Protecting Your Privacy
We believe transparency builds trust.
Last Updated: July 1, 2026
This Privacy Policy explains how RiverLoom handles your personal information when you use our services, visit our website, or interact with our products.
Overview
Our commitment to your privacy
RiverLoom ("we", "our", or "us") is a software engineering and AI solutions studio. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you visit our website, use our services, or interact with our products.
We are committed to protecting your privacy and handling your data with transparency and care. We encourage you to read this policy carefully and contact us with any questions.
This policy applies to all visitors, clients, and users of RiverLoom's website and services. [CONFIGURABLE: If you are located in the EEA, UK, or California, additional rights may apply as described below.]
Information We Collect
What we gather and why
We collect only the minimum information necessary to provide our services and improve your experience. We do not collect data indiscriminately.
We collect the following categories of information:
Personal Information: Name, email address, phone number, company name, job title, and billing information when you engage our services or contact us.
Technical Information: IP address, browser type, device information, operating system, and usage patterns when you visit our website.
Communication Data: Records of emails, calls, and messages exchanged with our team for service delivery and support.
We do not currently collect sensitive personal data such as health information, biometric data, or financial account numbers (beyond basic billing information processed by our payment partners). [CONFIGURABLE: Update this section if RiverLoom begins collecting additional data types.]
How We Use Your Data
Purpose of data processing
We use the information we collect for the following purposes:
Service Delivery: To provide, maintain, and improve our software engineering and consulting services.
Communication: To respond to inquiries, send project updates, invoices, and service-related communications.
Website Improvement: To analyze how visitors use our site and improve the user experience.
Legal Compliance: To comply with applicable laws, regulations, and legal requests.
We do not use your personal information for automated decision-making or profiling without your explicit consent. [CONFIGURABLE: If RiverLoom implements AI-driven personalization in the future, this section must be updated.]
Legal Basis for Processing
GDPR compliance framework
If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal information based on the following legal grounds:
Contractual Necessity: Processing required to fulfill our service agreement with you (e.g., project delivery, billing).
Legitimate Interests: Processing for our legitimate business interests such as improving services, security, and analytics — balanced against your privacy rights.
Consent: Where we rely on your consent (e.g., marketing cookies), you may withdraw consent at any time.
Legal Obligation: Processing necessary to comply with legal and regulatory requirements.
[CONFIGURABLE: This section should be reviewed by legal counsel to ensure GDPR compliance is accurately represented based on RiverLoom's specific data processing activities and jurisdictional exposures.]
Data Sharing & Third Parties
Who we share your data with
We do not sell your personal information. We may share your data with trusted third-party service providers who assist us in operating our business, subject to strict data processing agreements:
Cloud Infrastructure: [CONFIGURABLE: e.g., AWS, Google Cloud, Vercel] — for hosting and storage.
Communication Tools: [CONFIGURABLE: e.g., Slack, Email services] — for project communication.
Payment Processing: [CONFIGURABLE: e.g., Stripe, Razorpay] — for billing. Payment data is handled directly by the provider; we do not store full payment card details.
Analytics: [CONFIGURABLE: e.g., Plausible, PostHog, Google Analytics] — for website analytics with privacy safeguards in place.
We require all third parties to adhere to confidentiality and data protection standards equivalent to our own. [CONFIGURABLE: A complete list of sub-processors should be maintained and provided upon request.]
Data Security
How we protect your information
We implement comprehensive security measures to protect your data from unauthorized access, alteration, disclosure, or destruction:
Encryption: Data is encrypted in transit using TLS 1.3 and at rest using AES-256.
Access Control: Strict access controls with role-based permissions and multi-factor authentication.
Regular Audits: Periodic security reviews and penetration testing of our infrastructure.
Incident Response: A documented incident response plan to address any potential breaches.
While we implement strong safeguards, no method of transmission or storage is 100% secure. We cannot guarantee absolute security but will notify you promptly in the event of a data breach affecting your personal information, as required by applicable law.
Data Retention
How long we keep your data
We retain your personal information only as long as necessary to fulfill the purposes described in this policy, or as required by law:
| Data Category | Retention Period | Rationale |
|---|---|---|
| Account & Billing Data | [CONFIGURABLE: 7 years] | Legal and tax compliance |
| Project Communications | [CONFIGURABLE: 3 years after project completion] | Service continuity and reference |
| Website Analytics | [CONFIGURABLE: 26 months] | Industry standard for analytics |
| Inquiry Data | [CONFIGURABLE: 12 months] | Follow-up and relationship management |
When retention periods expire, your data is securely deleted or anonymized.
Your Rights
Control over your data
Depending on your jurisdiction, you may have the following rights regarding your personal information:
Right to Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure: Request deletion of your personal data, subject to legal retention obligations.
Right to Restrict Processing: Request limitation of how we use your data.
Right to Data Portability: Receive your data in a structured, commonly used format.
Right to Object: Object to processing based on legitimate interests or for marketing purposes.
California residents may have additional rights under the CCPA/CPRA. [CONFIGURABLE: Include specific CCPA section if RiverLoom has California clients or visitors.] To exercise any of these rights, contact us at contact@riverloom.in. We will respond within the timeframe required by applicable law.
International Transfers
Data across borders
RiverLoom operates globally. Your personal information may be transferred to and processed in countries other than your own, including [CONFIGURABLE: India, United States, United Kingdom, European Union]. Where we transfer data across borders, we implement appropriate safeguards:
Standard Contractual Clauses (SCCs) approved by the European Commission, where required.
Data Processing Agreements with all third-party service providers.
Transfer Impact Assessments where required by applicable regulations.
[CONFIGURABLE: Specify the exact countries where RiverLoom processes data. The adequacy decisions and SCCs referenced must match RiverLoom's actual data flows.]
Children's Privacy
Protecting minors
Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us immediately and we will take steps to delete that information.
[CONFIGURABLE: Update the minimum age if RiverLoom's services are used by younger audiences (e.g., educational products like VisiLearn may require a different age threshold depending on jurisdiction.)]
Changes to This Policy
Staying informed
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or operational needs. When we make material changes, we will notify you by:
Posting the updated policy on this page with a revised "Last Updated" date.
Sending a notification via email (for active clients) or through a website notice.
We encourage you to review this policy periodically. Your continued use of our services after changes take effect constitutes acceptance of the updated policy.
Contact Us
We're here to help
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Email: contact@riverloom.in
Response Time: We aim to respond within 48 hours during business days.
Business Hours: Monday–Friday, 9:00 AM – 6:00 PM [CONFIGURABLE: Specify timezone]
You also have the right to lodge a complaint with your local data protection authority if you believe we have violated applicable privacy laws. [CONFIGURABLE: Specify the relevant supervisory authority based on RiverLoom's primary jurisdiction.]