Privacy Policy

Riverfront, a Dravya product Effective date: 27 August 2026 Last updated: 14 September 2026

1. Who this policy covers

This Privacy Policy explains how Dravya ("Dravya," "we," "us," or "our"), the company behind Riverfront, collects, uses, and protects personal data when you visit getriverfront.com (the "Site") or otherwise interact with us through the Site, for example by requesting a demo or booking a call.

This Privacy Policy covers website visitor data only. It does not apply to any data the Riverfront application encounters while testing a client's AI agent, including scenario transcripts, findings, or any personal data that may appear in them. That processing is governed by the service agreement and data processing terms agreed separately with each client, with Riverfront acting as a processor on that client's behalf, not by this Site policy.

Dravya is a UAE entity. Contracts, delivery, and accountability for Riverfront sit with Dravya.

Registered entity: DRAVYA TECHNOLOGIES LIMITED Registered address: DIFC, Dubai, United Arab Emirates

2. Personal data we collect

Data you provide to us directly. When you book a meeting through our scheduling tool or email us, we collect what you provide, typically your name, work email address, company or organization, job title, and the content of your message.

Data collected automatically. Like most websites, our Site and hosting infrastructure automatically log standard technical data when you visit, including your IP address, browser and device type, referring page, pages viewed, and timestamps.

Cookies and analytics. We use analytics cookies through Google Analytics 4 to understand which pages are read and which links are clicked. We do not use advertising or targeting cookies, and we have not enabled Google Signals.

EU, wider EEA, UK, Switzerland. Analytics is off by default. We ask first, via a banner. Decline or ignore it, and no analytics cookie is set and no data reaches Google.

Everywhere else, including the UAE and the US. Analytics is on by default, and this policy is your notice of that.

When analytics is active for you, Google Analytics sets cookies in the '_ga' family to distinguish visitors and sessions, and processes your IP address, the pages you view, an approximate location derived from that IP, and your browser and device type. We remember your preference in your browser's local storage so we do not ask again, and that record itself is not shared with anyone. You can change or withdraw your choice at any time via the footer control, or by clearing this site's data in your browser.

We do not knowingly collect any special category or sensitive personal data through the Site.

3. How we use your data and our legal basis

The list below covers both what we do with your data and why we are allowed to, for visitors in the EEA, the UK and Switzerland under GDPR, and for visitors elsewhere.

• Responding to pilot and demo requests. We use what you submit to follow up about a potential engagement. In the EEA, the UK and Switzerland, the basis is steps taken at your request, prior to a contract. Elsewhere, including the UAE and the US, the basis is contractual necessity
• General inquiries and sending materials you asked for. We reply to your questions and send requested materials. The basis is legitimate interest, both in the EEA, the UK and Switzerland and elsewhere
• Operating and securing the Site. Technical and server logs help us run and protect the Site. The basis is legitimate interest, both in the EEA, the UK and Switzerland and elsewhere
• Understanding Site usage (analytics). Google Analytics tells us which pages and links get used. In the EEA, the UK and Switzerland the basis is consent: analytics is off by default and nothing loads until you agree. Elsewhere it is enabled by default where permitted by applicable law, and you can opt out at any time via the footer
• Legal and regulatory compliance. Retaining or disclosing data where the law requires it. The basis is legal obligation, both in the EEA, the UK and Switzerland and elsewhere

We do not rely on consent as the legal basis for handling a business inquiry submitted through this Site, and we do not use website visitor data to train or evaluate any AI model or agent. Riverfront's testing product operates on data supplied by clients under a separate agreement, entirely apart from this Site.

4. Applicable UAE data protection law

Dravya Technologies Limited is registered in the Dubai International Financial Centre (DIFC), a jurisdiction with its own independent data protection regime. We process personal data collected through this Site in accordance with the DIFC Data Protection Law (DIFC Law No. 5 of 2020, as amended), which is enforced by the DIFC Commissioner of Data Protection, including its principles of lawfulness, purpose limitation, data minimization, accuracy, storage limitation, and security. Depending on the nature of the personal data involved and where you are located, other UAE federal or international data protection laws may also apply.

5. Who we share data with

We do not sell personal data. We share it only with:

• Service providers who process data on our behalf, such as our hosting and infrastructure providers, email and calendar tools, and a scheduling tool for booking calls
• Google, as the provider of Google Analytics, where analytics is active for you, either because you agreed, in regions requiring prior consent, or because you have not opted out, where it is enabled by default. Google acts as our processor under its Data Processing Terms. If you decline or opt out, no further data reaches Google
• Professional advisors, such as legal or accounting counsel, where necessary
• Authorities, where required by law, regulation, or valid legal process

Each of these parties is only permitted to use personal data for the purpose we've specified.

6. International data transfers

Website visitor data may be processed by service providers located inside or outside the UAE. Where personal data is transferred internationally, we take reasonable steps to ensure it remains protected consistent with applicable data protection law.

• Google (Google Analytics), United States. The transfer relies on Google's EU-US Data Privacy Framework certification, plus the Standard Contractual Clauses in Google's Data Processing Terms
• Other service providers (hosting, email, scheduling), inside or outside the UAE depending on the provider. The transfer relies on contractual safeguards consistent with applicable data protection law

If you decline or opt out of analytics, no further visitor data is transferred to Google.

7. Third parties

The Site may link to external websites or services we do not control, for example our scheduling tool, our social media channels, or dravya.ai. This Policy does not cover how those third parties handle your data; please check their own privacy notices before providing information to them.

8. How long we keep data

We keep personal data collected through the Site, such as form submissions and related correspondence, for up to 12 months after our last contact with you, unless a longer period is required by law or you ask us to delete it sooner. Automatically collected technical logs are retained for up to 30 days for security purposes. Google Analytics user-level and event-level data, where analytics is active for you, is configured to be retained for up to 14 months, after which it is automatically deleted in accordance with Google Analytics' retention settings. We do not export this data to another system for longer retention.

9. Your rights

Depending on where you are located, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data
• Object to or restrict certain processing
• Request a portable copy of data you provided to us
• Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, contact us using the details in Section 12. We will respond within the timeframe required by applicable law.

If you believe we have not addressed your concern, you have the right to lodge a complaint with the relevant supervisory authority. Given Dravya's registration in the DIFC, that includes the DIFC Commissioner of Data Protection; if you are located elsewhere, you may instead contact your own local data protection authority.

10. Children's privacy

The Site is intended for business audiences and is not directed at children. We do not knowingly collect personal data from anyone under 18.

11. Security

We use reasonable technical and organizational measures designed to protect personal data, including appropriate access controls and security measures. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Contact us

Questions about this Privacy Policy, or requests relating to your personal data, can be sent to:

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will post the updated version on this page with a new "Last updated" date, and for material changes we will provide a more prominent notice where appropriate.

This Privacy Policy describes practices for getriverfront.com. It is one part of Dravya's overall approach to data protection and does not itself constitute legal advice, either to you or about your own compliance obligations.