Privacy policy

Riffiva is responsible for the processing described in this policy. Its operator’s full legal identity and contact details appear in the legal notice. For questions or requests concerning personal data, email contact@riffiva.com.

Riffiva determines the purposes and means of this processing. Polar acts separately as Merchant of Record for data it processes during payment, under its own privacy policy.

Depending on the features you use, Riffiva may process the following categories:

• Account: first name, last name, email, language, encrypted password or login data
• Subscription: plan, status, quotas, Polar customer and transaction identifiers, without the full card number
• TikTok profiles: handle, biography, and public information from the profile you add
• Public content: videos, media URLs, captions, hashtags, dates, durations, metrics, and available transcripts
• Creative analysis: voice, positioning, topics, visual formats, framing, editing, characters, expressions, and other observed signals
• Usage: saved trends, generations, scripts, edits, and history required for operation
• Technical and support: IP address, browser, security logs, preferences, emails, and support requests

Account data, preferences, and support requests are provided directly by users. Subscription information is sent by Polar after a transaction or subscription change.

Profile content is collected from information made public on TikTok through ScrapeCreators when a user requests a profile analysis.

Riffiva does not request users' TikTok credentials and does not log into their TikTok accounts.

Data is used only for defined purposes and under the following legal bases:

• Contract: create the account, analyze a profile, and generate and save scripts
• Contract: manage plans, quotas, payment, and support
• Legitimate interests: secure the service, prevent fraud, diagnose incidents, and improve reliability
• Legitimate interests: assess result quality in aggregate and reduce repetition
• Legal obligation: retain accounting and contractual evidence and respond to competent authorities
• Consent when required for an optional feature or non-essential tracker

Structured profile extracts, visual signals, and generation instructions may be sent to Anthropic to produce the requested creative analysis and scripts. Transcripts are used for profile analysis and are not sent in the script-generation prompt.

This automated processing assists with creative output but does not make decisions producing legal or similarly significant effects on users.

Riffiva limits information sent to models to what is needed for the feature. Do not submit sensitive or confidential data in free-text fields.

Data is accessible only to authorized people at Riffiva and the providers required to operate the service, according to their role and contractual commitments.

These providers may use their own subprocessors. Their policies and safeguards may change; Riffiva reviews the list when material changes occur.

• Convex: database, backend functions, and real-time data
• Railway: application hosting and the visual analysis service
• Anthropic: profile analysis, trend analysis, and script generation
• ScrapeCreators: collection of requested public TikTok information
• Polar: checkout, subscriptions, invoicing, taxes, and refunds
• Resend: transactional and security emails

Some providers are established or process data outside the European Economic Area, particularly in the United States. Depending on the provider and processing, transfers rely on an adequacy decision, standard contractual clauses, or another mechanism recognized by the GDPR.

You may request more information about the applicable safeguards by emailing contact@riffiva.com.

Riffiva retains data only as long as needed for each purpose, subject to legal obligations and technical backups:

• Account and preferences: while the account is active, then as needed for deletion and potential disputes
• Profiles, analyses, generations, and scripts: until deleted by the user or the account is closed
• Contractual data and correspondence: up to 5 years where required to establish or defend a right
• Accounting records and invoices: up to 10 years where legally required; Polar also retains its own records
• Technical and security logs: for a period proportionate to diagnostics, security, and abuse prevention

Subject to the conditions of the GDPR, you may exercise the following rights:

Send your request to contact@riffiva.com and specify the email linked to the account. Proof of identity may be requested only where there is reasonable doubt. Riffiva normally responds within one month, subject to lawful extensions.

Deleting a profile from Riffiva removes its analysis, generations, and related scripts from the active database. To close the account or exercise another right, use the contact above.

• Access your data and receive a copy
• Correct inaccurate or incomplete data
• Request deletion of your data
• Temporarily restrict processing
• Object to processing based on legitimate interests
• Receive provided data in a portable format where the right applies
• Withdraw consent at any time without retroactive effect

Riffiva uses cookies and storage strictly necessary for authentication, security, language, theme, and interface state. They enable the service to work and are not used for advertising profiles.

Authentication cookies expire based on the configured session duration. Language preferences may be kept for up to twelve months; some interface preferences remain in the browser until deleted.

If Riffiva later adds analytics or non-essential trackers, this policy and the consent mechanism will be updated before activation.

Riffiva applies technical and organizational measures proportionate to risk, including access controls, authentication, encrypted communications, secret separation, webhook verification, and error monitoring.

No system provides absolute security. If a breach is likely to create a risk, Riffiva follows the GDPR's documentation and notification requirements.

Riffiva is intended for adult creators. The service does not knowingly seek to collect data from children to create an account without the required authorization.

If you believe a minor provided account data without valid authorization, email contact@riffiva.com so the matter can be reviewed.

To exercise a right or ask about this policy, email contact@riffiva.com. Riffiva will seek to resolve the request directly and keep an appropriate record.

You may also lodge a complaint with the French Data Protection Authority (CNIL) or the supervisory authority where you live.

This policy may change when Riffiva adds a feature, changes a provider, or when regulation requires it. The update date at the top identifies the applicable version.

For a material change, Riffiva informs users through an appropriate channel, such as the application or email, before it takes effect where required.