Privacy

What Rivynt reads, and why

Rivynt reads your company's project records from your connected platform (Procore or Autodesk Construction Cloud) and scores each project against your own scorecard. A connection is made by an owner or admin of your company through that platform's own sign-in. Rivynt never changes or deletes your records: the only thing it creates in Procore or Autodesk Construction Cloud is its own notification webhook, and only when an owner or admin of your company allows it.

Today, for each connected Procore project, Rivynt reads: observations, inspections, daily logs (manpower, productivity, and daily log headers), meetings, RFIs, submittals, the documents list, forms, action plans, budget, contracts and change orders, the project directory (names and job titles), and the list of your projects. From Autodesk Construction Cloud it reads: issues, RFIs, submittals, forms, project files, cost contracts, the project members list, and the list of your projects. Rivynt reads once a day for each connected company, and again for just the one item that changed when your platform tells us something changed.

What Rivynt keeps

Rivynt stores the record your platform sent, minus the fields your platform uses to hold a person's sign-in or email address, phone number or, where a record carries one, postal address: those fields are removed before the record is kept, and ids, names and job titles stay. Text someone typed into a record — a note, a description, a question — is kept as it was sent, except that text inside a person's entry that contains an @ sign is removed whole. Alongside it we keep the facts we pulled from the record, the score and the explanation behind that score, and who filed the original record — their user id on that platform, name and job title. We also store your scorecard's versions, who is on your team and what they're assigned to, and a record of each month your team closes out. We keep the underlying record, not just the score, because a score that cannot be traced back to the record that produced it is not one we think is worth showing you — see our Security page for how that chain works end to end.

Your platform connection itself is stored encrypted, not in plain text, and the key that unlocks it lives outside the database — details are on our Security page.

Who else touches your data

Three companies process data on Rivynt's behalf today, each for one part of the service: Supabase stores everything Rivynt keeps and handles sign-in, in the United States. Vercel hosts the application, so every request to Rivynt passes through it. Anthropic writes the answers in Ask Rivynt and the summary in your monthly digest, and drafts a scorecard from a document you upload to the scorecard builder.

Sentry is not a subprocessor today. It will become one only when error reporting is switched on for this deployment, and this page will say so from that day.

Google is not a subprocessor today. It will become one only when sign-in email through Google Workspace ships, or when product email — the Monday digest, which is built but not switched on — is sent through it, and this page will say so from that day.

Apple Push Notification service is not a subprocessor today. It will become one only when push notifications to the iPhone app are switched on, and this page will say so from that day.

Stripe is not a subprocessor today. It will become one only if subscription billing on rivynt.com is switched on, and this page will say so from that day.

Procore and Autodesk Construction Cloud are not subprocessors: whichever you connect is your own system, not a subprocessor. Rivynt reads from it and never changes or deletes your records there; the only thing it creates is its own notification webhook, and only when an owner or admin allows it.

What Anthropic sees, and what it never does

When Ask Rivynt answers a question, or your monthly digest is summarized, or a scorecard is drafted from a document you upload, Anthropic receives only what that task needs: project names and job numbers, your scorecard's wording (rule, category and role names), scores and counts already computed from your records, dates, and the question you asked. An uploaded scorecard document is sent in full, because drafting from it is the point.

Anthropic never receives a record's own content — its title, description or any attachment — any internal id, or your platform connection. People's names held in Rivynt's own records are replaced by placeholders before anything is sent; a name you type into a question, or one inside a document you upload, is sent as typed. Rivynt does not store the question you asked or the answer you got back. Rivynt does not use your data to train any model, and neither does Anthropic on our behalf.

How long we keep things, and what you can ask for

Two things are deleted on a schedule today, and nothing else. Webhook delivery receipts are removed after 30 days, except the first and the newest for each job, which say when its live updates began and when they last arrived. In-app notifications are removed once they are 90 days old if they have been read, and once they are 180 days old if not. A record that disappears from your platform is retired in Rivynt — kept, marked, and no longer scored — not erased, so a past score stays explainable.

There is no self-service or automatic way to export or delete your company's data yet, and a closed month's sealed figures and audit trail are built to refuse deletion by design. You can still ask, and we will tell you plainly what we can and cannot do with your request today, and follow up once a documented process exists. Backups are managed by our hosting provider, Supabase; we don't have a verified retention window for them to state here.