Privacy Policy

1. Information we collect

We collect information you provide directly — such as your name, email address, and organization details when you create an account or contact us.

We also collect information automatically when you use Roiva, including usage data, log data (IP address, browser type, pages visited), and cookies necessary for the service to function.

When you connect third-party integrations (e.g. HubSpot, Salesforce, Zendesk, Xero), we store OAuth credentials and sync data from those platforms on your behalf. We do not access that data for any purpose other than providing the service to you. Each connection also keeps a name for the account it connects to: usually a company or workspace name, but for Google Workspace calendars, Microsoft 365, Microsoft 365 Copilot and Salesforce, the name, email address or username of the person who connected it.

When you connect a workplace AI assistant platform (Microsoft 365 Copilot, ChatGPT Enterprise, Claude Enterprise or Gemini in Google Workspace), its usage report names each of your people, by name, email or the platform's own ID. Before anything is saved, we replace each person with a one-way digest made with a key only Roiva holds, and keep only that digest, the first or latest day in each month they used the assistant (Gemini keeps both) and, for Microsoft 365 Copilot and Gemini, the apps they used it in. We keep no one's email or name from those reports, and nothing anyone asked the assistant or that it wrote. Glean is read as monthly counts only, with no one listed. What each platform keeps is published at What Roiva keeps from each platform.

A chat integration works the other way around. When you connect Slack or Microsoft 365, we store the Slack workspace name or, for Microsoft 365, the email address of the person who connects, the channel you choose and the webhook address for it, and we post notifications to that channel. We do not read your messages, list your channels, or see who is in your workspace.

Where your workspace allows it, an AI assistant someone in it connected (section 3) can draft a monthly reading, a vendor bill's charges as costs, or an initiative's business-case figures, for a person to accept in Roiva. We store each draft: the figures or the bill's lines, the basis line given for each business-case figure, the source the assistant gives for it, which may quote an email or a document, its reasoning, and which assistant drafted it for whom.

Information we receive from Google

When you sign in with Google or connect a Google service, Roiva receives data from Google's APIs only for that sign-in or connection, and keeps only what is listed here:

• Sign in with Google. Your name and email address, to sign you in.
• Google Workspace (calendar). The Google account ID and email address of the person who connects, and the name, ID and owner of each calendar they can see, so they can choose which to read; a calendar's ID is often a colleague's or a room's email address. From the calendars they choose, each event's start and end, whether it recurs or is held online, and how many people were invited and accepted. Google also sends each event's title, description and attendees; we keep none of them, nor any attendee's name or email, nor a meeting's join link.
• Google Cloud. Through a service account your organization grants read-only roles: monthly cost by project and service from your Cloud Billing export, your billing budgets, BigQuery job statistics, and the results of metric queries your team writes against its own tables.
• Gemini in Google Workspace. Google's Gemini audit log, read with a Workspace administrator's permission. Each entry names a person, by email and Google profile ID, with the Workspace app and the kind of action. Before anything is saved, we replace the person with a one-way digest of their profile ID, and we keep only those digests, the first and latest day in each month that each person used Gemini, the apps they used it in, and each month's count of people. We keep no one's email or name from the log, and the log holds nothing anyone asked Gemini or that Gemini wrote. When the connection is made, we read the newest entry of the Workspace's sign-in audit log, or of its Gemini audit log if the sign-in log has none, for the Workspace's customer ID, and keep only that ID and the Workspace's domain, besides the connection's own credentials. Google's sign-in also tells us the connecting administrator's email address, which we don't keep.

We use this data only to provide and improve the features you connected it for, such as counting meeting time or monthly Gemini users for your initiatives. We do not sell it, use it for advertising, or use it to develop, improve or train AI or machine-learning models, ours or anyone else's. We transfer it only to the sub-processors in section 5 that host and run the service. When you ask the in-app assistant about your figures or connections, the counts and totals derived from it, and a connection's name (a Google email address or a Workspace domain), reach Anthropic to answer you. An AI assistant your administrator connects through Roiva's MCP server (section 3) can read the same, at your organization's direction. People at Roiva look at it only with your permission, for example when you ask us for support, or to keep the service secure, or as the law requires. It is kept and deleted as section 4 describes. You can withdraw Roiva's access at any time from your Google Account's third-party connections page, or, for an administrator, in the Google Admin console.

Roiva's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy , including the Limited Use requirements.

When your team attaches documents to an initiative (for example a business case, a review deck, a statement of work or a contract), we store each file on your behalf, or, for a document kept elsewhere, its link and title. These documents may contain personal information about your staff or about the people and companies named in them. We do not read, analyze or share a document attached this way. The exceptions are files you ask Roiva to read: one you upload to create an initiative from its contents, or a business case you upload or pick from an initiative's documents to fill in its planned figures, described in section 5.

If you choose to receive two-factor sign-in codes by text message, we store your mobile number, encrypted, for as long as text messages are how you sign in, and delete it when you switch to an authenticator app or turn two-factor off. Each code is sent through AWS End User Messaging Notify, which receives your number and the code. We keep a one-way hash of each code we send, with the number, for two days, to check it and to limit how many we send. We do not share mobile numbers with third parties or affiliates for marketing or promotional purposes, and text-message opt-in data and consent are not shared with any third parties. AWS does not share phone numbers for marketing. See the text message terms.

2. How we use your information

We use the information we collect to:

• Provide, operate, and improve Roiva
• Authenticate your account and keep it secure
• Send transactional emails (invitations, notifications, receipts)
• Respond to support requests
• Comply with legal obligations

We do not sell your personal information to third parties. We do not use your data to train AI models.

3. Data storage and security

Your data is stored on servers in the United States (AWS). We use encryption in transit (TLS) and at rest. Sensitive credentials — integration tokens, API keys, OAuth client secrets, and SAML signing keys — are encrypted at the field level using AES-256.

External auditor access links are stored as a one-way SHA-256 digest, never as the original token. The full URL is shown to your administrator once at creation and cannot be retrieved again afterwards. If an auditor loses their link, your administrator regenerates a new one.

MCP access tokens, which let an AI assistant your administrator connects (such as Cursor, Gemini CLI, Google Antigravity, or Claude Code where it doesn't sign in) read your account, are stored the same way: as a one-way SHA-256 digest, shown once. So is the client secret Roiva generates when your administrator registers a client for an assistant such as Microsoft Copilot Studio, Microsoft 365 Copilot, Amazon Quick or Gemini Enterprise. So are the sign-in connections an administrator, or a member your administrator allows, approves for an assistant such as Claude, ChatGPT or one of those; for each connection we also keep which assistant it is, who approved it for which account, where its sign-in returned, and when it was approved, last used and disconnected. The assistant can read your data but not change it. Where your workspace allows it, it can also draft a monthly reading, a vendor bill's costs or an initiative's business-case figures, for a person to accept in Roiva, and nothing changes until someone does. The answers Roiva returns to it are processed by that assistant's provider under your organization's own agreement with them; that provider is not one of our sub-processors.

Reporting tokens, which let Power BI or your own loader read the reporting tables (a daily copy of your figures your administrator can turn on), are stored the same way and read nothing else. If your administrator adds a delivery destination, Roiva writes the reporting tables into a storage bucket your organization owns, through a role your organization creates that can add files and cannot read, list or delete them. The bucket, and whatever your organization uses to read it, such as a data warehouse or BI tool, are chosen and controlled by your organization and are not our sub-processors. Roiva deletes its own copies of the reporting tables after fourteen days, keeping the most recent while they are turned on. Your administrator can also have Roiva write a full export of your account to that bucket once a week; Roiva keeps no copy of it once it is written.

Documents attached to an initiative are stored in Amazon S3 in the United States and encrypted at rest. A file is served only to a signed-in member of your account who is allowed to see it, through a link that expires after five minutes. Statements of work and contracts are visible only to your account's owners and admins, and to the people named as approvers on that initiative. Each uploaded file is scanned for malware by Amazon Web Services when it arrives, in the same United States region where it is stored, and a file found to contain malware is never delivered to anyone.

No method of transmission or storage is 100% secure. We take reasonable measures to protect your information but cannot guarantee absolute security.

4. Data retention and deletion

We retain your account data for as long as your account is active. You can delete your data at any time using the in-app controls:

• Delete your user. Profile → Security → Delete account. This permanently removes your sign-in credentials, two-factor secret, assistant chat history, notifications, and personal activity, and removes you from every account you're a member of.
• Delete a workspace account (Owner only). Settings → Account → Delete account. This permanently removes the workspace and every initiative, value entry, integration, document, and report it contained.

Removing a document from an initiative deletes the stored file. Deleting an initiative deletes every document attached to it.

Both flows are irreversible. We recommend exporting any reports or data you want to keep before initiating either deletion.

Some records are deleted on a schedule rather than waiting for you to ask, because we shouldn't hold them longer than we need them:

• Audit logs: two years. The record of who did what inside your workspace. Two years so a SOC 2 audit can examine the period under test and the one before it.
• Product analytics and in-app notifications: 13 months.
• Drafts from AI assistants that nobody accepted: 90 days after they close. A draft that is declined, withdrawn, replaced or expires loses its figures or lines, source and reasoning 90 days later; we keep who drafted and decided it, and when. The audit log, kept two years, also records the figures drafted, or a bill's vendor and its lines' dates and amounts, and any note given when declining one, but not the bill's wording, the source or the reasoning. An accepted draft, with its source and the assistant's reasoning, stays with the reading, costs or business-case figures it became, like the rest of your records.
• Assessment responses that never became an account: two years from your last activity. If you took our public AI-readiness assessment and never signed up, your answers and contact details are deleted after two years. A copy may remain in our CRM under its own settings; email us and we'll remove that too.

Everything else in your workspace is kept while your account is active and deleted when you delete it. We don't age out your own records.

Our database backups are encrypted and deleted automatically after 30 days, so what you delete stays in them until they expire. We restore a backup only to test that restoring works or to recover the whole service after a failure, never to bring back one account's or one person's data. If we do restore one, we repeat every user and account deletion made after the point we restored to.

When you delete an account or user, we retain a single audit-log entry recording that the deletion happened — the date, an aggregate count of what was destroyed, and (for user deletions) a one-way SHA-256 hash of the email address so support can answer a future "did this person ever have an account" query without storing the email itself. No other personal information is retained, apart from the backups above until they expire. This entry exists so the deletion itself stays auditable.

One exception when you delete your user: the reports your workspace generated and keeps in Roiva (a report in Export history, or an accounting period's PBC packet) stay exactly as they were generated, so a copy already shared can be matched to the original. If one printed your name or email, such as the approver of a Board Brief's commentary or who decided an approval, it still does, until your workspace deletes that report or the workspace itself. A full-account export someone made before your deletion, and our copies of the reporting tables above, may also hold your details, for no longer than until they expire; one you made yourself is deleted with you.

Removing your name and email from the records Roiva keeps of what you did or what was asked of you, and from notifications and Assistant chats that mention you, normally finishes within minutes, and runs again a day later for anything written meanwhile. Until then we keep, encrypted, only what it needs to find them, retrying daily if a step fails. Text your colleagues typed into a note or description stays as they typed it. If you are a member of Roiva's staff, a workspace's audit log keeps your email beside any entry recording that you entered, locked or unlocked that workspace, so its owners can always see who at Roiva it was; those entries are deleted with the rest of the audit log after two years.

Financial records inside your workspace — accounting periods, journal entries, allocation rules — are deleted with the rest of the account data. We rely on your prior export of those records to satisfy your own tax and audit retention duties, in line with GDPR Article 17(3)'s recognition that erasure rights and financial-records obligations can coexist provided the data subject has been given the opportunity to preserve their own copy. Our own books (revenue from you, in our accounting system and Stripe) are retained separately under the retention period required by applicable tax law.

If you can't sign in and need help exercising your deletion right, contact us at hello@roiva.ai .

5. Third-party services

We use the following sub-processors to operate the service:

• AWS — cloud infrastructure, storage and email delivery. Roiva runs in a single US region (us-east-1): application data in Amazon RDS for PostgreSQL, uploaded files in Amazon S3, the background job queue in Amazon ElastiCache, transactional email through Amazon SES, which receives the recipient's address and the message we send them, and two-factor sign-in codes by text message through AWS End User Messaging Notify, which receives the mobile number and the code.
• Stripe — payment processing
• Sentry — error monitoring
• Anthropic — large-language-model inference for the in-app assistant, AI-generated initiative estimates and template recommendations, document analysis, and answers to questions asked in our public documentation. Content you send to the assistant, the initiative and company details behind estimates and recommendations, document text we analyze on your behalf, and questions asked in our documentation are processed by Anthropic's API. Anthropic does not use this content to train its models. See Anthropic's privacy policy for details.
• PostHog — product and usage analytics across both our marketing pages and the signed-in application. In-browser tracking only loads after you accept the analytics cookie banner; a limited set of account events (described in Section 6) is also sent from our servers. See PostHog's privacy policy for details.

Each sub-processor is contractually required to handle data in accordance with applicable privacy law.

These services also receive personal data, but for our own purposes as controller rather than on a customer's behalf. They are not sub-processors, process no customer data under our Data Processing Addendum, and are listed here so that every recipient of personal data is disclosed:

• HubSpot — demo scheduling and sales contact records. If you book a demo, the name, email address and meeting details you enter are submitted to HubSpot. The booking widget is an embedded HubSpot page; it does not set cookies or other storage on our own site. Separately, if you complete the AI ROI Exposure Assessment and give us an email address, we create a contact in our own HubSpot from what you entered — your email, company and role, and the answers the assessment scored — so that we can follow up. If you subscribe to one of our newsletters, your email address, the page you subscribed from and the consent you gave are sent to HubSpot, which sends the newsletter and handles unsubscribing. See HubSpot's privacy policy for details.
• Google Analytics 4 — usage analytics (only loaded after you accept the analytics cookie banner). See Google's privacy policy for details.

6. Cookies and analytics

Roiva uses two kinds of cookies and similar storage:

• Functional (always on). Session cookies for authentication, account context, and security, plus two that remember how to show pages to you: your color mode and your time zone. These are required for Roiva to work and are not optional.
• Analytics (opt-in). On our marketing pages and inside the signed-in application we use PostHog and Google Analytics 4 (GA4) to understand how people find and use Roiva. Neither tool loads in your browser until you click Accept on our cookie banner.

PostHog stores its identifier in both your browser's local storage and a first-party cookie. Once loaded it records pageviews, and — because autocapture is enabled — it also records interactions such as clicks on buttons and links, along with the element that was interacted with. PostHog only builds a stored person profile for users we have identified (in practice, signed-in users); visitors who are not signed in are counted without a persistent profile being created. We have configured our PostHog project to discard client IP addresses, so your IP address is not stored alongside these events; an approximate location is derived from it before it is discarded.

Google Analytics 4 sets its own cookies and records pageviews, on-site events, approximate location, and an anonymized IP address (IP anonymization is enabled in our configuration). We do not use GA4's advertising features, audiences, or remarketing.

Separately from the banner, when you are signed in our servers send a small, fixed set of product events to PostHog — such as completing signup or requesting an invite — together with your email address, account identifier, and account name. This is server-side processing we carry out to operate and improve the service; it does not involve cookies or storage in your browser, and it is not affected by your cookie banner choice.

You can decline analytics at any time by clicking Decline on the banner — your choice is stored in your browser's local storage. Because that storage is per-site, our marketing pages and the signed-in application ask separately, and declining on one does not carry over to the other. To change a previous choice, click Cookie preferences in the footer of any marketing page, or on your Profile page inside the application; the banner will reappear and you can choose again.

We do not use advertising, retargeting, or third-party tracking cookies.

7. Your rights

Depending on your jurisdiction, you may have the right to access, correct, or delete your personal data, or to object to or restrict certain processing.

The fastest way to exercise your erasure right (GDPR Article 17 and equivalents) is the in-app self-service flow described in Section 4 . For access, correction, objection, restriction, or any request you can't complete in-app, email us at hello@roiva.ai and we will respond within the timeframes required by applicable law.

8. Children

Roiva is a service for businesses and the people who work in them. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, email hello@roiva.ai and we will delete it.

9. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email or by posting a notice in the application. Continued use of Roiva after changes take effect constitutes acceptance of the updated policy.

10. Contact

Questions about this policy? Email us at legal@roiva.ai .