Privacy Policy - Rivulent Web Design, Inc.

1. Overview

Rivulent Web Design, Inc. ("Rivulent," "we," "our," or "us") provides software and hosting services enabling clients to conduct surveys, collect data, and manage participant interactions through their Platform, websites, and related services.

The company prioritizes data privacy by encrypting all stored information, declining to sell data, and processing information exclusively as clients direct.

2. Information We Collect

The Platform may collect or process:

Survey and research data entered by participants or uploaded by clients
Personally identifiable information (names, email addresses, phone numbers, mailing addresses, IP addresses) when necessary for participant communication, follow-up, verification, and de-duplication
Usage and technical data (access logs, browser type, device information, timestamps) for security and operational purposes

3. How Information Is Used

Rivulent processes information solely to provide and maintain services, including:

Hosting and storing client data securely
Sending authorized communications to participants as part of client projects
Providing technical support and troubleshooting
Ensuring security, uptime, and lawful Platform operation

"We do not use client or participant data for analytics, marketing, or profiling beyond what is explicitly authorized by the client."

4. Data Ownership and Control

All data belongs to the respective client (the organization conducting the project). Rivulent functions as a data processor or service provider.

Clients determine data collection scope, retention periods, and deletion timing. Upon request or contract termination, Rivulent will delete or return client data.

5. Data Sharing

The company does not sell, rent, or share client or participant data with third parties.

Trusted service providers support operations under confidentiality and data-processing agreements:

AWS for encrypted hosting and storage
Cloudflare for network protection (firewall, DDoS mitigation, geofencing)
Twilio, SendGrid, or comparable providers for communication functions

6. Data Security

The organization employs encryption for data in transit (TLS) and at rest, with strict access controls limiting authorized personnel access to fulfill contractual obligations or technical support requests.

7. Retention and Deletion

"Rivulent retains data only as instructed by the client."

Upon project completion or contract termination, data is deleted or returned according to client instructions and internal secure deletion procedures.

8. Children's Privacy

The Platform is not intended for individuals under 13 unless specifically authorized by the client and compliant with applicable research ethics standards.

9. Compliance with Privacy Regulations

Rivulent recognizes clients may collect data from individuals in jurisdictions with additional privacy requirements, such as the European Union (GDPR) or California (CCPA/CPRA).

Operating as a data processor on behalf of clients, Rivulent will:

Process personal data only under written client instructions via Data Processing Agreement or similar documentation
Maintain appropriate technical and organizational safeguards consistent with regulatory frameworks
Support clients' efforts to respond to lawful data-subject or consumer requests (access, deletion, correction, export) when directed and technically feasible

"Rivulent does not determine the legal basis for data collection or the scope of personal data gathered; those decisions are made solely by the client conducting the project."

10. Data Subject and Consumer Requests

If individuals contact Rivulent directly to exercise privacy rights under GDPR, CCPA, or similar laws, the company refers requests to the applicable client (data controller) responsible for that data, assisting where technically feasible and legally required.

11. International Transfers

"Rivulent hosts all systems and data within U.S. data centers operated by Amazon Web Services (AWS)."

When data originates outside the United States, it is transferred and processed in the U.S. under client direction and responsibility.

12. Changes to This Policy

The organization may update this Privacy Policy periodically. The "Last Updated" date reflects the current version. Continued Platform use after changes are posted constitutes acceptance of the revised policy.

Rivulent Privacy Policy