Privacy Policy

1. Scope and who we are

This Privacy Policy describes how RYVA LLC, a California limited liability company ("RYVA," "we," or "us"), collects, uses, and shares personal information when you visit our websites, use the RYVA spend authorization and control platform, including our web and mobile applications (the "Platform"), or interact with us in sales, support, or marketing.

RYVA is a business-to-business service. Our customers are organizations ("Customers"), and the individuals who use the Platform do so as employees, contractors, or authorized representatives of a Customer ("Users"). This Policy covers personal information about Users, prospective customers, website visitors, and other business contacts.

Card accounts, cards, and related banking services available through the Platform are provided by third-party banking-as-a-service providers and their sponsor banks ("Financial Partners"). Each Financial Partner has its own privacy policy that governs the information it collects and holds. Where this Policy and a Financial Partner's policy both apply, each governs its own party's handling of information.

This Policy does not cover personal information that a Customer uploads to or generates in the Platform about its own vendors, tenants, residents, or other third parties ("Customer Data"). RYVA processes Customer Data as a service provider on the Customer's behalf; see Section 9.

2. Information we collect

2.1 Information you or your organization provide.

• Account and profile information: name, work email, phone number, job title, role in the Platform, and the Customer and Entities you are associated with
• Organization information: legal name, address, and business type. Tax identification numbers, beneficial owner details, and verification documents are collected directly by the Financial Partner through its hosted onboarding component and are governed by its privacy policy. RYVA receives verification status and related account information from the Financial Partner
• Billing information: bank account details for the Customer's Billing Account, which are collected through the Financial Partner's hosted component and are not stored in full by RYVA
• Spend authorization data: Entity, expense category, amount, purpose, requester, approver, and timestamps for each authorization request
• Receipts and supporting documents, including any personal information they contain
• Communications with us: support requests, sales and demo inquiries (including company, role, portfolio size, tools used, and estimated annual spend), survey responses, and feedback

2.2 Information we receive from Financial Partners. When a Customer uses cards or banking services through the Platform, the Financial Partner sends us transaction data (merchant name, amount, date, category codes, authorization and settlement status), card status, and account status, so we can match transactions to authorizations and display them in the Platform. Full card numbers and card security codes are held by the Financial Partner and displayed, where at all, through Financial Partner-hosted components.

2.3 Information collected automatically. When you use our websites or the Platform we collect device and usage information: IP address, browser and operating system, device identifiers, pages viewed, referring URLs and campaign parameters, features used, timestamps, and error logs. We collect this through server logs, cookies, and similar technologies described in Section 6.

2.4 Information from other sources. We may receive business contact information from Customers (for example, when an administrator adds you as a User), from identity verification and fraud prevention providers, from accounting and other integrations a Customer connects, and from publicly available business directories.

3. How we use information

We use personal information to:

• Provide, operate, and maintain the Platform, including creating accounts, enforcing spend controls, matching transactions to authorizations, and generating reports
• Transmit authorization instructions and related data to Financial Partners so cards can be enabled and disabled
• Support Financial Partner identity verification, onboarding, and compliance requirements for Customers, their owners, and Users
• Bill Customers and collect fees
• Provide customer support and respond to inquiries
• Detect, investigate, and prevent fraud, misuse, security incidents, and violations of our Terms of Service
• Comply with legal obligations, including anti-money laundering, sanctions, and record retention requirements
• Improve and develop the Platform, including training and evaluating the automated features described in Section 5, using de-identified or aggregated data where practicable
• Send administrative messages about the Platform, such as authorization requests, approvals, security alerts, and changes to our terms
• Send marketing communications about RYVA products to business contacts, which you can opt out of at any time
• Enforce our agreements and protect the rights, property, and safety of RYVA, our Customers, and others

We do not use personal information to make automated decisions that produce legal or similarly significant effects about individuals. Spend authorization decisions are made by the Customer's own approvers under rules the Customer configures.

4. How we share information

We share personal information with:

• Financial Partners. To deliver card and banking services, we share Customer, Entity, owner, and User information (including contact details), authorization and transaction data, and information about risk events such as suspected fraud, non-payment, or account suspension. Financial Partners use this information under their own privacy policies and agreements with the Customer, and may contact Users directly about the services they provide.
• Your Customer. Administrators and approvers within your Customer can see your profile, role, authorization requests, transactions, and receipts, as needed to manage the organization's spend.
• Service providers. Vendors that host our infrastructure, handle website forms, send email and SMS, provide identity verification and fraud screening, process receipts (including AI service providers in the United States that parse receipt text), provide analytics, and support our operations. They may use personal information only to provide services to us.
• Integrations you or your Customer enable. Accounting systems and other third-party services connected to the Platform receive the data needed for that integration.
• Professional advisors. Lawyers, auditors, accountants, and insurers, under confidentiality obligations.
• Legal and safety. Regulators, law enforcement, courts, and other parties when required by law, subpoena, or legal process, or when we believe disclosure is necessary to protect rights, safety, or property, or to enforce our terms.
• Corporate transactions. A buyer, successor, or investor in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality terms.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. When we disclose information to Financial Partners, we do so because the Customer and its Users direct us to by applying for and using Financial Services through the Platform, and we do not receive payment for personal information. We may share aggregated or de-identified information that does not identify any individual or Customer.

5. AI-assisted features

The Platform uses automated processing to read receipts. When a User uploads a receipt image or PDF, optical character recognition (OCR) software extracts its text, and an AI language model parses that text into structured fields such as merchant name, date, address, and total. The results are attached to the related authorization record. This feature processes receipt content, including any personal information a receipt contains.

Extracted fields may contain errors, and Users can review and correct them. Receipt extraction does not make approval, categorization, or fraud decisions, and it does not make decisions with legal or similarly significant effects on individuals. A Customer's designated approvers remain responsible for every control decision.

We are developing additional automated features, such as spend anomaly detection, fraud and misuse alerts, and approval routing suggestions. These are not live today. Before any of them processes personal information, we will update this Policy to describe it.

We may use de-identified or aggregated data derived from Platform use to improve these features. We do not use Customer Data to train models that are made available to other customers in a way that could reveal that Customer's information. Receipt text is parsed by an AI service provider located in the United States, under a contract that limits its use of the data to providing that service to RYVA.

6. Cookies, analytics, and tracking

We use cookies and similar technologies on our websites and in the Platform. Our Cookie Policy lists each one and lets you manage your preferences. In summary:

• Strictly necessary: session and security tokens, your consent preference, Sentry error monitoring on our websites (configured not to collect IP addresses or form data), and Google Fonts
• Analytics (websites only, with your consent): Google Analytics and PostHog, used to understand how visitors find and use our websites in aggregate
• Performance (websites only, with your consent): PostHog session replay with all inputs masked, used to diagnose errors and improve our websites
• Marketing: none. We do not use advertising cookies, retargeting, or third-party ad pixels

Analytics and performance tools run only on our websites, and only if you accept them. The Platform uses only strictly necessary cookies. You can change your choice at any time through the cookie preferences control on our websites or through your browser settings. Blocking strictly necessary cookies may prevent the Platform from working. We do not respond to "Do Not Track" signals because there is no common standard.

7. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, role-based access controls, and logging and monitoring. Full card numbers and sensitive authentication data are held by Financial Partners rather than RYVA. No system is completely secure, and we cannot guarantee the security of information. If we confirm a security incident affecting your personal information, we will notify affected Customers and individuals as required by law and by our agreements.

8. Retention

We keep personal information for as long as needed to provide the Platform, meet legal and regulatory obligations, resolve disputes, and enforce our agreements. In general:

• Account and profile information: for the life of the Customer relationship and 30 days after termination, so the Customer can export its data
• Authorization records, transaction records, and audit logs: seven years after the transaction, to meet financial record-keeping and Financial Partner requirements
• Verification status and compliance records we receive: as required by law and by Financial Partners, typically five years after the relationship ends
• Support and sales communications: three years, except demo and sales inquiries that do not lead to a customer relationship, which are deleted or de-identified after 24 months
• Website analytics: up to 24 months, then deleted or aggregated

When retention is no longer needed we delete or de-identify the information.

9. Our role as service provider for Customer Data

RYVA acts in two roles:

• As a business for information about website visitors, prospects, and business contacts, and for User account and profile, billing, usage, and security information we collect for our own purposes. Sections 2 through 8 and Section 10 describe how we handle that information.
• As a service provider for Customer Data, meaning personal information a Customer uploads to or generates in the Platform, including authorization and transaction records, receipts, and information about its vendors, tenants, residents, property owners, and other third parties. User account and profile, billing, usage, and security information is handled by RYVA as a business, as described above. We process Customer Data only on the Customer's instructions and as needed to provide the Platform, comply with law, and as permitted by our Terms of Service and any data processing addendum with that Customer.

If you are a User and want to access, correct, or delete information held in your Customer's Organization, contact your Customer's administrator. We will assist Customers in responding to those requests. If we receive a request directly from an individual about Customer Data, we will refer it to the relevant Customer. For account and profile information RYVA holds as a business, you can make a request to us directly under Section 10.

10. California and other state privacy rights

If you are a California resident, the California Consumer Privacy Act (CCPA) gives you the following rights regarding personal information RYVA holds as a business:

• Know and access: what categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties we share it with
• Delete: subject to exceptions, including where we must retain information to complete a transaction, comply with law, or maintain financial records
• Correct: inaccurate personal information
• Opt out of sale or sharing: we do not sell personal information or share it for cross-context behavioral advertising
• Limit use of sensitive personal information: RYVA does not collect government identifiers, and bank account details are collected by Financial Partners through hosted components. To the extent we receive any sensitive personal information, we use it only for the purposes permitted by CCPA, so no separate limitation right applies
• Non-discrimination: we will not treat you differently for exercising these rights

Categories collected in the last 12 months. Identifiers (name, email, phone, IP address); business and professional information (employer, title, role); commercial information (authorization and transaction records); financial information (Billing Account details, collected through a hosted component); and internet and device activity. Sources, purposes, and recipients are described in Sections 2 through 4.

How to submit a request. Email support@ryvapay.com or write to RYVA LLC, 43 Malaga Cove Plaza, Suite A, Palos Verdes Estates, CA 90274, Attn: Privacy. We will verify your identity using information associated with your account and may ask for additional information. You may designate an authorized agent to make a request on your behalf, with written authorization. We will confirm receipt within 10 business days and respond within 45 days, extendable once by 45 days with notice.

Other states. Residents of other states with comprehensive privacy laws may have similar rights. The same request process applies. Where a state law provides a right to appeal a denied request, you may appeal by replying to our response, and we will respond within the time that law requires.

11. Children, international users, changes, and contact

Children. The Platform is for business use by adults. We do not knowingly collect personal information from anyone under 18. If you believe we have, contact us and we will delete it.

International users. RYVA is based in the United States and serves U.S. organizations. The Platform is not offered to organizations outside the United States, and personal information is processed and stored in the United States. If you access our websites or the Platform from outside the United States, you understand that your information will be transferred to and processed in the United States.

Changes. We may update this Policy. We will post the updated version with a new effective date and, for material changes, notify Customers by email or in the Platform at least 30 days before the change takes effect.

Contact. Questions or requests: support@ryvapay.com, or RYVA LLC, 43 Malaga Cove Plaza, Suite A, Palos Verdes Estates, CA 90274, Attn: Privacy.