Privacy Policy

1. Data controller

Rapid Dreams GmbH, c/o Value Solutions, Riedstrasse 7, 6330 Cham, Switzerland — the controller responsible for RivoCalc, available at www.rivocalc.com. Contact: privacy@rivocalc.com or through the contact form.

2. What data we collect

We process the following personal data, all kept to the strict minimum necessary:

• Contact form: the name, email, and message you choose to send us. We don't collect your address, phone number, or any other personal data.
• IP address: collected temporarily, only for spam protection (rate limiting). We don't associate the IP with your form submission in long-term storage.
• Usage data (analytics): collected only if you accept cookies — pages viewed, time on page, country of origin. Always anonymized (IP anonymization enabled).
• Waitlist (quote tool): your email, country, and the calculator you signed up from, your optional answer about whether you're a construction professional, and the date and text of the consent you accepted. We don't store your IP address or browser data.

3. Legal basis for processing

• Contact form: legitimate interest (replying to you) and pre-contractual steps (handling your request).
• Analytics: explicit consent (collected through the cookie banner — you can change your decision at any time by clearing your browser storage).
• IP-based rate limiting: legitimate interest (service security).
• Waitlist: explicit consent, given by checking the box on the form. You can withdraw it at any time.

4. Sub-processors

Your data may be processed by the following providers, based in the United States. For visitors in the EU and Switzerland, transfers to the United States rely on the EU-U.S. Data Privacy Framework (and its Swiss counterpart) where the provider is certified, and on Standard Contractual Clauses otherwise:

• Resend, Inc. (United States) — sends email from the contact form.
• Cloudflare, Inc. (United States) — contact message storage (KV), rate limiting, DNS, and CDN.
• Vercel Inc. (United States) — hosts the web application and processes requests.
• Google LLC (United States) — Google Analytics 4, only if you accepted cookies.
• Convex, Inc. (United States; data hosted in Ireland, EU) — waitlist database.

5. Retention period

• Contact emails: kept until you ask for removal.
• Contact form messages (KV): kept until you ask for removal.
• IP address (rate limiting): automatically deleted after 60 seconds.
• Analytics data: retention is controlled directly through our Google Analytics account, set to the shortest available window (14 months).
• Waitlist: kept for as long as we use it to notify you about the tool, or until you ask to be removed or unsubscribe. If the project is abandoned, the list is deleted.

6. Cookies

We only use the following cookie categories:

• Essential (always active): no third-party cookies; a single record in localStorage stores your decision about analytics cookies.
• Analytics (optional, requires consent): Google Analytics 4 — only loads if you accept it in the banner. You can decline it and the site still works fine.

To change your decision at any time, use "Manage cookies" in the site footer — the record rivocalc-cookie-consent-v1 in your browser's localStorage is cleared and the cookie banner reappears so you can decide again.

7. Your rights

Under GDPR, you have the right to:

• Access — know what data of yours we process.
• Rectification — correct inaccurate data.
• Erasure — request deletion of your data (the "right to be forgotten").
• Portability — receive a copy of your data in a structured format.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — decline analytics cookies or leave the waitlist at any time.

To exercise these rights, contact us through the contact form, or email privacy@rivocalc.com. We respond within one month, as required by GDPR.

8. Filing a complaint with a supervisory authority

If you believe our handling of your data violates the law, you can file a complaint with the data protection authority in your country of residence in the EU or, in Switzerland, with the Federal Data Protection and Information Commissioner (FDPIC). The United States has no general federal data protection authority; complaints about deceptive privacy practices or commercial email can be filed with the Federal Trade Commission (FTC).