Privacy policy

This Privacy Policy (the "Policy") explains how Rivool Finance ("Rivool," "we"), identified in the Terms of Use, processes personal data relating to the Rivool website, applications, interfaces, and support, as controller under Clause 5. This Policy forms an integral part of the Terms of Use and must be read together with them. We apply the appropriate legal basis to each purpose. Questions may be directed to our data protection channel: contact@rivool.finance.

We comply with the data protection legislation applicable to each processing activity, including the Data Protection Act, 2021, for the operation of the entity established in the British Virgin Islands, and Law No. 13.709/2018 (the LGPD) in the cases set out in its Article 3, including with respect to services offered to persons located in Brazil.

Clause 1. Scope and nature of the services

Rivool provides a self-custody, direct-to-blockchain interface, based on a Smart Wallet with Passkey authentication, through which the User interacts directly with blockchain networks and third-party decentralized finance (DeFi) protocols. Rivool may also make available optional features provided by regulated partners, such as fiat-to-crypto conversion (on-ramp and off-ramp, including via PIX and international payments), a prepaid card, and international investment products, under Clause 2.6.3 of the Terms of Use. In the self-custody flow, Rivool does not hold your private keys or custody your assets, does not intermediate orders, and does not custody funds. The regulated services are provided by the partners identified in Clause 5, which are responsible for the corresponding regulatory obligations.

Clause 2. Personal data we process

The categories below depend on the features you use. Merely accessing the interface does not mean that all of this data will be collected.

Data that is essential to account creation, security, or identity verification will be identified at the time of collection. Refusing to provide it may prevent the corresponding feature from working. Optional data will be identified as such, and declining to provide it will not prevent access to services that do not depend on it.

Account and contact data: name, email, phone number, and account preferences. The email linked to the account also serves as part of the access recovery mechanism, under Clause 14.8 of the Terms of Use.
Wallet, authentication, and security: the User's Smart Wallet address and Public Key. Rivool stores only the Public Key, which is needed to verify the authenticity of signatures (Clause 14.2 of the Terms of Use). It does not store or have access to the Private Key, the recovery material (the "Secret" or Recovery Phrase), or the Passkey. The Passkey and the Authenticator are the only mechanisms for authorizing transactions in the Smart Wallet. Biometric authentication takes place solely on the User's device, and no biometric data used in this authentication is transmitted to Rivool, the blockchain, or third parties. All that is transmitted to the network is the cryptographic signature produced by the device. The Recovery Guardian is the Privy wallet linked to the User's email, which operates solely within the Smart Wallet's social recovery module and has no signing power in the main transaction flow. We also process credential and Passkey identifiers, the status and data of the recovery process, sessions, and security signals.
Device and notifications: IP address, browser, operating system, app version, device or session identifiers, and records of the notifications sent to the User, including the notifications during the Protection Period of a recovery.
Financial and transactional data: balances, assets, positions, yields and rewards, and the history of deposits, withdrawals, crypto transfers, PIX, swaps, and transactions, including amounts, currencies, exchange rates, fees, status, dates, networks, source and destination addresses, token contracts, and hashes. Rivool does not store the full card number.
Identity and compliance (KYC/AML), where applicable: legal name, CPF or equivalent tax identifier, and information required for identity verification, risk analysis, and the prevention of money laundering, terrorist financing, and fraud. Identity verification and screening are carried out through Sumsub (Sum and Substance Ltd.), which acts as Rivool's processor for the verifications performed under its instructions. In this process, the User may provide an identification document and a facial image for a liveness check (biometric data), processed solely for identity verification and to meet anti-money-laundering obligations. Sumsub's processing is governed by its own Privacy Policy (https://sumsub.com/privacy-notice/). Certain regulated partners carry out their own verification directly with the User for the services they provide.
International investment products, where applicable: the data needed to verify eligibility and the acquisition restrictions applicable to each product, as set out in the documentation presented to the User before acceptance (Clause 2.6.3 of the Terms of Use).
Support: messages, attachments, and the history of requests submitted through the support channels (Clause 10 of the Terms of Use).
Communications, promotions, and referrals: the data needed to send communications and to take part in Promotions and the Referral Program (Section 9 of the Terms of Use), with the option to opt out of optional communications.
Cookies: these are small files stored on your device that may contain identifiers associated with you. We use session and functional cookies that are necessary for authentication, security, and the operation of the service. You can manage these choices through your browser or device settings, where available. If optional analytics or advertising cookies are used, we will inform you of their purposes and, where consent is required, they will only be activated after you make your choice, which you can later review. Declining these optional cookies does not prevent you from using essential features.

Clause 3. Where the data comes from

From you: when you create your account, activate a product, transact, take part in a promotion, or contact support.
From your device and your interaction with the platform: technical logs, usage events, and session data.
From public blockchains: publicly verifiable addresses, balances, contracts, and transactions.
From Distribution Partners: when the User accesses the Platform through a referral from or via a Distribution Partner, which acts independently (Clause 9.9 of the Terms of Use).
From partners and service providers: identity verification, fiat conversion, card, and infrastructure partners, as well as lawfully accessible sources for fraud prevention and compliance.

Clause 4. Purposes and legal bases

We process data only for legitimate, specific purposes. The legal basis depends on the operation, the role of each party, and the applicable law. For processing subject to the Data Protection Act, 2021, we rely on consent or one of the grounds permitted under it. Legitimate interest will be used only where permitted by applicable law. Where necessary, consent will be requested separately for the relevant purpose.

Operating the account and products: authenticating the User via Passkey or Authenticator; creating and recovering access, including through the account recovery process (registering a new Passkey, activating the email-linked Recovery Guardian, and a 7-day Protection Period, with notifications to the User); displaying balances; transmitting the User's signed instructions to the network; integrating partners; enabling the card; and providing support. Legal basis: performance of a contract or pre-contractual steps and, where directly applicable to Rivool, compliance with a legal obligation.
Identity, compliance, and security: performing KYC and AML screening through Sumsub and the responsible regulated partners; maintaining security controls, fraud prevention, and incident response, including refusing to transmit instructions identified as malicious. Legal basis: compliance with a legal obligation directly applicable to the responsible controller, performance of a contract, the regular exercise of rights, and legitimate interest, subject to balancing against the data subject's rights.
International investment products: verifying the User's eligibility and the applicable restrictions, and enabling the engagement with the responsible entity abroad (Clause 2.6.3 of the Terms of Use). Legal basis: performance of a contract, pre-contractual steps, and compliance with applicable legal and regulatory obligations.
Communicating and running promotions: sending transactional, security, and recovery notices; running Promotions and the Referral Program; and providing support. Legal basis: performance of a contract and legitimate interest, where permitted by applicable law. Optional communications are subject to consent where required and will include an opt-out option.
Complying with the law and defending rights: responding to authorities; meeting directly applicable legal, tax, or regulatory obligations; and protecting users, Rivool, and third parties. Legal basis: compliance with a legal obligation, the regular exercise of rights, and, for proportionate security and fraud-prevention measures involving non-sensitive data, legitimate interest.

Where consent is the legal basis, you may withdraw it without affecting prior processing. Withdrawal may prevent any feature that strictly depends on that consent.

Where the data we process is classified as sensitive under applicable law, we will rely only on the specific grounds permitted for that category, including explicit consent where required. The biometrics used in KYC liveness checks will follow this regime where applicable and are distinct from local Passkey authentication. We do not rely on legitimate interest as a legal basis for sensitive data.

Rivool shares data only to the extent necessary to provide the requested features, meet legal and regulatory obligations, prevent fraud, and ensure the security and operation of the services. This sharing may involve:

Identity verification (KYC/AML): Sumsub (Sum and Substance Ltd.), which processes document and biometric data for verification, acting as Rivool's processor for the verifications performed under its instructions.
Wallet, authentication, and recovery: Privy (Horkos, Inc.), which provides the self-custodial Smart Wallet, Passkey, and Recovery Guardian infrastructure.
Card: the responsible partner and its issuing network, responsible for issuing and operating the card.
Fiat-to-crypto conversion (including PIX and wire): Avenia and Unblockpay and their banking partners.
International investment products: the responsible entity abroad and the parties responsible for execution, settlement, and custody, as set out in each product's documentation.
Distribution Partners: as necessary for the User's referral and access, provided that the Distribution Partner acts independently and has no access to the User's keys, credentials, or assets.
Operational support providers: infrastructure, cloud, hosting, security, customer support, and communications providers.
Authorities and legally authorized third parties: pursuant to a valid order or request, a legal or regulatory obligation, or where necessary to prevent harm, investigate fraud, or exercise rights, limiting the sharing to the minimum necessary and redacting third-party data that is not covered.

As a rule, regulated partners act as independent controllers for activities subject to their own regulatory obligations, in which case the processing is also governed by the partner's privacy policy, made available to the User according to the feature used. RVL Global acts as controller for the platform processing whose purposes and means it determines. Sumsub acts as processor for the identity verifications carried out on Rivool's behalf and under its instructions. Rivool does not sell data subjects' data.

Clause 6. Data on public blockchains

Blockchain transactions are public, verifiable, and, as a rule, immutable. Rivool does not control the network and cannot delete or alter on-chain records, including the wallet's public address and the transactions linked to it (Clause 11.2 of the Terms of Use). Requests for correction or deletion reach only the records under Rivool's control and are subject to applicable technical and legal limitations. Third parties may consult or correlate public information linked to an address, over which Rivool has no control. A public address may constitute personal data where it makes it possible to identify someone, on its own or in combination with other information. The public nature or immutability of a record does not remove the legal protection applicable to the processing carried out by Rivool.

Clause 7. Automated decisions

Rivool and its partners may use automated rules and signals for security, fraud prevention, compliance, operational limits, and support prioritization, including restricting features in the event of a well-founded suspicion of fraud or at the request of a regulated partner (Sections 5 and 6 of the Terms of Use). In the cases provided for by applicable law, you may request a review of decisions taken solely on the basis of automated processing that affect your interests, subject to trade and industrial secrets and to the limits necessary for security and fraud prevention. Where provided for by law, you may also request information about the criteria and procedures used, subject to the protection of trade and industrial secrets.

Clause 8. Security

Rivool adopts technical, organizational, and administrative measures proportionate to the risk (Clause 12.5 of the Terms of Use). No measure eliminates risk entirely. For this reason, we review our controls and respond to incidents in accordance with the law. Where applicable law requires notification of the competent authority or the affected data subjects, we will follow the criteria, deadlines, and procedures it sets out.

Clause 9. Retention, account closure, and deletion

We keep data for as long as necessary for the purposes of this Policy and for the legal obligations directly applicable to Rivool, subject to limitation periods and the defense of rights. After the account is closed, certain data may be retained for the period required or permitted by legal, regulatory, tax, and accounting obligations, fraud prevention, security, and dispute resolution. Records of identity verification and of transactions subject to their own regulatory obligations are kept by the responsible partners for the periods the regulation imposes on them. Closing the account does not result in the immediate deletion of all history, nor does it erase data recorded on public blockchains. Once the applicable periods have elapsed and there is no basis to retain the data, it will be deleted or anonymized so that it cannot identify the data subject, subject to the limitations of public blockchain records described in Clause 6. The conditions for accessing the Wallet after closure are set out in the Terms of Use.

Clause 10. Your rights

In accordance with applicable law, you may request confirmation of and access to your data; correction; information about data sharing and about the consequences of withholding consent; portability; anonymization; blocking or deletion of data that is unnecessary, excessive, or unlawfully processed; withdrawal of consent; objection; and review of automated decisions. You may also file a complaint with the competent authority. Some rights are subject to legal requirements and exceptions, including the technical limitations of the blockchain described in Clause 6. Where a request involves data under the control of a regulated partner, we will handle the part relating to the processing under our responsibility and will point you to the channel of the partner responsible for the remaining processing. Send your request to contact@rivool.finance. We may confirm your identity and keep a record of how the request was handled. We will respond within the deadlines set by applicable law and will explain the reasons for any refusal or limitation.

Clause 11. Children and adolescents

Rivool is intended solely for people aged 18 or over and is not directed at children or adolescents (Clause 1.6 of the Terms of Use). If we identify use by a person under 18 in breach of this rule, we will take reasonable steps to stop the use and to delete or anonymize the data where there is no basis to retain it. Requests concerning the data of children or adolescents may be sent to contact@rivool.finance.

Clause 12. Electronic communications and corporate transactions

We may send operational communications necessary for the account and products, and the User agrees to receive them by electronic means (Clause 16.9 of the Terms of Use). Promotional communications will include an opt-out option. In a reorganization or corporate transaction, data may be transferred to the successor or a legitimate interested party, with confidentiality and continuity of the applicable protections (Clause 16.7 of the Terms of Use).

Clause 13. Changes to this Policy

We may update this Policy to reflect legal, technical, or operational changes. Material changes will be communicated to the User by appropriate means. The current version and its date will be available on the website or app (in line with Clause 16.8 of the Terms of Use).

Clause 14. International data transfers

Rivool's operation uses partners and service providers located in Brazil and in other countries and includes a structure in the British Virgin Islands. As a result, personal data may be transferred internationally, including as part of identity verification (Clause 11.3.2 of the Terms of Use). These transfers comply with the legal requirements applicable to the flow, through appropriate safeguards, contractual clauses, or another legally permitted mechanism. For transfers subject to the LGPD, we will also comply with the ANPD's regulations. Information about the destination countries, the purposes, and the parties involved will be made available according to the feature used and the legal transparency requirements. You may request additional information about the destinations and the mechanism applied through the channel in Clause 15.

Clause 15. Contact and data protection

To ask questions, exercise your rights, or file a complaint about the processing of personal data, contact us at contact@rivool.finance. The identity and contact details of the Data Protection Officer, where required by applicable law, will be made available on Rivool's website.