Privacy notice

Riffle B.V., registered with the Dutch Chamber of Commerce under number 42171381, at Tijm 2, 1902 JX Castricum, the Netherlands. For anything in this notice, write to help@riffle.so.

Riffle handles personal data in two different roles, and which one it is decides who makes the decisions.

• As a processor: everything an installer puts into the platform — their technicians, their customers, work orders, calls and photographs. The installer decides; we act on their instruction. That is the data processing agreement, not this page.
• As a controller: what we decide to collect ourselves. Who we write to, who visits this site, who holds an account, who emails us. That is what this notice covers.

If you work for an installer that uses Riffle and you want to know what happens to your data, your employer is the party who decides that. We help them answer it.

That is all of it. We buy no data, add nothing from other sources, run no advertising and sell nothing on.

We write to installers whose week we think Riffle would shorten. What we use to do it is public business information: your company name, your town, your website and the business address printed on it. Our basis is legitimate interest — business communication about a product that fits the work you do.

A link in our email carries a code that tells us who we sent it to. If you open it, we see which pages you read on this site and link that to what we hold about you, so a follow-up is about what interested you. We do not follow you beyond this site, and we keep no raw IP address. If you would rather we did not: open the site without the link, or tell us and we stop.

If you would rather not hear about it: use the unsubscribe link, or write to help@riffle.so. Your address then goes on a suppression list, and that list we do keep — it is the only way to stop a second email. Ask us to delete the whole record and we will.

You sign in to Riffle with a code we email you, or with your Google or Microsoft account. We hold no password, so we cannot lose one.

• With a code: we send six digits to your email address. We do not keep the code. We record only that we sent a message and whether it arrived, under an encoded form of your address rather than the address itself.
• With Google or Microsoft: they confirm who you are and give us your email address, a fixed account id, your name and your profile picture. We never see your password, and we get no access to your mail, calendar, files or contacts.
• For each sign-in we record when it happened, from which IP address and with which browser. That is how we notice someone else trying.

Sign-in runs on Supabase, in Frankfurt. The emails with codes and invitations are sent by Resend from servers in Europe. Resend is a US company and keeps a sent message, code included, in its log for 30 days. That is covered by the standard contractual clauses and the EU-US Data Privacy Framework.

If you choose Google or Microsoft, your sign-in also passes through them. They act as an independent party, under their own privacy notice. We do not decide what they keep.

What we receive from Google we use only to sign you in and recognise your account. We do not use it for advertising, we do not sell it, and we pass it only to the suppliers that make sign-in work. Nobody at Riffle reads it unless you ask us to, security requires it, or the law does. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Installers are going to use Riffle to give their customers a place of their own: the appointment, the work order, the documents. You sign in there with a code sent by email. You don’t need Google or Microsoft for it.

That email comes in your installer’s name, sent by Riffle from mail.riffle.so. Your installer decides what happens to your data and we carry it out, as with everything else they put into Riffle. Questions about your data go to them. If one reaches us, we pass it on and help them answer it.

Here too we do not keep the code, and here too we record the time, IP address and browser of a sign-in to spot misuse.

We share data with the suppliers we work with, and with nobody else. No advertisers, no data brokers.

Some of these process data outside the European Economic Area. Where they do, Riffle puts appropriate safeguards in place: an adequacy decision, the EU-US Data Privacy Framework, or the European Commission’s standard contractual clauses.

The other suppliers that make the platform run, such as storage and the AI processing, are not on this list but in the data processing agreement, because they handle our customers’ data rather than ours. Supabase and Resend are listed here because they also handle your sign-in.

• Approached and never heard from: we delete the record 90 days after the first email.
• Unsubscribed: your email address only, on the suppression list, indefinitely. Otherwise we would write to you again.
• Customer data: for as long as the agreement runs. Invoices and the accounts behind them we keep for 7 years, because Dutch tax law requires it.
• Email with us: for as long as the matter it concerns is open.
• Site measurement: 12 months.
• Your login: for as long as your account exists. After 90 days without using Riffle you sign in again; the account itself stays until it is deleted.
• The sign-in log (time, IP address, browser): 90 days.
• What we record about sign-in emails we sent: 30 days.
• An address that does not exist, or that reported our email as spam, goes on a suppression list in encoded form, so we stop mailing it. An address that did not exist comes off after 12 months.

You may see what we hold about you, have it corrected, have it deleted, have the processing restricted, get your data in a portable file, and object to processing we base on legitimate interest. Write to help@riffle.so; we answer within a month and ask for no more than we need to know it is you.

If we cannot settle it between us, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (https://autoriteitpersoonsgegevens.nl). That right stands whether or not you come to us first.

If you ask us to delete your login, or your employer removes your account, we delete your email address, the link to Google or Microsoft with the name and picture it sent, your sessions, your entries in the sign-in log and what we recorded about your sign-in emails.

What stays is the work. A work order you signed or hours you logged belong to your employer’s records. Your employer decides how long those are kept and whether your name stays on them. In Riffle that work then hangs on a fixed reference with no email address, and nobody can sign in with it.

We keep two things: an address on the suppression list, because otherwise we would email you again, and invoices, for 7 years, because Dutch tax law requires it. The rest leaves our backups within 7 days, as they are overwritten. If you are an installer’s customer, ask your installer; we carry it out.

We use PostHog on its European instance to see which pages get read and how, including recordings of how a page is used; anything you type into a field is masked in them. There are no advertising trackers on this site and we do not follow you to other ones.

When this notice changes, the date at the top changes. When a change affects you and you hold an account, we email you about it.