← Back to Riverz

Privacy Policy

Last updated: May 19, 2026

1. Who we are

Riverz is a SaaS platform operated by Excelencia Empire S.A.S. (Colombia), available at riverzai.com. We help brands and agencies create performance creatives with AI, connect them to Meta Ads, and analyze the performance of their ads. For questions about this policy, write to us at riverzoficial@gmail.com.

2. Data we collect

We collect only what is needed to operate the service:

  • Account: name, email, and avatar (provided by Clerk when you sign in).
  • Meta connection: your Facebook User ID and public name, the granted permissions (granular_scopes), and a long-lived access token . The token is stored encrypted (AES-256-GCM) in our database.
  • Data from your ads: ad accounts, pages, campaigns, ad sets, ads, and metrics (spend, CTR, ROAS, comments) that we pull from the Meta Graph API solely to show them to you inside Riverz.
  • Uploaded or generated content: images, videos, product briefs, transcriptions, and notes you create in the app.
  • Shopify connection (optional): your store domain and Admin API access token (encrypted), so we can sync products and publish landing pages.
  • Payments: Stripe processes payments directly. We only receive subscription metadata (plan, status, last 4 of the card). Never the full card number.
  • Technical usage: application logs, errors, and anonymized events (Google Analytics + Meta Pixel) to understand which features users use.

3. Meta Graph API data

When you connect your Meta account, Riverz requests the following permissions via OAuth. We only access this data for the features described here:

  • ads_management + ads_read: read and create campaigns, ad sets, ads, and creatives in your authorized ad accounts.
  • business_management: identify the Businesses (Business Managers) you authorized to scope the view to those accounts.
  • pages_show_list: list the Pages you authorized to choose the ad identity.
  • pages_read_engagement: read comments on your ads and Page metadata for winner analysis.
  • pages_manage_metadata: subscribe your Pages to the Meta webhook so we can show you the comments on your ads in real time.
  • public_profile: your Facebook name + photo (the minimum required by Meta).

We only see the assets you select in Meta’s "Edit access" dialog. If you restrict the grant to a single Business, only those ad accounts and pages appear in Riverz.

We do not use Meta data to train general AI models, nor do we share it with third parties outside the processors listed below.

4. Shopify Admin API data

When you install Riverz Landing Publisher in your Shopify store (via Custom Distribution or the Shopify App Store), Riverz requests the following access scopes through the standard OAuth flow. We only access the described data for the features listed below:

  • write_files: we upload the images and videos you paste into a landing to your own Shopify Files via stagedUploadsCreate + fileCreate. The assets are hosted on Shopify’s CDN, not on Riverz servers.
  • write_content: we create or update the pages (Shopify Online Store Pages) where each landing is published.
  • read_products + write_products: we read your catalog so you can pick a product in the editor, and when publishing as a Theme Template we automatically assign the custom template to the linked product.
  • read_themes + write_themes: to publish landings as Product Templates we create a section.liquid + template.json in your main theme. The files carry the Riverz project name so you can audit them in Admin → Online Store → Themes → Edit code.

Data we do NOT access: orders, customers, carts, checkout data, payment methods, or any personally identifiable data of your shoppers. Riverz does not store PII of Shopify customers at any time.

What we store in our database: your store domain(tu-tienda.myshopify.com), the Admin API access token encrypted at rest with AES-256-GCM, the mapping of each published landing to its page_id + template_key in Shopify, and the final storefront URL. Nothing else.

GDPR / privacy compliance: Riverz implements the three mandatory Shopify webhooks and responds to each with verified HMAC in under 5 seconds:

  • customers/data_request → we respond 200 OK indicating we do not store PII of Shopify customers (there is nothing to send).
  • customers/redact → we respond 200 OK (there is no customer PII to delete).
  • shop/redact → on receipt, we delete all rows associated with your shop_domain in our database: connection, encrypted tokens, mapping of published pages, registered theme templates. Deletion is immediate and verifiable.

5. How we use your data

  • Provide the app’s features (create, analyze, and publish ads).
  • Show performance dashboards for your campaigns.
  • Process subscription payments.
  • Improve the app and detect errors (aggregated analytics).
  • Handle support and reply to messages you send us.

6. Subprocessors

We share only the necessary data with the providers that supply our infrastructure. Each one has its own privacy policy:

  • Clerk: authentication. clerk.com/privacy
  • Supabase: database and file storage. supabase.com/privacy
  • Stripe: payments. stripe.com/privacy
  • Render: application hosting. render.com/privacy
  • Meta Platforms: Graph API (data from your ads and the pages you authorize).
  • Shopify: Admin API (products, themes, files from the store you connect). shopify.com/legal/privacy
  • kie.ai: proxy for generative models (Gemini, Veo, Nano Banana).
  • Google (Gemini API): text generation and analysis.
  • Google Analytics: anonymized app usage metrics.
  • Meta Pixel: attribution for Riverz’s own marketing campaigns.

7. Your rights

Under Law 1581 of 2012 (Colombia) and the GDPR (EU) you have the right to:

  • Access the data we hold about you.
  • Request its correction or update.
  • Request its deletion (closing your account erases all your data except what the law requires us to keep).
  • Revoke the Meta connection at any time from Meta Ads → Disconnect.
  • Receive your data in a portable format.
  • File a complaint with the Superintendence of Industry and Commerce (Colombia) or your supervisory authority.

To exercise these rights, write to us at riverzoficial@gmail.com from the email associated with your account. We respond within 15 business days at most.

8. Deletion of Meta data

When you disconnect Meta from Meta Ads → Disconnect we immediately delete:

  • The encrypted access token.
  • The saved granular_scopes .
  • The connection record.

We keep derived data (transcriptions, notes, dashboards) associated with your Riverz account in case you reconnect the same Meta account. To delete those too, close your Riverz account or write to us.

If you revoke access from Facebook (Settings → Apps and Websites → Riverz → Remove), Meta sends us a deletion notification; on receipt we delete the same data automatically.

9. Deletion of Shopify data

When you uninstall Riverz Landing Publisher from Shopify Admin → Apps → Riverz → Uninstall, Shopify sends the app/uninstalled webhook to our servers. On receipt:

  • We mark the connection as uninstalled in under 1 second and stop using the access token (which has already expired on Shopify’s side).
  • The encrypted token is kept for 30 days in case you reinstall the app in the same store (it saves you the full OAuth flow). After 30 days the row is deleted.
  • Landings published as Shopify Pages stay live. They are files in your store’s theme, not ours. If you want to delete them, do so from Online Store → Pages.
  • The Product Template templates (section.liquid + template.json) remain in your theme. To clean them up: Admin → Themes → Edit code → look for files with the prefix riverz-.

If you want to delete everything immediately without waiting the 30 days, write to us at soporte@riverzai.com from the email associated with the account and we respond within 5 business days at most. You can also trigger the official shop/redact webhook from Shopify to run the full deletion automatically.

10. Security

  • All connections use TLS 1.2+.
  • Meta and Shopify tokens are encrypted at rest with AES-256-GCM before touching the database.
  • Database access restricted by Row Level Security and service-role keys that live only in backend environment variables.
  • Payments handled entirely by Stripe; we do not store card numbers.
  • Regular permission audits and periodic key rotation.

11. Retention

  • Active account: we keep your data while you use Riverz.
  • Cancelled account: we delete content and connections after 30 days unless the law requires us to keep it (billing: 5 years in Colombia).
  • Technical logs: 90 days.

12. Cookies

We use strictly necessary cookies to:

  • Keep you signed in (Clerk).
  • Remember your light/dark theme.
  • Measure anonymous app usage (Google Analytics).
  • Marketing attribution (Meta Pixel, only on public pages such as /).

You can block analytics cookies in your browser settings without affecting how the app works.

13. Minors

Riverz is not directed at people under 18 and we do not knowingly collect data from them. If we discover a minor’s account, we close it and delete its data.

14. Changes to this policy

If we change this policy we will notify you by email and/or a banner in the app at least 7 days before it takes effect. The current version will always live at riverzai.com/privacy.