Subprocessors
Last updated: 14 October 2026
1. What this page is
Rivyt is operated by Naveiyra Holdings, Inc. dba Rivyt, a Delaware corporation. Our customers are manufacturing and industrial companies. When they use Rivyt, we process personal information on their behalf, as their service provider and processor.
A subprocessor is a company we engage to process that customer personal information for us, so that we can provide Rivyt. This page lists every one of them, what each does, what it receives, and where it processes it.
What we never do. We do not sell customer data or share it for advertising. We do not use customer data to train anyone’s AI models, and none of these companies may use it to train theirs. The Rivyt app uses no analytics trackers or advertising cookies.
2. Current subprocessors
2.1 Core service
These are needed for Rivyt to work at all.
| Subprocessor | Purpose | Data it receives | Where |
|---|---|---|---|
| Anthropic | Writes the answers to questions, reads each document when it is added to build Rivyt's knowledge from it, reads scanned pages and pictures, and maps and words inspections | Your question, the passages from your documents that answer it, and earlier turns of the conversation. For suggested and tailored answers, your job title, profile and the equipment you ticked. When a document is added, its full text, page by page, to build Rivyt's knowledge graph and record of events from it, and images of scanned pages and pictures so their text can be read. Spreadsheet rows needed to answer a question. The text of an inspection, if your company uses inspections. | Stores data in the United States. Its models may process a request in another region where Anthropic operates. |
| Supabase | Database, sign in and file storage | Your account, your profile, the documents your company adds, the text and knowledge graph built from them, your question history including the full text of each question and answer, and encrypted Google Drive access tokens. | United States (AWS us-east-1) |
| Pinecone | Search index for documents | Numeric representations of your company's documents and the passage text stored alongside them, with each passage's file name and heading. Each workspace has its own separate area. | United States (AWS us-east-1) |
| Voyage AI | Search and ranking | Document passages when they are indexed, and, when you ask a question, its text together with the candidate passages it ranks. | Voyage AI does not publish where it processes requests, so it may be outside the United States. |
| Railway | Runs our servers | Everything our servers handle, in transit and in memory while it is processed. | The region of our servers is not yet confirmed in writing. Connections enter at Railway's nearest edge location. |
2.2 Optional features
Used only when a person chooses to turn the feature on. Each person is asked for consent first, and typing works without it. Rivyt does not store audio and makes no voiceprint.
| Subprocessor | Purpose | Data it receives | Where |
|---|---|---|---|
| OpenAI | Voice, only if you turn it on | Your recorded voice, to turn it into text, and the text of an answer when spoken replies are on. That answer text is written from your company's documents and can quote them. OpenAI never receives whole documents. | OpenAI does not commit to a processing region for our account, so it may be outside the United States. |
2.3 Operations
These keep the service running, deliver emails, and report errors. They receive little or no customer content.
| Subprocessor | Purpose | Data it receives | Where |
|---|---|---|---|
| Sentry | Error reports from our servers | Technical details of a failure, such as which code failed. It is set up to leave out what you sent, your content and who you are. | United States |
| Resend | Sends sign in, invite and security emails | Your email address and the email itself, such as an invite link or a security code. | United States |
| Formspree | The feedback form in Settings | What you type into it and your email address. | United States |
| Vercel | Delivers the app and this website to your browser | Standard request logs, such as your IP address and browser. None of your content. | A worldwide network that serves each visitor from the nearest location. A visitor in the United States is normally served in the United States. |
| Cloudflare | Domain names | Domain name lookups for our websites, which can include an IP address. None of your content. | A worldwide network that answers each lookup from the nearest location. |
2.4 Which subprocessors receive data from Google Drive
If a customer connects Google Drive, text and data from the files Rivyt reads reach these subprocessors, and no others:
| Subprocessor | What it receives from Drive files | Purpose | Where |
|---|---|---|---|
| Anthropic | The full text of each file, page by page, and images of scanned pages; passages that answer a question; spreadsheet rows needed for an answer | To build the knowledge graph, to read scanned pages, and to write answers | Stores data in the United States. Its models may process a request in another region where Anthropic operates. |
| Voyage AI | Passages when they are indexed; passages ranked against a question | To build the search index and rank results | Voyage AI does not publish where it processes requests, so it may be outside the United States. |
| Pinecone | Passages, their numeric representations, file names and headings | To store the search index | United States (AWS us-east-1) |
| Supabase | A copy of each file and its versions, the text extracted from it, the knowledge graph facts drawn from it with quoted evidence, its name and location, the encrypted Google tokens, and the connected account's email | Database and file storage | United States (AWS us-east-1) |
| Railway | Everything our servers handle, in transit and in memory | To run our servers | The region of our servers is not yet confirmed in writing. Connections enter at Railway's nearest edge location. |
| OpenAI | Only if spoken replies are on: the text of an answer, which can quote a Drive file | To read the answer aloud | OpenAI does not commit to a processing region for our account, so it may be outside the United States. |
| Sentry | Error reports, set up to leave out request bodies and content; no document text | To fix failures | United States |
3. What is not a subprocessor
Your own Google account. If your company connects Google Drive, Rivyt reads your files from Google under the permission your user grants. Google is your company’s own provider, under your company’s own contract with it, not a subprocessor Rivyt engaged.
Google API data. Rivyt's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. See our Google data use page.
Public lookups. For inspections, the vehicle identification number (and nothing else) is sent to the US National Highway Traffic Safety Administration’s free public VIN decoder.
4. Changes to this list
When we plan to add or replace a subprocessor, or change what one receives, we email every customer’s company admins before the change takes effect, and update this page and its “Last updated” date.
Anyone else at a customer, such as a privacy or procurement contact, can subscribe to the same email on our in-app privacy page. You can unsubscribe at any time.
A customer that objects to a change on reasonable data protection grounds can tell us at privacy@getrivyt.com, and we will discuss it in good faith. A customer’s signed agreement or DPA may give it further rights, and where it does, those apply.
5. Notes
Where the DPA prevails. This page describes our subprocessors. A customer’s DPA sets out the binding terms. If they differ, the DPA prevails.
Questions. Email privacy@getrivyt.com for privacy questions, and security@getrivyt.com to report a security concern.
6. Change history
| Date | Change |
|---|---|
| 14 October 2026 | Descriptions corrected, with no change in what is sent: Anthropic also reads each document when it is added, page by page, to build Rivyt's knowledge from it; a spoken answer from OpenAI can quote your documents; Pinecone stores file names and headings with each passage; Voyage AI ranks candidate passages with your question. Locations now say where each provider stores and processes data, as far as it has been confirmed. |
| 28 September 2026 | Resend added. Resend has sent sign in, invite and security emails since 27 September 2026, and was missing from this list until then. |
| 24 September 2026 | List first published, in the Rivyt app's privacy policy, with Anthropic, Supabase, Pinecone, Voyage AI, OpenAI, Sentry, Formspree, Railway, Vercel and Cloudflare. |