customer notice and an opportunity to object, and only under a written contract requiring the Subprocessor to meet Rivyt’s obligations for the personal data (clause 12).

7. Personnel confidentiality and access

7.1 Rivyt will ensure that every person at Rivyt with access to Customer Personal Data is bound by a written confidentiality obligation, or an appropriate statutory obligation, that continues after their engagement ends, and will limit access to personnel who need it to perform the Business Purposes.

7.2 Rivyt staff access to Customer Content. Rivyt personnel may read Customer Content only (a) at Customer’s or an Authorized User’s request for support, (b) to investigate a Security Incident or abuse, or (c) where law requires it, and only with a stated reason.

8. Security

8.1 Rivyt will implement and maintain reasonable security procedures and practices appropriate to the nature of Customer Personal Data, to protect it from unauthorized or illegal access, destruction, use, modification or disclosure, including the measures described on our security page.

8.2 Rivyt may update its security measures, but will not materially reduce the overall level of protection for Customer Personal Data during the term.

8.3 Customer is responsible for configuring the Service appropriately, including managing who is invited, who is an admin, workspace membership, which Google Drive files are connected, and whether voice is enabled; for keeping Authorized Users’ credentials and second factors secure; and for promptly removing people who leave.

9. Security Incidents

9.1 Notice to Customer. Rivyt will notify Customer of a Security Incident (a) without undue delay after Rivyt discovers it, with a preliminary notice containing what Rivyt then knows; and (b) in any event no later than 72 hours after Rivyt confirms that a Security Incident has occurred.

9.2 Content of the notice. So far as known: the nature of the Security Incident and when it occurred and was discovered; the categories and approximate number of data subjects and records concerned, and the workspaces and systems affected; the categories of Customer Personal Data concerned; the likely consequences; the measures Rivyt has taken or proposes; any Subprocessor involved; and a contact at Rivyt. Where information is not yet available, Rivyt will provide it in phases, without further undue delay.

9.3 Cooperation. Rivyt will cooperate with Customer’s investigation, provide information Customer reasonably needs to meet its own notification obligations, and preserve relevant logs and evidence.

9.4 Customer controls notification. Customer decides whether and how to notify affected individuals, regulators and the public. Rivyt will not notify them about Customer Personal Data without Customer’s prior written approval, unless law requires it.

9.5 A notice under this clause is not an admission of fault or liability.

10. Assistance with rights requests

10.1 Tools in the Service. Customer’s admins can remove a person (which deletes their account, profile and sign-in and, at Customer’s choice, their questions and answers), correct profile data, review a person’s question history, delete documents and workspaces, and export the workspaces they belong to.

10.2 Further assistance. Where Customer cannot fulfil a request with those tools, Rivyt will, on Customer’s written instruction, help Customer respond to requests to know or access, delete, correct, port, opt out or limit, and appeal, in time for Customer to meet its statutory deadline.

10.3 Documents stay with Customer. Deleting a person does not delete Customer’s documents. If a request concerns a person named inside a document, Customer decides whether to edit or delete the document.

11. Assessments and information

11.1 Rivyt will give Customer the information Customer reasonably needs to conduct and document a data protection assessment, risk assessment or cybersecurity audit under Applicable Data Protection Law that covers the Service, including the details of processing in clause 17, the subprocessor list, a description of the AI processing, and the voice and knowledge interview flows.

11.2 Once every 12 months, and additionally after a Security Incident, Customer may send Rivyt a reasonable written security and privacy questionnaire, which Rivyt will answer completely and accurately. Rivyt will not misrepresent any fact in such an answer.

12. Subprocessors

12.1 General authorization. Customer authorizes Rivyt to engage the Subprocessors listed on our subprocessors page, and new Subprocessors in accordance with this clause.

12.2 Terms with Subprocessors. Rivyt engages each Subprocessor under written terms that include data protection and confidentiality obligations and that limit its use of the data to providing its service to Rivyt. Rivyt remains responsible to Customer for each Subprocessor’s performance as if it were Rivyt’s own.

12.3 Notice of changes. Before a new Subprocessor begins processing Customer Personal Data, or an existing Subprocessor’s processing changes materially (for example, new data categories or a new location), Rivyt will email Customer’s admins and anyone who has subscribed to change notices, and update the public list.

12.4 Right to object. Customer may object to a new or changed Subprocessor on reasonable data protection grounds by writing to privacy@getrivyt.com before the change takes effect. The parties will discuss the objection in good faith, and Rivyt will use reasonable efforts to offer a way of using the Service that avoids processing Customer Personal Data by that Subprocessor. If no resolution is reached, Customer may end the affected part of the Service by written notice, without penalty.

12.5 What is not a Subprocessor. Google (Drive) is Customer’s own provider. Rivyt reads from it under the permission that Customer’s Authorized User grants, and Customer’s contract with Google governs Google’s processing. Rivyt’s use of data received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

13. Data location

13.1 Rivyt stores Customer Personal Data in the United States. Some Subprocessors may process it elsewhere, as the subprocessors page states for each one: in particular, AI model providers may process a request outside the United States, and connections pass through networks that handle each one at the location nearest the user.

13.2 Export-controlled data. The Service is not designed for technical data controlled under the International Traffic in Arms Regulations or the Export Administration Regulations, or for Controlled Unclassified Information. Rivyt does not guarantee that only US persons can access such data at Rivyt or its Subprocessors. Customer will not upload such data unless the parties first agree in writing to specific controls.

14. Deletion or return at the end of the Agreement

14.1 During the term. Customer can delete documents, workspaces and Authorized Users at any time using the Service. Deleting a document removes its stored files, its passages from the search index and the text kept from it, and withdraws the knowledge Rivyt learned from it, so that it is no longer used. Deleting a workspace does the same for every document in it.

14.2 Export at the end. For 30 days after the Agreement ends, Customer may export Customer Content (documents, question history and knowledge graph facts) in a commonly used, machine-readable format, using the export in the Service or on request to privacy@getrivyt.com.

14.3 Deletion. Within 30 days after that export period, or earlier on Customer’s written instruction, Rivyt will delete Customer Personal Data and Customer Content from its production systems, including derived data, and will revoke its Google Drive access. Copies in backups are deleted as those backups expire. Rivyt will confirm the deletion in writing on request.

14.4 Retention required by law. Rivyt may retain Customer Personal Data only to the extent law requires, and then only for as long as it requires. That data remains subject to this DPA. Audit records that must survive a person’s deletion are kept without the person’s name.

15. Customer obligations

15.1 Customer is responsible for having a lawful basis and giving all notices, and obtaining all consents, that law requires for Rivyt to process Customer Personal Data under this DPA, including any employee monitoring notice (Customer’s admins can read the question history of members of their workspaces) and any notice or consent for voice recording.

15.2 Unless the parties agree otherwise in writing, Customer will not upload, sync or submit to the Service: special categories of personal data or sensitive personal information (for example health, biometric, genetic, racial or ethnic origin, religious belief, sexual orientation, citizenship or immigration status, precise geolocation, government identifiers, or financial account numbers), other than the account credentials the Service itself uses; personal data of children; protected health information under HIPAA, or payment card data; or export-controlled data or Controlled Unclassified Information (clause 13.2). Rivyt will tell Customer if it becomes aware of such data and will delete it on instruction.

15.3 Customer is responsible for choosing which Google Drive files its Authorized Users connect, and for the lawfulness of the data in them.

16. AI-specific commitments

16.1 No training. Clause 5.5 applies to every AI Subprocessor. Rivyt uses each AI Subprocessor only under terms that do not allow it to train on Rivyt’s API data, has opted out of training wherever a Subprocessor offers that setting, and will not opt in to any data sharing program.

16.2 Voice. Voice features are off until each Authorized User turns them on after a consent screen. Rivyt does not store audio, does not create voiceprints, and does not identify speakers by voice.

16.3 Outputs. Answers and decision briefs are decision support. They cite their sources and do not replace Customer’s controlled procedures or professional judgment.

17. Details of processing

Subject matter. Provision of the Rivyt Service: turning Customer’s operational documents into a searchable, cited knowledge base and knowledge graph, and answering Authorized Users’ questions about them by text and, optionally, voice.

Duration. The term of the Agreement, plus the export and deletion periods in clause 14. Transient processing (for example, voice audio) lasts only as long as the request.

Nature of processing. Collection, storage, conversion to text, splitting into passages, creation of embeddings, indexing, AI extraction of facts, retrieval, AI answer generation, speech to text and text to speech (optional), transmission of service emails, display, access control, logging and deletion.

Categories of data subjects. Customer’s employees and contractors who are Authorized Users; individuals named in, or whose information appears in, Customer’s documents (for example authors, approvers, technicians on work orders and supplier contacts); and individuals whose voices are captured in voice features or knowledge interviews, which should be the Authorized User only.

Categories of personal data. Account data (name, work email, role, workspace memberships, sign-in records, MFA enrollment status, IP address and browser details in security logs); profile (job title, “In your own words”, equipment worked on, the tailoring setting); question history; voice audio (transient, not stored by Rivyt); knowledge interview content; names and information in documents; service email data; feedback; inspection records; and audit data.

Sensitive data. Account log-in credentials (an email address with a password, stored as a hash by the sign-in provider, and an authenticator-app second factor), used only to authenticate Authorized Users and secure the Service. No voiceprint or other biometric identifier is created.

18. General

18.1 This DPA lasts for as long as Rivyt processes Customer Personal Data, whether or not the Agreement has ended.

18.2 Notices to Rivyt go to privacy@getrivyt.com (privacy) and security@getrivyt.com (security incidents).

18.3 This DPA is governed by the law governing the Agreement. If any provision is invalid, the rest remains in force.

Naveiyra Holdings, Inc., Delaware, United States.