Last updated 4 November 2026

Privacy policy

Rivit Invoices is run by Red Bridge Network Inc. in Toronto, Canada ("we", "us"). This policy covers the website at rivitpay.com, the dashboard at dashboard.rivitpay.com and the Rivit Invoices app for iPhone and Android. It explains what we collect, who receives it and what you can do about it.

1. The short version
2. Your data and your clients' data
3. What we collect
4. How we use it
5. Who we share it with
6. Where data is processed
7. How long we keep it
8. Deleting your account
9. Your rights
10. Cookies and browser storage
11. Keeping data safe
12. Children
13. Changes to this policy
14. Contact

The short version

• We collect what we need to run your account, send your invoices and get you paid.
• The free generators on rivitpay.com run in your browser. What you type there isn't sent to us.
• Your clients pay on a Stripe page. We never see their card or wallet details, and the money goes straight to your Stripe account.
• We don't sell your data, and there are no ads in Rivit Invoices.
• You can delete your account at any time, in the app or on the web dashboard. Deleting your account lists what goes, what we keep and why.

Your data and your clients' data

Your account data is your name, email, business profile and how you use Rivit Invoices. We decide how it's used, so we're responsible for it (the "controller" under privacy law).

Your clients' details are the names, email addresses and other details you add to invoices and estimates. We handle them only for you and on your instructions (as your "processor" or "service provider"). You're responsible for having the right to use them and for telling your clients how you handle their data. If one of your clients asks us about their data, we'll pass the request to you.

What we collect

Your account

• Your name and email address.
• How you sign in. On the web dashboard you use your email and a password. We store only a scrambled hash of it, never the password itself. In the app you use Sign in with Apple, Google, or a one-time code sent to your email. Apple may give us a private relay email instead of your real one. Google gives us your name, email and profile picture link.
• Your sign-in sessions, with the IP address and browser or device type they came from.
• When we send you a sign-in code or a password reset link, a short record of the email address and IP address it went to, to stop abuse.

Your business profile

• Business name, logo, address, email, phone, website and tax ID.
• Invoice settings, such as currency, payment terms, default notes, numbering and style.
• Bank transfer details you add to show on invoices: account holder, bank name, account number and routing number. They're encrypted when stored, both in your business profile and on each invoice.

Your clients and documents

• Client names, email addresses, phone numbers, addresses and reference numbers you enter.
• Invoices and estimates: line items, amounts, tax, discounts, notes, dates and status, including whether a client accepted or declined an estimate.
• Reminder schedules and the notes you add to reminders.
• A history for each document: when it was created, sent or shared, who it was emailed to, when your client first opened it and when it was paid.

Payments

• Your Stripe account ID, its country and currency, and whether it can take payments and pay out.
• Payment status and amounts from Stripe, and our fee on each payment.
• In the app, your Stripe balance, recent payouts and the bank account they go to (bank name and last digits only), fetched from Stripe when you look at them.

We don't receive card numbers or crypto wallet details. Your clients enter them on a Stripe page.

Pro subscription

• Your plan, the product you bought, which store you bought it from, whether it will renew and when it ends. This comes from RevenueCat, which gets it from Apple or Google. We never see your Apple or Google payment details.

In the app

• A push notification token for each phone you sign in on, and whether it's iPhone or Android, so we can tell you when an invoice is opened or paid.
• Drafts are saved on your phone until they sync to your account.
• If you add a logo, the app reads only the image you pick.
• Install and marketing data, through AppsFlyer: your device type and operating system, an app ID that Apple gives us for your phone (not your advertising ID), IP address, your Rivit Invoices user ID, when you installed and opened the app, and whether you signed up, sent your first invoice, started a free trial or bought Pro. We use it to see which of our ads and links bring people to the app. The app never reads your phone's advertising ID and never asks to track you across other companies' apps.
• Crash reports, through Sentry: device type, operating system, app version, your Rivit Invoices user ID and what the app was doing when it crashed. Email addresses, phone numbers and amounts are removed before a report is sent. We use them to find and fix bugs.

On rivitpay.com

• Free generators: they run in your browser and save drafts in your browser's storage. Share links carry the invoice in the part of the link after the "#", which browsers don't send to servers.
• Company auto-fill: if you use it, the domain of the work email you entered (such as acme.com) is sent to our server, which looks up public details about that company.
• Crypto invoices: if you put a wallet address on an invoice, it's saved in your browser and carried in the share link. The payment check reads the public blockchain straight from your browser, through public network servers that see your IP address and the wallet address. Exchange rates come through our server, which receives only the coin and currency.
• Google Analytics: on most pages we use Google Analytics to count visits. It records the pages you view, the buttons you use, your browser and device type and your rough location, and sets cookies. Where the law requires it, such as in the EU and UK, it runs only after you agree. We remove anything after "#" before it's sent, so the contents of share links never reach Google. The W-9 form page has no analytics.

When your client opens a pay page

• We record when the invoice or estimate was first opened, and tell you. When they pay, Stripe collects their card or wallet details under Stripe's privacy policy.

When you contact us

• Your email address and what you write to us.

How we use it

• To run Rivit Invoices: store and sync your documents, make PDFs, email invoices, estimates and reminders for you, show the pay page and send you notifications.
• To get you paid: create payments on your Stripe account, apply our fee and show you what's been paid.
• To run Pro: check your plan and remove our payment fee while it's active.
• To keep Rivit Invoices safe: sign you in, limit sign-in attempts, and find and stop fraud and abuse.
• To help you: answer support emails and send messages about your account, such as changes to these policies.
• To improve Rivit Invoices: see which website pages people use, through Google Analytics, and find and fix app crashes, through Sentry.
• To measure our marketing: see which of our ads and links bring people to the app, through AppsFlyer.
• To follow the law: keep records we're required to keep and respond to lawful requests.

We don't sell your data or your clients' data. We don't show ads in Rivit Invoices, and we don't use the contents of your invoices for analytics or advertising.

Who we share it with

These companies process data for us under contract. Each one gets only what it needs.

We also share data:

• With your clients, when you send them an invoice or estimate. They see what you put on it, including any bank details you chose to show.
• When the law requires it, for example a valid court order.
• If Rivit Invoices is sold or merged. The new owner would have to follow this policy, and we'd tell you first.

Where data is processed

We're in Canada. Rivit Invoices runs on Cloudflare, so your data may be processed in Canada, the United States and other places where Cloudflare has servers. Our other providers mostly process data in the United States.

The EU recognises Canada's privacy law as giving adequate protection, so data can come to us from the EU without extra safeguards. When our providers move data out of the EU, the UK or Canada, we rely on their data processing terms, including the EU Standard Contractual Clauses and the UK's equivalent where they're needed.

How long we keep it

Stripe, Apple and Google keep their own records under their own policies and the law.

Deleting your account

Go to Settings → Delete account, in the app or on the web dashboard. It's one account, so deleting it in one place deletes it everywhere. You can also email support@rivitpay.com from the email address on your account and we'll delete it for you.

Deleting your account removes, straight away:

• your account and sign-in methods
• your invoices, estimates, clients and reminders
• your business profile, including bank details
• the history of each document, your plan record and your push tokens
• the link to your Stripe account
• your logos and saved PDFs

Payment links you've sent stop working.

It doesn't remove:

• Your Stripe account. It's yours, with any money on its way to your bank. To close it, contact Stripe.
• Your Pro subscription. Cancel it in your App Store or Google Play settings first, or the store keeps billing you.
• Records other companies keep: Stripe keeps its own payment records under its own policy, and Apple, Google and RevenueCat keep their purchase and subscription records.
• Emails already delivered to your clients.
• Backups, which are overwritten within 35 days.
• Records of payments and the fees we charged, for up to 7 years where tax and accounting law requires it. We keep only what's needed for that, and use it for nothing else.
• The Sign in with Apple link. To remove it, go to iPhone Settings → your name → Sign-In & Security → Sign in with Apple, choose Rivit Invoices and tap Stop Using.
• The Google sign-in link. To remove it, go to myaccount.google.com/connections and remove Rivit Invoices.

Your rights

Wherever you live, you can ask us to:

• give you a copy of your data, in a format you can take elsewhere
• correct it
• delete it
• stop using it for a particular purpose

You can edit your profile, clients and documents, and delete your account, yourself. For anything else, email support@rivitpay.com. We'll answer within 30 days, and we may ask you to prove the account is yours. We won't treat you differently for using your rights.

Canada. Under PIPEDA, you can also complain to the Office of the Privacy Commissioner of Canada.

EU, EEA and UK. We use your data because:

• we need it to provide Rivit Invoices to you under our terms
• it's in our legitimate interests to keep Rivit Invoices secure, prevent fraud, fix crashes and understand how the website and app are used
• you agreed, for analytics cookies and app install measurement where the law asks for consent
• the law requires it, for example to keep financial records

We'll name an EU and UK representative before we offer paid plans there. [TO CONFIRM: James to name the EU and UK representative, or confirm when paid plans open there.] You can also complain to your local data protection authority.

California. Under the CCPA, as amended by the CPRA, you can ask what personal information we collect, use and disclose, and ask us to correct or delete it. We collect identifiers (such as name, email and IP address), commercial information (such as your plan and payments), internet activity (such as pages viewed) and rough location from your IP address, for the purposes above. We don't sell personal information or share it for cross-context behavioral advertising. You can use an authorized agent to make a request.

Cookies and browser storage

• Sign-in cookie: keeps you signed in to the dashboard. Rivit Invoices can't work without it.
• Google Analytics cookies: on rivitpay.com, to count visits. Where the law requires it, such as in the EU and UK, we set them only after you agree, and you can change your mind at any time.
• Browser storage: remembers your light or dark theme and keeps your free generator drafts on your own device.

Keeping data safe

• Everything travels over an encrypted connection (HTTPS).
• Your data is encrypted when stored, including the bank details on your profile and invoices.
• Bank details in your business profile get a second layer of encryption, with a separate key kept apart from the database.
• Card and wallet details are handled by Stripe and never reach us.

No system is perfectly secure. If a breach affects your data, we'll tell you and the regulators as the law requires.

Children

Rivit Invoices isn't for anyone under 16. We don't knowingly collect personal information from children under 16. If you think a child has given us their information, email support@rivitpay.com and we'll delete it.

Changes to this policy

When we change this policy, we'll update the date at the top. If a change affects what we collect or who we share it with, we'll tell you by email or in the app before it takes effect.

Contact

Red Bridge Network Inc.
25 Parkway Forest Drive, Toronto, ON M2J 1L4, Canada
support@rivitpay.com