Privacy Policy

Last updated: September 13, 2026

Riveta Labs operates the OneTracker homework management platform and related services, including the rivetalabs.com marketing website, the 10-Day Homework Sprint program, and the OneTracker SaaS subscription (collectively, the "Services"). The OneTracker application is hosted on Vercel and uses Supabase for database and authentication services. The rivetalabs.com marketing website is also hosted on Vercel. This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase or other transaction using the Services or otherwise communicate with us. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use, and disclosure of your information as described in this Privacy Policy.

Service Eligibility and Age Requirements

Our homework management service is designed exclusively for students in grades 6 through 12. Some students in these grade levels may be under 13 years of age. We comply with the Children's Online Privacy Protection Act (COPPA) as described in the "Children's Data and Student Privacy" section below.

By providing LMS credentials and student information, you represent and warrant that you are the parent or legal guardian of the student, or have written authorization from the legal guardian to access this information and enroll the student in our Services.

Personal Information We Collect or Process

When we use the term "personal information," we are referring to information that identifies or can reasonably be linked to you or another person. Personal information does not include information that is collected anonymously or that has been de-identified, so that it cannot identify or be reasonably linked to you. We may collect or process the following categories of personal information, including inferences drawn from this personal information, depending on how you interact with the Services, where you live, and as permitted or required by applicable law:

  • Contact details including your name, address, billing address, shipping address, phone number, and email address.
  • Financial information including credit card, debit card, and financial account numbers, payment card information, financial account information, transaction details, form of payment, payment confirmation and other payment details.
  • Account information including your username, password, security questions, preferences and settings.
  • Transaction information including the items you view, put in your cart, add to your wishlist, or purchase, return, exchange or cancel and your past transactions.
  • Communications with us including the information you include in communications with us, for example, when sending a customer support inquiry.
  • Device information including information about your device, browser, or network connection, your IP address, and other unique identifiers.
  • Usage information including information regarding your interaction with the Services, including how and when you interact with or navigate the Services.

Educational Data We Collect

When you use our homework management service, we collect and process educational data with your explicit authorization.

Learning Management System (LMS) Data: With your permission, we connect to your student's school Learning Management System (Canvas) to access:

  • Assignment names, descriptions, due dates, and availability windows (such as when an assignment locks)
  • Submission status, including whether work has been submitted, when it was submitted, and how many attempts were made
  • Assignment completion status as determined by the teacher, including whether an assignment is marked late, missing, or excused, and how late a submission was (used to help determine which overdue assignments need the most urgent attention)
  • Whether a teacher has requested that your student redo an assignment
  • Assignment format (for example, file upload, discussion post, or quiz)
  • Course names, teacher names, and semester or term dates
  • Course structure information, such as assignment categories (for example, "Homework" or "Tests") and how those categories are weighted in the course
  • How assignments are scored (for example, by points, pass/fail, or percentage)
  • Point values (used for prioritization only, not for grade calculation)

We collect this data to help you stay on top of your student's homework. Each type of data serves a specific purpose:

  • Submission timing and status flags let us tell you whether your student turned in their work and whether anything is overdue, so you do not have to check the school's system yourself.
  • Assignment categories and weights help us rank which assignments matter most, so the daily to-do list puts the highest-impact work first.
  • Assignment format and availability windows help us give you accurate guidance about what your student needs to do and when it must be done by.
  • Redo requests and attempt counts let us flag assignments that need your student's attention again, even after the original due date.
  • Term dates let us filter out completed semesters so your dashboard shows only current work.

Chrome Browser Extension: We offer an optional Chrome browser extension that syncs assignment data from your student's LMS to OneTracker. The extension only activates on LMS domains you configure and transmits data via encrypted API calls. The extension does not collect browsing history, keystrokes, or any data from websites other than the configured LMS domains.

We Do NOT Access:

  • Grades, scores, grade letters, GPA, or report cards
  • Private messages between students and teachers
  • Student social security numbers or government IDs
  • Medical, health, or disciplinary records
  • Standardized test scores
  • Financial aid or scholarship information
  • Medical, therapeutic, or disciplinary treatment records from schools
  • Student activity surveillance data such as page views, time spent on pages, or participation tracking

When we say we collect "assignment completion status including late, missing, or excused," we mean the status the teacher assigned to the homework. We do not access or store the reason an assignment was excused. We do not use these status flags for disciplinary purposes, behavioral profiling, or any purpose other than helping you track homework completion.

Student Information (Provided by You):

  • Student's first name
  • Grade level and enrolled courses
  • Your relationship to the student (parent, guardian, etc.)
  • Student birth year (year only), so we can apply age-based compliance rules without collecting a full date of birth

LMS Credentials:

  • API access token or login credentials (you provide these)
  • Your school's LMS domain URL

SMS Communications:

Our service sends SMS notifications to phone numbers you provide, including your student's phone number. When recipients reply to these messages, we log confirmation events (such as receiving a "START" or "DONE" response) with timestamps for service functionality and guarantee verification. The specific keywords that trigger confirmations are stored as event records. Conversational content beyond these trigger keywords is not permanently stored. Phone numbers and confirmation event logs are retained according to our data retention schedule.

This educational data is collected solely to provide the homework tracking and notification services you have requested.

Course pages and files

These capabilities require availability in OneTracker and the matching permission. The Chrome extension reads teacher Pages, announcements, syllabus text, module structure and course-file metadata; it does not download course-file bodies or follow external module links. Supported file-body processing uses a separately authorized server connection. Extension requests include a linked student identifier and course teacher names and emails where supplied by Canvas. The extension uses the Canvas session locally and does not send Canvas passwords or session cookies to Riveta.

With separate course-content permission, OneTracker can read teacher-owned course pages, announcements, syllabus text and supported course files to suggest homework. School and connection authorization are still required. Finding possible homework does not add or change an assignment. A parent reviews each suggestion, or separately permits future dated homework from an eligible Page. Undated homework needs a parent plan.

Raw source snapshots are restricted to the service. Parents see a limited review excerpt, work details and source links. An announcement snapshot is retained for 14 days from the time that snapshot is stored. Seeing the same snapshot again does not extend that period. Other source content is scheduled for deletion 90 days after the family's verified service end. Active, paused, trial or unknown family service is not treated as ended.

AI permission is separate. When eligible and separately authorized, Google Gemini may receive limited relevant source text if the standard extraction process found no homework. Announcements and photos do not enter Gemini content extraction. AI suggestions require parent review. Withdrawing AI permission does not withdraw permission for course-content processing that does not use AI.

Homework photos

Homework photos require separate permission. A parent confirms the task details and course before homework is added from an instructions photo. A finished-work photo records that a photo was received for the selected assignment. It does not submit work to school or prove that a teacher received it. Photos do not enter AI content extraction.

Image bytes upload to private Supabase Storage. OneTracker processes supported images on Vercel to create a viewable copy. Access is checked against current family permission. Upload links are temporary and sent through Twilio to the selected recipient. An authorized parent can view retained photos and request an original-image export through the authenticated application.

Retention runs from the original upload-slot admission, not from each retry. Failed or unfinished uploads are scheduled for cleanup after 24 hours. Unconfirmed instructions photos are retained for 7 days. Approved instructions photos and finished-work photos are retained for 30 days. Parent-entered task text can remain with the assignment after its image is deleted. External deletion uses a durable cleanup process, so a failed deletion is retried rather than treated as complete.

Your choices, export and deletion

An authorized parent can turn either purpose off in Settings, including when rollout is paused. Withdrawal revokes the applicable processing permission and clears pending source content. Photo withdrawal ends retained photo access immediately and retires unconfirmed instructions photos; confirmed images keep their scheduled retention. Turning permission on again does not restore revoked photo access. Existing approved assignments and minimal source records follow the assignment retention rules.

Family export includes limited source metadata, reviewable proposal details, decisions and assignment source records. It excludes raw source bodies, internal processing records, credentials and temporary upload tokens. Original photo bytes use the separate authenticated export flow.

Account deletion blocks processing and records required cleanup before external deletion begins. A student shared by multiple families must be resolved before account deletion can proceed.

Personal Information Sources

We may collect personal information from the following sources:

  • Directly from you including when you create an account, visit or use the Services, communicate with us, or otherwise provide us with your personal information.
  • Automatically through the Services including from your device when you use our products or services or visit our websites, and through the use of cookies and similar technologies.
  • From our service providers including when we engage them to enable certain technology and when they collect or process your personal information on our behalf.
  • From our partners or other third parties.

How We Use Your Personal Information

Depending on how you interact with us or which of the Services you use, we may use personal information for the following purposes:

  • Provide, Tailor, and Improve the Services. We use your personal information to provide you with the Services, including to perform our contract with you, to process your payments, to fulfill your orders, to remember your preferences and items you are interested in, to send notifications to you related to your account, to process purchases, returns, exchanges or other transactions, to create, maintain and otherwise manage your account, to arrange for shipping, to facilitate any returns and exchanges, to enable you to post reviews, and to create a customized shopping experience for you, such as recommending products related to your purchases. This may include using your personal information to better tailor and improve the Services.
  • Educational Services. We use your personal information to sync assignments from your student's Learning Management System, calculate priority scores to identify which assignments need attention first, send SMS and email notifications about homework tasks and deadlines, generate daily summaries, and track guarantee metrics. Specifically:
    • We use submission timing and status flags (late, missing, excused) to show you accurate homework completion status, so the information you see matches what the teacher sees.
    • We use assignment category weights to rank assignments by importance. A missing test in a heavily weighted category ranks higher than a missing worksheet in a lightly weighted category.
    • We use assignment format information to provide context about what your student needs to do (for example, "this is a discussion post" versus "this is a file upload").
    • We use redo requests and attempt counts to flag assignments that need your student's attention again, even after the original due date.
    • We use term dates and availability windows to show only current, active assignments and to identify the real submission deadline.
    We also track participation metrics including scheduled call attendance, response times to daily check-ins, and routine completion to verify guarantee eligibility as described in our Refund Policy.
  • AI-Assisted Services (Scout). We use an artificial intelligence assistant called Scout, built into our OneTracker platform, to help you manage homework operations. Scout can answer questions about assignments, analyze workload, suggest next actions, and support Quick Actions (like sending reminders to your teen). Scout processes your family's assignment data and OneTracker usage to provide this assistance. Key limitations: Scout does NOT auto-execute any action without your explicit approval. Scout does NOT provide tutoring, therapy, medical advice, or IEP/504 legal guidance. Scout does NOT guarantee grade improvements. Scout does NOT process or have access to diagnosis information, medical records, or IEP/504 documents. When Scout encounters complex situations, conversations are flagged for human review by our team. Scout is powered by Google Gemini, a third-party AI service that processes data according to Google's AI terms.
  • Marketing and Advertising. We use parent and guardian contact information and shopping behavior for marketing and promotional purposes, such as to send marketing, advertising and promotional communications by email, text message or postal mail, and to show you online advertisements for products or services on the Services or other websites. We use cookies and tracking pixels (such as Meta Pixel, Google Analytics 4, and Microsoft Clarity) to understand how visitors interact with our marketing website and to serve relevant advertisements. These tools run only on the rivetalabs.com marketing website. They are never present in the OneTracker application.
  • Security and Fraud Prevention. We use your personal information to authenticate your account, to provide a secure payment and shopping experience, detect, investigate or take action regarding possible fraudulent, illegal, unsafe, or malicious activity, protect public safety, and to secure our services. If you choose to use the Services and register an account, you are responsible for keeping your account credentials safe. We highly recommend that you do not share your username, password or other access details with anyone else.
  • Communicating with You. We use your personal information to provide you with customer support, to be responsive to you, to provide effective services to you and to maintain our business relationship with you.
  • Legal Reasons. We use your personal information to comply with applicable law or respond to valid legal process, including requests from law enforcement or government agencies, to investigate or participate in civil discovery, potential or actual litigation, or other adversarial legal proceedings, and to enforce or investigate potential violations of our terms or policies.

Student Data Usage Restrictions:

Student names, assignments, courses, grades, and all other educational data are NEVER used for:

  • Advertising or marketing purposes
  • Sale to third parties
  • Creating student profiles for commercial purposes
  • Sharing with colleges, employers, or other institutions
  • Sharing with advertising networks or data brokers
  • Behavioral targeting or profiling

Marketing and advertising activities use only parent/guardian contact information and shopping behavior. Student educational data is never shared with our advertising or analytics partners.

Subscription and Billing

OneTracker is offered as a monthly subscription at $149 per month. We also offer a 10-Day Homework Sprint program at $997, which includes one month of OneTracker SaaS access.

Auto-Renewal: Your OneTracker subscription automatically renews each billing cycle until you cancel. You will be charged the then-current subscription fee at the start of each renewal period. You may cancel your subscription at any time through your account settings or by contacting us at hello@rivetalabs.com. Cancellation takes effect at the end of your current billing period. Refunds are handled in accordance with our published Refund Policy.

Payment processing is handled by Stripe. When you subscribe, your payment information is transmitted directly to Stripe and is not stored on our servers. Please review Stripe's Privacy Policy for information about how they handle your payment data.

How We Disclose Personal Information

In certain circumstances, we may disclose your personal information to third parties for legitimate purposes subject to this Privacy Policy. Such circumstances may include:

  • With vendors and other third parties who perform services on our behalf (e.g. IT management, payment processing, data analytics, customer support, cloud storage, fulfillment and shipping).
  • OneTracker Application Subprocessors: The OneTracker SaaS platform uses the following service providers who process data on our behalf:
    • Supabase (database storage and authentication for student name, assignments, course data, and user accounts)
    • Stripe (payment processing for subscriptions and one-time purchases)
    • Twilio (SMS notifications using phone numbers and message content)
    • Resend (transactional email delivery)
    • Google Gemini (AI assistant processing for the Scout feature, using assignment and usage data)
    • Vercel (application hosting and serverless function execution)
    • Sentry (error monitoring and diagnostics for application reliability)
    These providers are bound by data processing agreements that require them to protect your data and use it only for the specific purposes we have engaged them for. These providers process your data only as necessary to perform their specific functions.
  • Marketing Website: The rivetalabs.com marketing website is hosted on Vercel. When you submit a form on the marketing website, such as a playbook request, your email address is processed by Resend, our email delivery provider, to deliver the material you requested. The marketing website has no separate storefront platform or storefront processor.
  • With analytics and advertising partners (such as Meta, Google, TikTok, and OpenAI) to understand website usage and serve relevant advertisements. These partners receive information about your browsing behavior on our marketing website but do NOT receive any student names, assignment data, course information, or other educational data. When you request a playbook or buy OneTracker, Meta, TikTok, and OpenAI each receive a one-way hash of your email, name, and phone number if you gave one, plus your IP address, browser details, a random visitor ID stored in a first-party cookie for 12 months, and any ad-click identifier their own code stored in your browser, so ads can be measured. When you buy, Meta also receives a one-way hash of your billing city, state, ZIP code, and country, and OpenAI receives those four billing fields as written. Our server makes those hashes, and when you submit a form on this site Meta's, TikTok's, and OpenAI's own code in your browser may make the same kind of hash of the email, name, and phone number you typed before anything is sent. Nothing readable leaves your browser or our server. We do not send these server-side events if your browser sends the Global Privacy Control signal or if you have used the opt-out control described in the "Your Rights and Choices" section below.
  • We use Microsoft Clarity to capture how visitors use and interact with our marketing website through behavioral metrics, heatmaps, and session replay, which helps us find and fix pages that confuse people. Usage data is captured using first and third party cookies and other tracking technologies and is used for site optimization and fraud and security purposes. Microsoft may also use this data as described in the Microsoft Privacy Statement. Microsoft Clarity runs only on the marketing website, never in the OneTracker application, and does not load if your browser sends the Global Privacy Control signal or if you have used the opt-out control described in the "Your Rights and Choices" section below.
  • When you direct, request us or otherwise consent to our disclosure of certain information to third parties, such as to ship you products or through your use of social media widgets or login integrations.
  • With our affiliates or otherwise within our corporate group.
  • In connection with a business transaction such as a merger or bankruptcy, to comply with any applicable legal obligations (including to respond to subpoenas, search warrants and similar requests), to enforce any applicable terms of service or policies, and to protect or defend the Services, our rights, and the rights of our users or others.

Depending on where you reside, you may have a right to direct us not to share information about you to show you targeted advertisements and marketing based on your online activity with different merchants and websites. You can exercise your rights to opt-out of those uses here.

We Do NOT Share Student or Educational Data With:

  • Advertising networks or data brokers
  • Social media platforms for advertising purposes
  • Schools, districts, or educational institutions (unless you request it)
  • Any third party for marketing or commercial purposes

Marketing Website Hosting

The rivetalabs.com marketing website is hosted on Vercel, the same provider that hosts the OneTracker SaaS application (your homework management dashboard). Supabase provides database and authentication services for the OneTracker application. The marketing website does not use Supabase and has no access to student or educational data.

Vercel also provides two first-party measurement tools that run on the marketing website: Vercel Web Analytics, which counts page views, and Vercel Speed Insights, which measures how quickly pages load. Neither tool uses third-party cookies, and neither receives your name, your email address, or any student or educational data. Vercel Web Analytics stores the page address including any query parameters, the website that referred you, your approximate location (country, region, and city), and your device type, operating system, and browser version. It distinguishes repeat page views within a single day using a temporary value derived from the incoming request, which Vercel discards after 24 hours. Vercel Speed Insights stores the page address, page loading measurements, your country, your network speed, and your device type, operating system, and browser version; Vercel states that it is not tied to or associated with any individual visitor or IP address. Both tools run only on the rivetalabs.com marketing website and are never present in the OneTracker application. Vercel documents the exact values each tool collects for Web Analytics and Speed Insights.

When you submit a form on the marketing website, your submission is delivered through Resend, our email delivery provider. Analytics and advertising tools that run on the marketing website are described in the "How We Disclose Personal Information" section above. You can opt out of advertising data sharing at any time using the controls described in the "Your Rights and Choices" section below.

Our free homework plan form also asks about your child's school level, the school portal, and your interest in paid homework help. We store these answers with your name, email, referral source, and latest submission date in Resend to assess whether OneTracker may fit your family. These answers and the resulting fit category are not included in our advertising event payloads. Requesting the plan does not sign you up for a drip email sequence.

Phone, postal code, and country are not required to get the free plan. On the form with a separate outreach choice, we store the phone number you provide and your choice in Resend. We also keep a record of the notice text, its version, the submission time and method, and the name, email, phone, and country submitted with that choice. This helps us track permission for follow-up. Postal code is not stored in the lead record.

If you check the outreach box and submit the form, Riveta Labs may call, text, or email you about OneTracker and paid homework help. This may include automated dialing and artificial, prerecorded, or AI-generated voices. You can get the free plan or buy without agreeing. Message frequency varies. Message and data rates may apply. You can withdraw consent at any time by replying STOP to texts or emailing hello@rivetalabs.com. Existing opt-outs still apply. Forms without this separate choice do not collect outreach permission or store phone numbers in the lead record.

When advertising data sharing is allowed, we normalize and hash supported contact details for pixel matching with our connected advertising platforms. Hashing is a matching safeguard, not anonymization. Outreach permission is separate from advertising data sharing. Your advertising privacy choices still apply, and we do not include outreach choices or consent records in our advertising event payloads.

Third Party Websites and Links

The Services may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness, or reliability of information found on these sites. Information you provide on public or semi-public venues, including information you share on third-party social networking platforms may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use by us or by a third party. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators, except as disclosed on the Services.

Children's Data and Student Privacy

Our homework management service is designed to help parents and guardians manage their children's homework for students in grades 6 through 12. Some students in these grades may be under 13 years of age.

COPPA Compliance

We comply with the Children's Online Privacy Protection Act (COPPA). We obtain verifiable parental consent before collecting any information related to children under 13 through the following mechanism:

  • All accounts must be created by a parent or legal guardian
  • Purchase completion and parent-completed in-product consent checkpoints serve as our verifiable parental consent flow under COPPA
  • Parents provide all student information directly; we do not collect information directly from children
  • Parents control all account settings and may review, modify, or delete their child's information at any time

Consent is collected separately for LMS access, automated SMS, and Scout AI. When our privacy terms materially change, we may require a parent to re-confirm year of birth and the current policy version before normal app access resumes.

How We Handle Student Data

  • All student accounts are created and controlled by the parent or guardian
  • Students cannot create accounts directly
  • Student account setup and LMS credentials are provided by the parent or guardian
  • Students may interact directly with the service through SMS confirmations (texting keywords like "START") and dashboard login; these interactions occur under parental authorization
  • SMS notifications are sent to phone numbers provided by the parent
  • Parents may request deletion of their child's data at any time

As of the Effective Date of this Privacy Policy, we do not have actual knowledge that we "share" or "sell" (as those terms are defined in applicable law) personal information of individuals under 16 years of age.

FERPA Compliance Notice

Riveta Labs operates as a parent-authorized service provider, not as a "school official" under the Family Educational Rights and Privacy Act (FERPA). We access Learning Management System data using parent-provided credentials, acting on the parent's behalf. Key points:

  • Parents have the right under FERPA to access their child's educational records
  • Parents may authorize third parties (like Riveta Labs) to access this data on their behalf
  • We do not have direct agreements with schools or school districts
  • We do not access school systems without explicit parent authorization

If you have questions about FERPA compliance or your rights regarding your child's educational records, please consult with your school district.

State Student Privacy Laws

We comply with applicable state student privacy laws including California's Student Online Personal Information Protection Act (SOPIPA) and similar state laws. We do not use student data to build advertising profiles, engage in targeted advertising to students, or sell student information.

Data Retention

How long we retain your personal information depends on different factors, such as whether we need the information to maintain your account, to provide you with Services, comply with legal obligations, resolve disputes or enforce other applicable contracts and policies.

Retention Periods for Educational Data:

  • Active account data: Duration of service relationship
  • Assignment history (including submission timestamps, completion status flags, assignment format, redo requests, and attempt counts): Duration of active subscription plus 90 days
  • Course structure data (assignment categories, weights, grading format, term dates): Duration of active subscription plus 90 days
  • SMS notification logs (delivery status, phone numbers, and confirmation events): Duration of active service relationship plus 12 months
  • Sync operation logs (internal records of when data was synced and any errors): Duration of active subscription plus 90 days
  • Progress reports and certificates: 1 year
  • Payment records: 7 years (legal requirement)

LMS Access Termination:

If LMS access is revoked, expires, or credentials are changed, we retain previously synced assignment data according to the retention periods above. No new data is collected once access is terminated.

After these periods, data will be deleted from our systems upon request. To request deletion, email hello@rivetalabs.com with subject line "Data Deletion Request".

Consent for Educational Data Access

By creating an account, completing a purchase, and checking the data authorization checkbox during signup, you provide explicit consent for Riveta Labs to:

  • Access your student's Learning Management System using the credentials you provide
  • Collect and process assignment data, including names, descriptions, due dates, availability windows, point values, assignment format, attempt counts, and redo requests
  • Collect and process submission data, including whether and when your student submitted assignments
  • Collect and process teacher-assigned completion status, including whether assignments are marked late, missing, or excused
  • Collect and process course structure data, including course names, teacher names, term dates, assignment categories, category weights, and grading format
  • Send SMS notifications to the phone numbers you provide, including your student's phone number
  • Process any replies to SMS notifications for service functionality
  • Share data with our service providers as described in this policy
  • Retain data according to the retention periods specified above

You May Withdraw Consent at Any Time By:

  • Revoking your LMS API token through your school's LMS settings
  • Requesting account deletion by emailing hello@rivetalabs.com
  • Disabling SMS notifications through your account settings
  • Revoking Scout AI consent in your account settings

Withdrawal of consent will result in termination of homework tracking services but will not affect the lawfulness of processing performed before withdrawal.

Security of Your Information

We implement security measures to protect your personal information, including:

  • Encryption of data in transit (HTTPS/TLS)
  • Encryption of sensitive credentials at rest (AES-256)
  • Secure password hashing
  • Access controls limiting who can view production data
  • Row-level security policies isolating family data at the database level
  • Regular security reviews

Please be aware that no security measures are perfect or impenetrable, and we cannot guarantee "perfect security." In addition, any information you send to us may not be secure while in transit. We recommend that you do not use unsecure channels to communicate sensitive or confidential information to us.

Data Breach Notification

If we discover a security breach affecting your personal information or your student's educational data, we will notify you within 72 hours via the email address associated with your account. Our notification will describe: (1) what data was affected, (2) what steps we are taking to address the breach, and (3) steps you can take to protect yourself and your student. If required by applicable law, we will also notify relevant regulatory authorities.

Your Rights and Choices

Depending on where you live, you may have some or all of the rights listed below in relation to your personal information. However, these rights are not absolute, may apply only in certain circumstances and, in certain cases, we may decline your request as permitted by law.

  • Right to Access / Know. You may have a right to request access to personal information that we hold about you, including information about your student.
  • Right to Delete. You may have a right to request that we delete personal information we maintain about you and your student.
  • Right to Correct. You may have a right to request that we correct inaccurate personal information we maintain about you.
  • Right of Portability. You may have a right to receive a copy of the personal information we hold about you and to request that we transfer it to a third party, in certain circumstances and with certain exceptions.
  • Right to Opt out of Sale or Sharing for Targeted Advertising. Depending on where you reside, you may have a right to opt out of the "sale" or "share" of your personal information or to opt out of the processing of your personal information for purposes considered to be "targeted advertising", as defined in applicable privacy laws. You can exercise your rights to opt-out of those uses here. The opt-out control on that page sets a flag stored locally in your browser. While the flag is set, advertising pixels and Microsoft Clarity do not load and no server-side conversion events are sent for your form submissions, and Google Analytics runs with its advertising features disabled. The flag applies to the device and browser where you set it, so you will need to set it again if you clear your browser data or use a different browser or device. If you visit our website with the Global Privacy Control opt-out preference signal enabled, we automatically treat this as a request to opt out for the device and browser that you use to visit the website, with the same effect as the on-page control. To learn more about Global Privacy Control, you can visit https://globalprivacycontrol.org/. Other than the Global Privacy Control, we do not recognize other "Do Not Track" signals that may be sent from your web browser or device.
  • Managing Communication Preferences. We may send you promotional emails, and you may opt out of receiving these at any time by using the unsubscribe option displayed in our emails to you. If you opt out, we may still send you non-promotional emails, such as those about your account or orders that you have made.
  • Parental Rights Under COPPA. If your student is under 13, you have the right to review the personal information we have collected about your child, request deletion of that information, and refuse to permit further collection. To exercise these rights, contact us at hello@rivetalabs.com.

You may exercise any of these rights where indicated on the Services or by contacting us using the contact details provided below.

We will not discriminate against you for exercising any of these rights. We may need to verify your identity before we can process your requests, as permitted or required under applicable law. In accordance with applicable laws, you may designate an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require that the agent provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us. We will respond to your request in a timely manner as required under applicable law.

California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

  • Right to know what personal information we collect and how it is used
  • Right to delete personal information
  • Right to opt out of sale of personal information (we do not sell personal information)
  • Right to non-discrimination for exercising your rights

To exercise your rights, contact us at hello@rivetalabs.com.

Complaints

If you have complaints about how we process your personal information, please contact us using the contact details provided below. Depending on where you live, you may have the right to appeal our decision by contacting us using the contact details set out below, or lodge your complaint with your local data protection authority.

International Transfers

Please note that we may transfer, store and process your personal information outside the country you live in.

If we transfer your personal information out of the European Economic Area or the United Kingdom, we will rely on recognized transfer mechanisms like the European Commission's Standard Contractual Clauses, or any equivalent contracts issued by the relevant competent authority of the UK, as relevant, unless the data transfer is to a country that has been determined to provide an adequate level of protection.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on this website, update the "Last updated" date and provide notice as required by applicable law.

Contact

Should you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of the rights available to you, please call us at (520) 250-0864, email us at hello@rivetalabs.com, or write to us at Riveta Labs, 3301 East Ray Road, Apt 3039, Gilbert, AZ 85296, US

Machine-Readability & AI Context

To ensure accuracy in automated retrieval, indexing, and AI-generated summaries of Riveta Labs' data handling and service structure, we maintain a designated endpoint for automated agents. Please adhere to the protocols defined in our System Context & Source of Truth.