Rivvena Privacy Policy

Effective date: November 4, 2026

1. Introduction and our roles

Rivvena, Inc. ("Rivvena," "we," "us" or "our") provides an operational intelligence platform for restaurants and restaurant groups. This Privacy Policy explains how we collect, use, disclose and protect personal information in connection with:

• our website at rivvena.com and any related pages (the "Site");
• our cloud-based operational intelligence platform, including reports, forecasts, digests, and task and accountability tools, and related services (the "Services"); and
• our marketing, sales and demo activities, and other interactions with you.

Rivvena is a Delaware corporation.

Our two roles

When we act as a controller. We decide how and why personal information is processed for our own business purposes. This includes information about Site visitors, prospective customers, people who book demos, and the people who hold accounts on or receive digests from the Services. This Privacy Policy governs that information.

When we act as a service provider or processor. Our customers are restaurant businesses. They connect the third-party systems and software they use to run their restaurants to the Services and enter information through the Services. That information may include personal information about their employees and guests ("Customer Data"). We process Customer Data on behalf of, and under the instructions of, the customer, as set out in our agreement with that customer. The customer controls its own privacy practices for Customer Data. Section 3 describes this processing, and Section 8 explains how to make a request about Customer Data.

The Services are intended for business use. We do not offer the Services to consumers.

2. Information we collect as a controller

Information you provide to us

• Contact and demo requests. When you contact us, book a demo or call, or join our design partner program, we collect your name, business email, phone number, company and restaurant name, role, number of locations, and anything else you choose to share. We use a third-party scheduling service to book demos. That service collects the information you enter and shares it with us.
• Account information. When you or your organization sets up an account on the Services, we collect your name, business email address, role, the locations you can access, and your login credentials or other authentication data.
• Communications. We collect the content of emails, support requests, feedback and other communications you send us. With your consent, we may record and transcribe calls and demos, and we will tell you at the start of a call when recording is on.
• Billing information. We collect billing contact details and subscription information. We do not collect or store full payment card numbers. Our payment processor collects payment details directly and handles them under its own privacy policy.

Information collected automatically

• Site usage information. When you visit the Site, we and our service providers collect your IP address, browser type, device information, referring URL, pages viewed, and dates and times of visits. See Section 6.
• Platform usage information. When you use the Services, we collect access logs, login times, IP address, device and browser information, and your activity in the Services, such as the pages and features you use and the tasks you update.
• Digest engagement information. We send digests and other service emails to recipient lists that our customers configure. These emails include tracking technologies that tell us whether an email was delivered and opened and which links were clicked.

Information from other sources

We may receive business contact information about prospective customers from referrals, events, commercial data and contact-enrichment providers, and public sources such as company websites and professional networking profiles.

3. Customer Data we process on behalf of our customers

Our customers connect their systems to the Services and enter information into the Services. Depending on the customer's configuration, Customer Data may include the following.

We use Customer Data to provide the Services to the customer. This includes calculating operating metrics, generating digests and reports, and creating and tracking tasks. We process Customer Data under our agreement with the customer, including our Data Processing Addendum. We do not sell or share Customer Data, and we do not use personal information in Customer Data for our own marketing. We may create aggregated or de-identified data from Customer Data as described in Section 4.

What the Services do not do. Rivvena does not process payments. It is not a payroll processor or an employer of record. We do not receive or store payment card data or bank account numbers. The Services provide operational analysis and workflow tools. The Services may recommend staffing levels and operational actions by role. Rivvena does not identify individual employees in its findings or tasks, and does not make or recommend employment, scheduling, disciplinary or compensation decisions about any specific individual. Those decisions remain with our customers.

Customer responsibilities. Our customers are responsible for providing any notices and obtaining any consents required to share Customer Data with us. Customers agree not to submit Social Security numbers, dates of birth, home addresses, government identifiers, health or medical information, or other sensitive personal information through the Services, including in free-text notes. We also configure our integrations to exclude these categories from the data we import.

Employees and guests of our customers. If you work at or dined at a restaurant that uses Rivvena, the restaurant's own privacy practices govern your information. Please direct questions or requests to that restaurant. If we receive a request directly, we will refer it to the relevant customer and assist the customer as our agreement requires.

4. How we use information

We use the information we collect as a controller to:

• provide, operate and maintain the Site and the Services, including authenticating users and delivering digests;
• respond to inquiries, schedule demos, and administer our design partner program;
• provide customer support and send service-related communications, such as account, security and billing notices;
• monitor and improve the Site and the Services, including measuring digest delivery and engagement;
• send marketing communications about Rivvena to business contacts, subject to your right to opt out;
• protect the security and integrity of the Site and the Services, and detect and prevent fraud and misuse;
• comply with legal obligations and enforce our agreements; and
• carry out other purposes we describe to you when we collect the information.

AI-generated narratives

The Services use a third-party large language model to turn computed metrics into a plain-language digest. To do this, we send the model provider a structured summary of operating results, which may include manager notes. Metrics are calculated by our own systems, not by the model. The model generates narrative summaries and may help prioritize and explain findings. Our agreement with the model provider prohibits it from using this data to train its models. The provider processes the data on our behalf.

Aggregated and de-identified data

We may create aggregated or de-identified data from the information we process, including Customer Data. Such data does not identify, and cannot reasonably be linked to, any customer, restaurant location, employee, guest or other individual. We use it to test, train and improve the Services' algorithms, models and analytics features; to develop historical, statistical and benchmarking insights across our customer base, using only data combined from enough customers and locations that no single customer or location can be identified; and to develop and improve the Services. We maintain such data in de-identified form. We do not attempt to re-identify it, and we contractually prohibit recipients from doing so. Our customer agreements permit this use, and it may continue after a customer's agreement ends.

5. How we disclose information

We disclose personal information only as described below.

• Service providers and subprocessors. We use vendors that process information on our behalf. These include providers of cloud hosting and database infrastructure, AI language models, email delivery, email and productivity software, demo scheduling, meeting recording and transcription, contact data enrichment, website hosting and analytics, payment processing, and weather data. They may use the information only to provide services to us and are bound by confidentiality and data protection obligations. Customers may request a list of our current subprocessors by contacting us.
• Integrations a customer chooses. When a customer connects a third-party system, we exchange data with that system at the customer's direction. The customer's agreement with that provider governs the provider's practices.
• Within a customer's organization. Digests, reports and tasks are delivered to the users and recipients the customer designates. Information about a location is visible to users with access to that location, and to group-level users the customer authorizes.
• Legal and safety. We may disclose information to comply with law, regulation, legal process or a governmental request; to enforce our agreements; or to protect the rights, property or safety of Rivvena, our customers or others.
• Business transfers. We may disclose information in connection with a merger, acquisition, financing, reorganization, sale of assets or bankruptcy, or in the diligence for any of these. Any successor will be bound by commitments at least as protective as those in this Privacy Policy for the information transferred.
• With your direction or consent. We may disclose information when you ask us to or agree that we may.

No sale or sharing. We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

6. Cookies, analytics and email tracking

Site. We and our service providers use cookies and similar technologies on the Site. They help the Site function and let us understand how visitors use it. Our website platform provides privacy-friendly analytics that measure aggregate page views and traffic sources. We do not use Google Analytics, advertising cookies or advertising pixels. You can control cookies through your browser settings. If you block certain cookies, parts of the Site may not work as intended.

Services. The Services use cookies and local storage that are needed for login, security and session management. These are required for the Services to work.

Email. Our digests and other emails contain tracking pixels and tracked links. These tell us whether an email was delivered and opened and which links were clicked. Customers can see aggregate engagement information for their locations. We use it to confirm delivery, measure whether digests are useful, and improve the Services. You can usually limit open tracking by turning off automatic image loading in your email client.

Do Not Track. The Site does not respond to Do Not Track signals.

7. Retention, security and data location

Retention. We keep personal information for as long as we need it for the purposes in this Privacy Policy, unless the law requires or permits a longer period.

• Customer Data: kept for the term of the customer's agreement. After the agreement ends, the customer may retrieve its data for 60 days. We then delete it, except for aggregated or de-identified data described in Section 4. Deleted data may remain in backups until they are overwritten as described below.
• Account and usage information: kept while the account is active and for 12 months afterward. Longer retention applies only where needed for security, legal or record-keeping purposes.
• Prospect and marketing information: kept until you ask us to delete it or opt out, or until it is no longer relevant, and in any case no longer than three years after our last contact.
• Backups and logs: may persist for up to 35 days until overwritten in the normal course.

Security. We use administrative, technical and physical safeguards designed to protect personal information. These include access controls, encryption of data in transit, encryption at rest, logical separation of each customer's data, and confidentiality obligations for our personnel. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Data location. Rivvena is based in the United States. We store information in the United States, and our service providers process it primarily in the United States. The Services are offered to businesses in the United States. If you access the Site from outside the United States, your information will be transferred to and processed in the United States.

8. Your choices and rights

Marketing emails. You can opt out of marketing emails at any time. Use the unsubscribe link in the email or contact us. Service-related messages, such as digests your organization has set up for you and account or security notices, will continue while you have an account or remain on a customer's recipient list. To stop receiving digests, ask your organization's account administrator to remove you.

Account information. Account holders can update some account information in the Services or through their organization's administrator.

Privacy rights. Depending on where you live and the laws that apply to Rivvena, you may have the right to:

• know about and access the personal information we hold about you;
• correct inaccurate personal information;
• delete your personal information;
• receive a portable copy of your personal information; and
• opt out of the sale of your personal information, sharing for targeted advertising, or certain profiling. We do not engage in these activities.

To make a request, email privacy@rivvena.com. We will need to verify your identity before responding, and we may ask for information to do so. You may use an authorized agent where applicable law allows. If we deny your request, you may appeal by replying to our decision, where the law provides that right. We will not discriminate against you for exercising your rights.

Requests about Customer Data. If your information was provided to us by a restaurant that uses Rivvena, such as an employer or a restaurant where you dined, please send your request to that restaurant. We process that information on the restaurant's behalf. We will help our customers respond to requests as our agreements require.

9. Other important information

Children. The Site and the Services are intended for businesses. They are not directed to children under 16. We do not knowingly collect personal information from children under 16 as a controller. If you believe a child has provided us with personal information, please contact us and we will delete it.

Third-party sites and services. The Site and the Services may link to or integrate with third-party websites and services, including scheduling tools and the systems our customers connect. Their own privacy policies govern those third parties. We are not responsible for their practices.

Changes to this Privacy Policy. We may update this Privacy Policy from time to time. We will post the updated version on the Site and change the effective date above. If we make material changes, we will provide additional notice, such as by email to account holders or a notice in the Services.

Contact us. If you have questions about this Privacy Policy or our privacy practices, contact us at:

Rivvena, Inc., Attn: Privacy, privacy@rivvena.com