Privacy Policy

1. About this policy

This Privacy Policy explains how Rivo Software Ltd, a company registered in Scotland (company number SC895161), registered office 332 Leith Walk, Edinburgh, EH6 5BR and operator of Rivo Salon Software (“Rivo”, “we”, “us”), handles personal data. It covers the Rivo application, the booking website and the salon email address, together the “Service”. We are committed to the UK GDPR and the Data Protection Act 2018.

Rivo plays two roles. For the salon owners and staff who hold Rivo accounts, and for people who visit our marketing site, we are the data controller. For the client and business data a salon puts into Rivo to run its business, we are a data processor acting on that salon’s instructions - the salon is the controller. How we handle data processed on a salon’s behalf is set out in more detail in our Data Processing Addendum.

2. Data we handle as controller

When you sign up for and use Rivo as a salon, or contact us, we process:

• Account and identity data: name, business name, email address, phone number, and login credentials (passwords are stored hashed).
• Billing data: your plan, subscription status, and payment references. Card details are handled by Stripe - we do not store full card numbers.
• Usage and technical data: log records, device/browser information, IP address, and actions taken in the app, used to run and secure the Service.
• Support and communications: messages you send us and the content of support tickets.
• Marketing-site data: limited information from visitors to rivosalon.com, and anyone who enquires or signs up.

3. Data we process on behalf of salons

To provide the Service, we store and process the data a salon enters or generates in Rivo, which the salon controls. This can include the salon’s clients’ names, contact details, appointment and sales history, notes, consultation and consent forms, patch-test records, and messages between the salon and its clients. We process this only to provide the Service to that salon and on its instructions. If you are a client of a salon that uses Rivo, please contact that salon to exercise your rights over your data; we will assist the salon as its processor.

4. How and why we use data (lawful bases)

As controller, we use personal data to:

• Provide, maintain and secure the Service, and manage your account - to perform our contract with you.
• Take payment and manage billing - to perform our contract and meet legal obligations.
• Provide support and respond to enquiries - for our contract and our legitimate interests.
• Keep the Service secure, prevent abuse and troubleshoot - for our legitimate interests.
• Meet legal, accounting and tax obligations - to comply with the law.
• Send service messages, and (where permitted) occasional product updates - for our legitimate interests; you can opt out of non-essential messages.

5. Sharing and sub-processors

We do not sell personal data. We share it only with service providers who help us run Rivo, under contracts that require them to protect it, and where the law requires. Our key providers are Stripe (payments), Telnyx (SMS and voice), and Hostinger (hosting). Email is self-hosted on our own infrastructure. A current list of sub-processors is maintained in our Data Processing Addendum.

We may also disclose data if required by law, to protect our rights or the safety of others, or in connection with a business sale or reorganisation (in which case we will protect your data and tell you where required).

6. International transfers

Our infrastructure is based in the United Kingdom. Some providers (for example Stripe and Telnyx) may process limited data outside the UK. Where they do, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses.

7. How long we keep data

We keep account data for as long as your account is active. Because appointment and sales history is a record of the salon’s business (who attended, the service, the staff member and the amount paid), we retain it for the life of the account so those records stay intact. In summary:

A salon (as controller) can ask us to delete data sooner, subject to any retention we are legally required to keep.

8. Security

We use technical and organisational measures to protect personal data, including encryption in transit, encryption of sensitive stored secrets, access controls, tenant isolation so each salon’s data is separated from every other salon’s, PIN protection for shared screens, and audit logging. No system is perfectly secure, but we work to protect your data and to respond quickly to any incident.

9. Your rights

Under UK data protection law you have rights to access your personal data, to have inaccurate data corrected, to have data erased in certain circumstances, to restrict or object to certain processing, and to data portability. Where we rely on consent, you can withdraw it at any time.

To exercise your rights over data we hold as controller, contact us using the details below. If your data is held by a salon that uses Rivo (as controller), contact that salon; we will support them as processor. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).

10. Cookies

Rivo uses only cookies that are strictly necessary to run the Service, such as keeping you signed in. We do not use third-party advertising or analytics cookies. See our Cookie Policy for details.

11. Changes and contact

We may update this policy from time to time and will post the new version here with an updated date. For privacy questions or to exercise your rights, email privacy@rivosalon.com. We have not appointed a statutory Data Protection Officer; privacy matters are handled by Rivo Software Ltd at the address above.