Privacy Policy

Rivet is a service of Rivet Solutions LLC, a Wyoming limited liability company (“Rivet”, “we”).

When a homeowner calls a contractor who uses Rivet, the contractor is the business responsible for that customer relationship. Rivet is their service provider: we process call content on the contractor’s behalf and on their instructions, and for no independent purpose of our own.

This policy covers the contractors who buy Rivet, the callers whose calls we answer, the business owners Rivet’s independent sales partners speak with, and visitors who use the assistant on our website. For calls between a sales partner and a business, Rivet is the business responsible for the data. Callers may also want the shorter Call Recording & AI Notice.

From callers, during a call:

• Audio of the call, once the recording notice has played.
• A written transcript of what was said.
• The structured details the caller gave in order to book: name, callback number, service address, what is wrong, and the time window they chose.
• The caller ID and the time and length of the call.
• Whether the caller asked not to be recorded.

From contractors:

• Account and contact details, including the mobile number alerts go to.
• The business knowledge you enter so the assistant can answer well: trades, hours, services, pricing, service area, and your instructions to it.
• Billing information, which is handled by our payment processor. We never see or store full card numbers.
• Ordinary product usage and error logs.

From business owners on calls with a Rivet sales partner:

• Audio of the call. The partner tells you at the start that the call is recorded and transcribed, including by AI.
• A written transcript of the call, produced by an AI speech-recognition service.
• The number dialled, and the time and length of the call.
• If the partner uses Rivet’s live coaching tool: the call is also transcribed and analysed by AI in real time to suggest what the partner could say next. The coach only starts listening to your side after that notice has been given, and stops if you object to the AI. It keeps no audio and no transcript of its own — only a score and written feedback for the partner.

From visitors who use the assistant on our website:

• The live demo and the support assistant send what you type or say to our AI vendor to generate a reply.
• Demo conversations are not stored by Rivet.
• Support conversations are saved so we can follow up on your question.

We do not use call content to train AI models. Not ours, not a vendor’s. There is no tier, toggle or roadmap item that turns this on. Our AI vendor does not train on data sent through its API, and we also switch off its optional storage of requests on every call we make.

We do not create voiceprints. We do not perform voice authentication, speaker identification, or any analysis of vocal characteristics to identify or profile a person. Speaker labels in a transcript come from the fact that the caller and the assistant are on separate audio channels — never from acoustic analysis of a voice.

We do not sell or share personal information as those terms are used in California and other state privacy laws. We do not run advertising, and we do not place third-party advertising or analytics pixels on signed-in pages.

We do not take payment card numbers over the phone. The assistant is instructed to refuse them outright and to tell the caller the business will follow up about payment directly.

• Answering calls, booking appointments, and writing them to the calendar you connected.
• Sending you the summary, the booking alert, and the emergency escalation.
• Showing you calls, transcripts and recordings in your dashboard.
• Metering your minutes and billing you accurately.
• Keeping the service working, secure, and free of abuse.
• Meeting our legal obligations and keeping the consent evidence the law requires us to keep.
• For sales calls: showing that the recording and AI notice was given, reviewing call quality, and coaching our independent sales partners.

A transcript of a home-services call routinely contains a physical address and, from time to time, things a person said without thinking. Before a transcript is written to storage we automatically remove payment card numbers, Social Security numbers, and bank routing and account numbers, replacing them with a redaction marker. The same redaction runs on any text sent to the summarizer.

We never email a full transcript. Emails link to it behind a login. The summary text message carries the minimum useful detail only — who called, their number, what is wrong, and the time window.

Shorter is safer, which is why the defaults are short. A retention schedule that only exists in a privacy policy is worse than none, so deletion runs as an automated job and is monitored.

We use a small number of vendors to run the service. Each processes data only to provide its service to us, and none of them trains AI models on it.

• Telephony and text messaging — carrying the call and the SMS.
• OpenAI (through its API) — the AI that answers calls, speaks and understands speech, drafts call summaries, transcribes and analyses sales calls for live coaching, and powers the website demo and support assistant. OpenAI does not use API data to train its models, and we send every request with storage switched off (store: false). OpenAI’s standard API data retention still applies: it may keep request data for a limited period, generally up to 30 days, to detect abuse, and then deletes it.
• Deepgram — speech recognition that produces the transcripts of recorded sales calls.
• Cloud hosting and database — in the United States.
• Email delivery — the booking notices and calendar files we email to contractors.
• Google Calendar or Microsoft Graph — only if you connect one, and only with the narrow permissions described below.
• Payment processing — for your subscription. They see your card; we do not.

The full named list of the other vendors is available on request and will be published here before launch. We will give notice before adding a subprocessor that processes call content. The terms we hold ourselves and these vendors to when we process call content for a contractor are in the Data Processing Addendum.

If you connect Google Calendar, we request exactly two permissions: the ability to see when you are free or busy, and the ability to manage events on a calendar we create ourselves, named “Jobs booked by Rivet”. We cannot read the contents of your other events, and we never request access to your email.

If you connect Outlook or Microsoft 365, we request permission to read and write calendar events so we can check availability and create the job. We do not request mail permissions.

Access tokens are encrypted with AES-256-GCM before they are stored, using a key that is never kept in the database. You can disconnect at any time from Settings, which deletes the stored tokens.

Rivet’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use Google Calendar data only to provide the scheduling features described above, we do not transfer it to others except as necessary to provide those features or as required by law, we do not use it for advertising, and no human at Rivet reads it except with your explicit permission, to resolve a support issue you have raised, or where required by law. We do not use Google user data to train AI or machine-learning models, and we contractually prohibit our processors from doing so.

We text the contractor at the number they gave us, having ticked a box agreeing to it — at signup, during setup, or in their notification settings. Message frequency varies with call volume, and message and data rates may apply.

Reply STOP to any message to stop it immediately, or HELP for help. We honor STOP in real time rather than taking the ten business days the rules allow, and we honor it however it is phrased — “stop texting me” and “take me off this” work exactly as well as the word STOP. After a STOP we send exactly one confirmation and then nothing.

A number added to an account by somebody other than its owner gets a request for consent first and receives nothing else until it replies YES.

We do not text callers at all — no confirmations and no reminders. We do not send marketing texts, and Rivet cannot be used to send them.

9.1 Your mobile number is not shared for marketing

We do not share or sell mobile phone numbers, or SMS opt-in consent data, with third parties or affiliates for their marketing or promotional purposes. Mobile numbers are shared with the service providers listed in section 7 — such as the carriers and messaging providers that deliver our texts, and the vendors that host the service and run the AI that answers calls — and only so they can provide the service to us. The only other places a number goes are the business a caller phoned, because it is that business’s customer record (section 1), and anyone the law requires us to give it to.

Depending on where you live you may have the right to know what we hold about you, to get a copy, to correct it, to delete it, and to appeal a refusal. We do not sell or share personal information, so there is nothing to opt out of there.

If you were a caller to a business that uses Rivet, that business decides what happens to their customer records. Write to us at privacy@rivet.llc and we will route your request to them and help them answer it. If you simply want your call recording deleted, ask us and we will delete it.

If you are a contractor, most of this is self-serve in Settings, and anything that is not, we will do for you on request.

• Every row of customer data is isolated per account at the database level, not just in application code.
• Third-party tokens are encrypted at the application layer, with the key held outside the database.
• Access to production data is limited to the people who need it, and administrative actions are logged with a required reason.
• We are a small team and we will tell you plainly if something goes wrong. If a breach affects your data we will notify you within 72 hours of confirming it.

Rivet is a business tool and is not directed at children. We operate in the United States and store data in the United States. We do not currently offer the service in the European Economic Area or the United Kingdom.

Rivet Solutions LLC · privacy@rivet.llc

By post: Rivet Solutions LLC, c/o Republic Registered Agent LLC, 5830 E 2nd St, Ste 7000, Casper, WY 82609. Email is faster, and a request by email is just as valid.

Open items for counsel: the named subprocessor list and change-notice mechanism; whether the Data Processing Addendum’s statute-by-section service-provider terms must also restate the statutory language verbatim; and the precise wording of the caller-facing rights channel where the contractor, not Rivet, is the responsible business.