Privacy Policy

Rilvo is a product of Apliteni OÜ ("Apliteni", "we", "us"), a company registered in Estonia. Apliteni OÜ is the data controller for the personal data described in this policy. You can reach us at compliance@apliteni.com for any privacy question or request.

This policy covers two things: (a) this marketing website (rilvo.io and its subdomains), and (b) the Rilvo product once it becomes generally available. Where a section only applies to one of the two, that is stated explicitly.

As of the date above, this website does three things with data:

• Consent banner and analytics. We use Lessly Analytics to count visits and see which pages are read. A consent banner loads before any tracker runs and records your choice. Without your consent the analytics runs in cookieless mode: it stores nothing on your device and collects only aggregate page-level data. If you consent, a first-party cookie is set so repeat visits can be recognised. You can change or withdraw your choice at any time through the banner.
• Waitlist form. If you submit the form on our waitlist page, we store the email address you enter together with your consent to be contacted, and we use it only to tell you about early access. There is no profiling and no sharing with third parties for their own purposes. You can ask us to remove you at any time by writing to the address in section 8, and we delete waitlist entries once the waitlist is closed.
• Demo bookings. The "Book a demo" button opens an external Calendly page in a new tab. Nothing is transmitted from this site when you click it, but if you book a slot, Calendly processes the name, email address and any details you enter on its own page, on our behalf. Calendly is listed on our Sub-processors page.

We do not sell this data, and we do not use it for advertising. The legal basis is your consent for analytics cookies and for waitlist emails, and our legitimate interest in understanding aggregate traffic to the site.

The Rilvo product is designed around your organization and the people you invite to it:

• Account data — name, email address, and a hashed personal API key for each user; the organization name your users belong to.
• Onboarding / compliance profile data — what you tell us about your product or company (company type, what data it processes, jurisdictions you operate in) so we can determine which compliance domains apply to you.
• Generated compliance content — the legal context, gap items, and policy/procedure documents Rilvo generates for your organization, plus any evidence links you or your team attach to a gap item.

By design, Rilvo does not connect to your production infrastructure and does not pull data from your systems automatically — evidence is provided by you or your own agent, by reference. We only process what your organization actively puts into the product.

• To provide the product you signed up for — performance of a contract.
• To keep the service secure and improve it — legitimate interest.
• To send you product or marketing updates you asked for — consent, which you can withdraw at any time.

We share personal data only with the sub-processors listed on our Sub-processors page, and only to the extent needed to run the service (hosting, payments, and the AI model provider used to generate compliance content). Where a sub-processor is outside the EEA, we rely on Standard Contractual Clauses. We do not sell personal data.

We keep account and organization data for as long as your organization has an active relationship with us, and for a limited period afterwards to meet legal and accounting obligations. You can ask us to delete your data earlier, subject to what we're legally required to retain.

Under the GDPR, you have the right to access, correct, delete, restrict, or export your personal data, and to object to certain processing. To exercise any of these, write to compliance@apliteni.com. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (AKI) or your local supervisory authority.

If we make material changes to this policy, we'll update the date at the top of this page and, where required, notify organization admins directly.