How we use your information

Who is responsible

SASU Riviair & Water

• SASU Riviair & Water, a French registered business, is responsible for your information. For any privacy question or request to delete your data, write to us at the email address below.

Contact and visit requests

• When you send a message or book a visit, we receive your full name, email, phone number, town or postcode (and the visit address for on-site visits), property type and size, your message or notes and the time you chose.
• To send a message you must give your full name, email and a message of at least 10 characters and pass the spam check; phone number, town or postcode and property type and size are optional. To book a visit you must also give your phone number, town or postcode and short notes, choose the visit type and a time, and accept the booking terms. Property type and size are optional for bookings too.
• We use these details to answer you, organise the visit, send you a confirmation email and notify the RiviAir team. Visit bookings are added to the RiviAir team’s Google Calendar.
• To block spam, forms use Cloudflare Turnstile, which checks your browser before the request is sent.

Client space and care plans

• We check the email domain’s mail records through Cloudflare DNS; we do not send the full email address to that service or verify that an individual mailbox exists. Existing-account purchases are linked only after verified ownership. Incorrect purchase emails can be corrected by the RiviAir team after payment identity checks.
• During care-plan checkout, we retain your contact, installation and billing details and accepted agreement securely. After confirmed payment, we create or link your account and email a secure access link. Existing account details are not overwritten.
• Your client space uses your email address and password, or Google sign-in. It shows your appointments, care plan, any voucher code used, and the work records and photos from our visits.
• Card payments are made in Stripe’s secure payment window. We receive the payment status and a Stripe customer reference, not your full card details.

Website assistant and WhatsApp

• Messages you type in the website assistant are sent through the Lovable AI Gateway to OpenAI to write the reply. This website does not save chat logs. Please do not share sensitive information in the chat.
• The WhatsApp button opens WhatsApp. Anything you send there is handled through WhatsApp under its own terms.

Cookies, analytics and browser storage

• Google Analytics is connected to this website and runs only with your consent.
• Google Analytics runs only if you accept analytics. It then records page-view events on our public pages and sets its own cookies (such as _ga) holding an identifier for your browser. Google also receives technical connection and device information, such as your IP address (used for approximate location) and your browser and device type. We remove query details from page addresses and never send form contents. You can withdraw your choice at any time in Cookie settings at the bottom of every page.
• Your browser remembers your language and analytics choice, a care-plan quote in progress, the page to return to after signing in, and your sign-in session.
• Lovable’s built-in analytics is separate from Google Analytics. It records pages visited, where visitors came from, country, browser, operating system and device type, time on page, page speed and errors. It uses no cookies, stores nothing on your device, does not keep IP addresses and does not identify visitors. Lovable collects this data for us; Lovable’s privacy policy (lovable.dev/privacy) explains how it handles it. Detailed data is kept for 90 days and daily summaries for a year. We rely on our legitimate interest in running and improving the website.
• RiviAir also uses Cloudflare statistics to understand website traffic and keep the site secure, based on our legitimate interest. Cloudflare Turnstile is a separate security check used on our forms.
• Pages load fonts from Google Fonts, and our Google reviews show reviewer photos from Google, so your browser connects to Google to display them.

Strictly necessary cookies

• Essential cookies support sign-in, website delivery, spam protection and payment security. They are separate from optional analytics and marketing cookies. Hosting version cookie (__dpl): identifies the current website version and supports the correct functioning and delivery of website content. It does not require consent when used only for this necessary purpose; any use for visitor tracking, analytics or nonessential testing requires reassessment. Its observed browser lifetime is approximately 24 hours.
• Cloudflare uses __cf_bm for bot protection (observed lifetime: 30 minutes). Turnstile pre-clearance is enabled according to the RiviAir team and may set cf_clearance; its lifetime has not been verified on this website.

Payment Processing Cookies (Stripe)

• We use Stripe to securely process payments and subscriptions. Stripe loads when you open a care-plan payment window, not automatically while browsing our services. Stripe uses browser and device information and cookies to authenticate payments, assess fraud risk and protect transactions. Observed identifiers include __stripe_mid (approximately one year), __stripe_sid (30 minutes) and m on Stripe’s domain (approximately 400 days). These are browser lifetimes, not guarantees about Stripe’s data retention.
• During the payment process, Stripe may also set additional cookies for payment authentication, transaction security, fraud prevention and the operation of selected payment methods. The cookies identified during testing are indicative and may differ depending on the payment method used and the security checks required. For further information about Stripe’s cookies and their purposes, please refer to Stripe’s Privacy Centre.

Stripe Privacy Centre

Who receives your information

• The RiviAir team, and the service providers that run this website for us: Lovable (website hosting, plus the Lovable Cloud database, sign-in and confirmation emails), Google (Calendar, sign-in, Fonts, reviews and, with consent, Analytics), Stripe, Cloudflare, and the Lovable AI Gateway with OpenAI for the assistant.
• Within RiviAir, customer information in the website admin area, the info@riviair.com inbox and the business calendar is accessed by the owner and authorised team members.

Legal bases

• We use your personal information for the following purposes under the General Data Protection Regulation (GDPR).
• Quotes, appointments and services you request. When you ask for a quote, video consultation or visit for yourself, we use the information we need to respond and arrange it. If you become a customer, we use the information needed to provide the agreed service, manage your care plan and client account, process payments, and make service reports available to you. Our legal basis is taking steps at your request before entering into a contract or performing our contract with you (Article 6(1)(b)).
• General enquiries, business contacts and website security. We use contact information to respond to general enquiries and communicate with people acting on behalf of a business, property owner or other customer. We also use security checks to protect our website and forms against spam and abuse. Our legal basis is our legitimate interest in handling enquiries, coordinating our work and keeping the website secure (Article 6(1)(f)).
• Accounting and tax records. We use and keep invoice and transaction information where required to meet our accounting and tax obligations (Article 6(1)(c)).
• Website assistant. We provide instant answers to visitor questions based on our legitimate interest (Article 6(1)(f)); the website does not save chat logs.
• Website analytics. We use Google Analytics to understand how visitors use the website if you give us permission (Article 6(1)(a)). You can withdraw your consent at any time in Cookie settings at the bottom of the website.

How long we keep information

• Enquiries and quotes. If an enquiry, quote or appointment request does not lead to a job or care plan, we keep it for up to 12 months after our last exchange about it. This applies to requests received through our website, email or WhatsApp.
• Customer accounts and service records. We keep the information needed to manage your account, appointments and services while you are a customer. After the relationship ends, we keep records needed for warranties, insurance claims or disputes for the applicable warranty or legal claims period. Access to archived records is restricted.
• Invoices and accounting records. We keep invoices and supporting accounting records for 10 years from the end of the financial year they relate to.
• Online consumer contracts. Where French law requires us to archive a consumer contract concluded online for €120 or more, we keep it for the applicable 10-year period.
• Website analytics. If you accept Google Analytics, we set user- and event-level data retention to 14 months. You can withdraw your consent for future analytics at any time in Cookie settings.
• Website assistant. Our website does not save a chat history. If RiviAir keeps a record relating to an assistant interaction, we keep it for up to 12 months from the date of that interaction. Messages are processed through Lovable’s AI Gateway and OpenAI to generate replies. These providers may apply their own retention periods.
• We apply these periods as part of our regular business routines, including periodically clearing non-converted enquiries and emails after 12 months.

Transfers outside the EU

• Some of our technical providers, such as Stripe, Google, Cloudflare and OpenAI (via Lovable), may process information outside the European Union. These transfers rely on the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework.

Your rights

• Depending on the situation, you can ask to access, correct or delete your information, restrict or object to its use, receive a copy, and withdraw consent at any time. Write to us at the email address below.
• You can also complain to the CNIL, the French data protection authority.

Make a complaint to the CNIL