Privacy Policy

Effective 2 October 2026

This policy explains what personal information Rivero (“we”, “us”) collects through Kestrel, our product analytics service, and through this website, why we collect it, and the choices you have. Questions: pankaj@rivero.co.in.

1. Who this applies to

• People who sign in to Kestrel — employees of our customers (and Rivero staff who support them). For their account information, Rivero decides how it is handled together with the customer organization they belong to.
• End users of our customers’ apps and websites — whose usage events our customers send to Kestrel. Here our customer decides what is collected and why; Rivero processes that data only on the customer’s behalf and on their instructions. Their own privacy policy applies to you.
• Visitors to this website.

2. Signing in with Google

Kestrel offers “Continue with Google”. When you use it, Google shares with Kestrel only your name, email address, profile picture and Google account identifier (the openid, email and profile permissions). We do not receive your Google password and we do not access your Gmail, Drive, contacts or any other Google data.

We use this information only to:

• confirm who you are and whether your organization has given you access;
• show your name and picture inside Kestrel (for example on reports you create and in your organization’s user list);
• let your organization’s administrators manage access, and keep a security audit log.

Kestrel’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We never sell this information, never use it for advertising, and never share it outside your organization’s Kestrel environment except as described in section 6.

3. Other information Kestrel keeps about people who sign in

• Access details: your role, who invited you, and when you last signed in or were active.
• Security audit log: sign-ins and administrative actions, with the time, the IP address they came from and what changed. Your organization’s administrators can see this log.
• Content you create: reports, boards, cohorts and similar items, linked to your account.
• Session cookie: Kestrel sets one strictly necessary cookie that keeps you signed in. It is not used for tracking or advertising.

4. Analytics data our customers send

Our customers send Kestrel events describing how their products are used, which may include identifiers and properties of their end users. We store and analyze this data solely to provide Kestrel to that customer. We do not use one customer’s data for another customer, and we do not sell it. Requests about this data should go to the customer whose app or website you used; we will help them respond.

5. Where data is stored and how it is protected

Each customer has a separate, dedicated Kestrel environment. Environments hosted by Rivero run on Amazon Web Services in the Mumbai (ap-south-1) region, India. Some customers run Kestrel in their own cloud account, in which case the data stays there. Connections to Kestrel are encrypted (HTTPS), and access to each environment is limited to the people who need it to run the service.

6. Who we share information with

• Service providers that host and run Kestrel for us — Amazon Web Services (hosting) and Google (sign-in) — only as needed to provide the service.
• Your organization: its administrators can see who has access and the audit log described above.
• Authorities, when required by law.

7. How long we keep information

We keep sign-in and account information while your organization uses Kestrel. If your organization removes you, you can no longer sign in; the record of your account and your past actions may be kept so that reports you created and the audit log remain accurate. Analytics data is kept for the period agreed with each customer. When a customer stops using Kestrel, we delete its environment and data as agreed in its contract.

8. Your choices and rights

Under India’s Digital Personal Data Protection Act, 2023 and other applicable laws, you may ask to access, correct or erase your personal information, withdraw consent, or raise a grievance. If you sign in to Kestrel through an organization, you can also ask that organization’s administrators. You can revoke Kestrel’s access to your Google account at any time at myaccount.google.com/connections.

Grievance Officer, Rivero: pankaj@rivero.co.in. We respond within 30 days.

9. This website

This website uses no cookies and no analytics. It is hosted on GitHub Pages, whose servers may record visitors’ IP addresses for security, under GitHub’s privacy statement.

10. Children

Kestrel is a business tool and is not meant for anyone under 18 to sign in to.

11. Changes

If we change this policy, we will update the date at the top of this page, and tell customers about significant changes before they take effect.