I. Identity and address of the Data Controller
| Data Controller | LEADWAY CRM SOFTWARE BY LEVA |
| Tax ID (RFC) | LCS250213850 |
| Trade name | Ryvo (ryvo.so) |
| Address | Monterrey, Nuevo León, Mexico |
| team@ryvo.so | |
| Website | ryvo.so |
Legal
Privacy policy
Ryvo: automation and AI platform
- Last updated
- August 2026
- Version
- 1.1
- Related document
- Terms of Service
Contents
This Privacy Policy (Aviso de Privacidad) is issued in compliance with the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations, as well as the Privacy Notice Guidelines issued by the INAI. The Data Controller is LEADWAY CRM SOFTWARE BY LEVA, operator of the Ryvo platform (ryvo.so).
II. Personal data we collect
A. Ryvo Customers(individuals or representatives of legal entities)
- Identification data: full name, job title, company name.
- Contact data: email address, phone number, tax address.
- Billing and payment data: tax ID (RFC), tax regime, credit card or bank account details (processed by Stripe; Ryvo does not store card data on its servers).
- Platform usage data: voice Agent configuration, scripts, uploaded contact lists, conversation metrics.
- Communication data: emails and messages exchanged with the Ryvo team.
B. End Users(leads, prospects and customers of our Customers)
Data processed:
- Phone number from which the call is placed or received.
- Audio recording of the conversation with the voice Agent.
- Automatically generated text transcript of the conversation.
- Outcome of the conversation: lead qualification, appointment booked, case resolved.
- Data voluntarily provided by the End User during the conversation (name, email, needs, etc.).
- Call metadata: date, time, duration, number dialed.
III. Purposes of processing
A. Primary purposes(necessary to provide the service)
- Identify and manage the business relationship with the Customer.
- Provide the contracted communications automation and artificial intelligence Services.
- Configure, operate and maintain the Customer's voice Agent.
- Process the Agent's conversations with End Users and record their outcomes in the Customer's CRM.
- Generate transcripts and conversation analyses for the Customer's dashboard.
- Process Setup and Monthly Fee payments through Stripe.
- Issue digital tax receipts in accordance with SAT (Mexican tax authority) regulations.
- Send monthly metrics reports to the Customer.
- Handle the Customer's technical and operational support requests.
- Comply with applicable legal, tax and regulatory obligations.
B. Secondary purposes(optional)
- Send communications about Ryvo updates, new features or promotions. The Customer may object to this processing at any time by writing to team@ryvo.so.
- Compile aggregated, anonymized statistics on platform usage to improve the Services. This data does not allow any person to be identified.
IV. Transfers of personal data
A. Infrastructure(hosting and platform data)
| Sub-processor | Country | Data transferred | Purpose |
|---|---|---|---|
| Vercel Inc. | USA | Account data, platform traffic, usage logs | Hosting and execution of the Ryvo web application |
| Supabase Inc. | USA | All platform data: accounts, configuration, conversations | Database, authentication and file storage |
| Upstash Inc. | USA | Session and tenant identifiers | Caching and usage rate limiting |
| Functional Software, Inc. (Sentry) | USA | Error logs and their technical context | Error monitoring and fault diagnosis |
B. Voice and artificial intelligence(the Agent's conversational engine)
| Sub-processor | Country | Data transferred | Purpose |
|---|---|---|---|
| ElevenLabs, Inc. | USA | Voice recordings, conversation audio | Voice synthesis and the Agent's conversational engine |
| Cartesia AI, Inc. | USA | Text to be synthesized into speech | Alternative voice synthesis, depending on the voice chosen by the Customer |
| Anthropic PBC | USA | Transcripts and conversation context | Language model that generates the Agent's responses |
| Langfuse GmbH | Germany | Conversation traces with personal data redacted | Observability of the Agent's performance. Enabled only if configured |
C. Channels and integrations(telephony, calendar, CRM and automation)
| Sub-processor | Country | Data transferred | Purpose |
|---|---|---|---|
| Telnyx LLC / Twilio Inc. | USA | Phone number, call metadata | Telephony infrastructure for calls |
| Cal.com, Inc. | USA | Name, email, phone and details of the booked appointment | Appointment scheduling and synchronization |
| n8n GmbH | Germany | Contact data, conversation outcomes | Workflow automation and orchestration |
D. Payments and email(billing and communication with the Customer)
| Sub-processor | Country | Data transferred | Purpose |
|---|---|---|---|
| Stripe, Inc. | USA | Customer payment data | Payment processing and billing |
| Plus Five Five, Inc. (Resend) | USA | Email address and content of messages sent to the Customer | Delivery of transactional emails and reports |
Transfers to providers established abroad are carried out under the terms of Article 36 of the LFPDPPP.
V. Security measures
- Encryption of data in transit using TLS/HTTPS protocols.
- Encryption of data at rest in the database with AES-256.
- Access to personal data restricted through multi-factor authentication and role-based control.
- Sub-processor API keys and credentials encrypted and stored in a secure vault; never exposed to the frontend.
- Logical isolation between the data of different Customers through tenant identifiers.
- Audit logs of access to and operations on personal data.
- Periodic review of security measures and of agreements with Sub-processors.
VI. ARCO rights
Data subjects have the right to Access, Rectify, Cancel or Object to (ARCO rights) the processing of their personal data, as established in the LFPDPPP.
To exercise your ARCO rights, send your request to team@ryvo.so including:
- Full name of the data subject and a copy of a valid official ID.
- A clear and precise description of the data in respect of which you seek to exercise an ARCO right.
- Any document or information that helps locate the data.
- In the case of the right of Rectification, the requested changes and supporting documentation.
Ryvo will respond within a maximum of 20 business days. If the request is granted, the right will be made effective within the following 15 business days.
VII. Use of cookies
| Type | Examples | Purpose |
|---|---|---|
| Essential | Session, authentication | Required for the site to function. They cannot be disabled. |
| Analytics | Google Analytics | Anonymous analysis of traffic and user behavior on the site. |
| Functional | Language preferences | Remember user preferences to improve the experience. |
Users may configure their browser to reject or delete cookies at any time, although this may affect the functionality of the site.
VIII. Data of minors
Ryvo's Services are intended exclusively for persons over 18 years of age and for businesses. Ryvo does not knowingly collect or process personal data of minors. If the Customer becomes aware that an End User who interacted with the voice Agent is a minor, the Customer must notify Ryvo immediately at team@ryvo.so so that the corresponding data can be deleted.
IX. Conversation recordings
Given that voice recordings constitute personal data of a potentially sensitive nature:
- Informing the End User: At the start of each conversation, the voice Agent informs the End User that they are interacting with an artificial intelligence system and that the conversation may be recorded. The End User has the option not to continue the conversation.
- Purpose: Recordings are used to: (i) generate the transcript of the conversation; (ii) record the outcome in the Customer's CRM; (iii) allow the Customer to review the conversation from their dashboard; and (iv) analyze the Agent's performance for its continuous improvement.
- Retention period: Recordings are retained for a maximum of 12 months from the date of the conversation, unless the Customer requests their early deletion or there is a legal obligation to retain them for longer.
- Access: Restricted to the Customer holding the account, authorized Ryvo personnel and ElevenLabs to the extent strictly necessary to provide the voice service.
- Deletion: The data subject may request the deletion of a specific recording by writing to team@ryvo.so.
X. Changes to this Privacy Policy
LEADWAY CRM SOFTWARE BY LEVA reserves the right to modify this Privacy Policy at any time. Changes will be notified by publication on ryvo.so and, in the case of substantial changes, also by email to registered Customers.
XI. Right to file a complaint with the INAI
If the data subject considers that their right to the protection of personal data has been infringed, they may file a complaint with the INAI (Mexico's data protection authority):
- Website: www.inai.org.mx
- Phone: 800 835 4324 (INFOMEX)
XII. Contact and Privacy Officer
| team@ryvo.so (subject: Data privacy) | |
| Website | ryvo.so |
| Address | Monterrey, Nuevo León, Mexico |
| Business hours | Monday to Friday, 9:00 to 19:00 (CST) |