Privacy Policy

Riva (also referred to as Rivabase, and provided at rivabase.ai) is a lead management, qualification and booking platform for tattoo studios, operated by Itisthatis Labs (OPC) Private Limited, a company incorporated in India under the Companies Act, 2013 (CIN U63122KA2025OPC208029), with its registered office at VO-378, WeWork-Vaishnavi No78/9, WeWork-Vaishnavi, Bellandur, Bellandur, Bengaluru, Bengaluru Urban, Karnataka, 560103.

In this Privacy Policy, “Riva”, “Rivabase”, “we”, “our” and “us” all refer to Itisthatis Labs (OPC) Private Limited and its platform. “Riva” and “Rivabase” denote the same service, operated by the same company. “Riva” is used throughout the remainder of this document.

This Privacy Policy explains how we collect, use, store, and protect information when you use our application, including our Instagram and WhatsApp-integrated chatbot and lead inbox features.

By using Riva, you agree to the practices described in this policy. If you do not agree, please discontinue use of the application.

We use the information we collect for the following purposes:

• To operate and deliver the Riva service — including running the qualification chatbot, displaying the lead inbox, and generating lead summaries and intent scores
• To respond to leads on behalf of studios within the free messaging windows permitted by Meta's platforms
• To generate lead intelligence — including intent scoring based on conversation signals
• To send studio owners notifications and reminders about their leads
• To improve and develop our product based on aggregate usage patterns
• To comply with applicable legal obligations

We do not sell your data or leads' data to third parties. We do not use lead conversation data for advertising purposes.

Riva integrates with Meta's Instagram Graph API and WhatsApp Business API. As a result:

• We access messaging data only with explicit permission granted by the studio owner through Meta's OAuth and permissions framework
• We use this data solely to provide the lead qualification and management service described in this policy
• We do not share Meta platform data with third parties except as required to operate our service (e.g., cloud hosting providers under strict data processing agreements)
• We comply with Meta's Platform Terms, Developer Policies, and any applicable data use restrictions
• Studio owners are responsible for ensuring their use of Riva complies with applicable laws when collecting and processing messages from their leads

Respective roles. Where a studio uses Riva to communicate with its leads, the studio determines the purpose of that communication and is responsible for its content. Riva processes lead data on the studio's instructions to provide the service. Leads seeking to exercise rights over data held by a studio outside Riva should contact that studio directly.

We do not sell, rent, or trade your personal information. We may share data only in the following limited circumstances:

• Service providers — trusted third-party vendors who help us operate our infrastructure (e.g., cloud hosting, analytics), bound by confidentiality and data processing agreements
• Legal compliance — if required by law, court order, or government authority
• Business transfers — in the event of a merger, acquisition, or sale of assets, data may be transferred to the successor entity with notice to affected users
• With your consent — for any other sharing not described here, we will ask for your explicit consent

We retain data for as long as necessary to provide our service and comply with legal obligations:

• Studio account data — retained for the duration of the subscription and up to 12 months after account closure
• Lead conversation data — retained for up to 12 months from the date of the conversation
• Billing records — retained for up to 7 years as required by applicable financial regulations

After the applicable retention period, data is securely deleted or anonymised.

Full step-by-step instructions, including how to disconnect your Instagram and WhatsApp accounts, are available on our Data Deletion page.

You have the right to request deletion of your data at any time. To do so:

• Studio owners: Send an email to r@rivabase.ai with the subject line “Data Deletion Request” and include your registered business name and email address. We will process your request within 30 days.
• Leads (end users): If you are a consumer who interacted with a studio's chatbot and wish to have your data deleted, please contact us at r@rivabase.ai. Include your Instagram username or the approximate date of your conversation. We will process your request within 30 days.

We process deletion requests within 30 days. Once your data is deleted, we email you at the address you contacted us from to confirm. We delete your lead and conversation data, including messages, reference images, and lead records, except records we must keep for legal reasons (for example, billing records; see Section 6).

Please note that deletion of certain data may limit our ability to provide the service to studio owners.

We take the security of your data seriously and implement the following measures:

• Encryption of data in transit using TLS/HTTPS
• Encryption of sensitive data at rest
• Access controls — only authorised personnel can access personal data
• Regular security reviews and monitoring

While we take reasonable precautions, no system is completely secure. In the event of a data breach, we will notify affected users and relevant authorities as required by applicable law.

Riva is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us immediately at r@rivabase.ai and we will delete it promptly.

Depending on your location, you may have the following rights regarding your personal data:

• Right to access — request a copy of the data we hold about you
• Right to correction — request that we correct inaccurate or incomplete data
• Right to deletion — request that we delete your data (see Section 7)
• Right to restriction — request that we limit how we use your data
• Right to portability — request your data in a machine-readable format

To exercise any of these rights, contact us at r@rivabase.ai. We will respond within 30 days.

Grievance redressal. If you are dissatisfied with how we have handled a privacy request, you may escalate to our Grievance Officer:

We respond to grievances within 30 days.

We use cookies and similar technologies to manage user sessions, remember preferences, and analyse usage patterns. You can control cookie preferences through your browser settings. Note that disabling cookies may affect the functionality of our platform.

Our platform integrates with third-party services including Instagram and WhatsApp (owned by Meta Platforms, Inc.). This Privacy Policy applies only to Riva. We are not responsible for the privacy practices of third-party services. We encourage you to review Meta's Privacy Policy and WhatsApp's Privacy Policy separately.

This Privacy Policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023 and rules made under it. The courts at Bangalore, Karnataka have exclusive jurisdiction over any dispute relating to this policy.

If you are located outside India, you acknowledge that your data may be processed in India, where data protection law may differ from that of your own country.

We may update this Privacy Policy from time to time. When we do, we will update the “Last Updated” date at the top of this document and notify registered studio owners via email or in-app notification. Continued use of Riva after changes are posted constitutes acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us:

We are committed to resolving privacy concerns promptly and transparently.