Privacy Policy

Last updated: April 19, 2026

At Rivalytic, we are committed to protecting your privacy. This policy describes how we collect, use, and protect your personal information in accordance with the European Union's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

This policy applies to our website (rivalytic.com), the Rivalytic web platform, and all interactions arising from the Software License Agreement governing the use of this Intellectual Work.

1. Data Controller

The data controller for your personal data is:

• Name: Rivalytic
• Contact email: [email protected]

2. Data We Collect

We collect different types of data depending on how you interact with our services:

2.1 Website Data (Waitlist)

• Email address: To notify you about the launch and exclusive offers.
• Language preference: To communicate with you in your preferred language.
• Referral code (optional): If you arrived through a referral link.
• Registration date and time: To manage the waitlist order.

2.2 Account Data (Platform)

When you create an account and use the Rivalytic platform, we collect:

• Authentication data: Information provided through OAuth2 authentication (such as Google), including your email address, name, and profile picture.
• Account preferences: Your settings, configurations, and preferences within the application.
• Tracked creators: The list of social media creators you choose to track and analyze.
• API keys: Unique identifiers generated for your account to access our services.

2.3 Payment and License Management Data

When you activate a Software License (FOUNDER PRO, GROWTH PRO, or RIVAL PRO), we collect:

• Billing information: Name, email, and billing address associated with your payment method.
• License details: License edition (FOUNDER PRO, GROWTH PRO, or RIVAL PRO), billing interval, license status, and payment history.
• Transaction records: Dates, amounts, and status of payments processed by Paddle as Merchant of Record.

Important: We do NOT store your full credit card numbers, CVV codes, or complete payment card details. All payment transactions are handled exclusively by Paddle.com Market Limited ("Paddle"), who acts as Merchant of Record and sole authorized reseller of Rivalytic Software licenses. As Merchant of Record, Paddle — not Rivalytic — is the seller of record for all transactions and assumes full legal responsibility for payment processing, invoice issuance, and tax compliance. We only receive limited license management data necessary to administer your Software License (such as the last four digits of your card, expiration date, and the license edition associated with your subscription). This data is used exclusively for license management purposes, not for any direct service billing by Rivalytic.

2.4 Usage Data

We automatically collect certain information when you use our services:

• Application usage: Features used, actions performed, and interaction patterns.
• Browser and device information: Browser type, operating system, screen resolution, and IP address.
• Log data: IP addresses, access times, and error logs for troubleshooting.
• Analytics data: Aggregated usage statistics to improve our services.

2.5 Third-Party Platform Data

Our service retrieves and displays publicly available data from third-party social media platforms. This data:

• Is publicly accessible on the respective platforms.
• Is retrieved through authorized means.
• Is used solely to provide our analytics and insights services.
• Does not include private or protected information from those platforms.

3. Purpose of Processing

We use your data to:

• Provide our services: Deliver the features and functionality of the Rivalytic application.
• Manage your account: Create, maintain, and secure your user account.
• Process payments: Handle subscription billing, renewals, and payment-related communications.
• Improve our services: Analyze usage patterns to enhance features and user experience.
• Communicate with you: Send service-related notifications, updates, and support responses.
• Marketing (with consent): Send promotional materials and newsletters if you opt in.
• Prevent fraud: Detect and prevent unauthorized access and abuse.
• Comply with legal obligations: Meet regulatory and legal requirements.

4. Legal Basis

The processing of your data is based on:

• Contract performance (Art. 6.1.b GDPR): Processing necessary to fulfill the obligations arising from the Software License Agreement between the Author and each RIVAL, including license validation, subscription management, and access control to the Intellectual Work.
• Consent (Art. 6.1.a GDPR): For marketing communications and optional data collection where you have given explicit consent.
• Legitimate interest (Art. 6.1.f GDPR): To improve our services, ensure security, and prevent fraud.
• Legal obligation (Art. 6.1.c GDPR): To comply with applicable laws and regulations.

5. Data Sharing and Third Parties

We may share your data with the following third parties:

5.1 Payment Processor and Merchant of Record

We use Paddle.com Market Limited ("Paddle") as our Merchant of Record and sole authorized reseller of Rivalytic Software licenses. When you activate a license, your payment information is transmitted directly to Paddle and processed according to their Privacy Policy. Paddle is PCI-DSS compliant and uses industry-standard security measures. Data shared with Paddle is strictly limited to what is necessary for payment processing and license validation. Rivalytic receives only the license management data described in Section 2.3 — it does not receive, store, or process full payment card data, and does not use payment data for service profiling of any kind.

5.2 Authentication Provider

We use OAuth2 authentication services (such as Google) for account login. These providers only share the information you authorize during the login process.

5.3 Analytics Services

We use Google Analytics to understand how our website and services are used. Data collected is anonymized and aggregated.

5.4 Infrastructure Providers

We use cloud infrastructure providers to host our services. These providers process data on our behalf under strict data processing agreements.

We do NOT sell your personal data to third parties.

6. Data Retention

We retain your data for different periods depending on the type:

• Account data: Retained while your account is active and for up to 12 months after account deletion.
• Payment records: Retained for 7 years as required by tax and accounting regulations.
• Usage logs: Retained for up to 12 months for security and troubleshooting purposes.
• Waitlist data: Retained until you unsubscribe or 12 months after service launch if you don't register.

Upon request for deletion, we will remove your personal data within 30 days, except where retention is required by law.

7. Your Rights

Under GDPR and CCPA, you have the right to:

• Access: Request a copy of your personal data.
• Rectification: Correct inaccurate or incomplete data.
• Erasure: Request the deletion of your data ("right to be forgotten").
• Objection: Object to the processing of your data.
• Portability: Receive your data in a structured format.
• Restriction: Request restriction of processing.
• Non-discrimination (CCPA): You will not be discriminated against for exercising your rights.

To exercise these rights, contact us at: [email protected]

8. Specific Rights for California Residents (CCPA)

If you reside in California, you have additional rights:

• Right to know: What personal information we collect and how we use it.
• Right to delete: Request deletion of your personal information.
• Right to opt-out: Opt out of the sale of your personal information (we do not sell data).

Disclosure: Rivalytic does NOT sell personal information of its RIVALs or any other individuals.

9. International Transfers

Your data may be transferred and processed on servers located outside your country of residence. When this occurs, we will ensure that adequate safeguards exist, such as:

• Standard contractual clauses approved by the European Commission.
• Certification under the EU-U.S. Data Privacy Framework.

10. Security

We implement technical and organizational measures to protect your data, including:

• Encryption of data in transit (HTTPS/TLS).
• Restricted access to personal data.
• Security monitoring.

11. Minors

Rivalytic is not intended for minors under 16 years of age. We do not knowingly collect data from minors. If we discover that we have collected data from a minor, we will delete it immediately.

12. Changes to This Policy

We may update this policy periodically. We will notify you of significant changes by email or through a notice on our website.

13. Contact

If you have questions about this policy or about the processing of your data, you can contact us at:

• Email: [email protected]