Privacy Policy

Last updated: November 9, 2026

This policy explains how FOL Yazılım A.Ş. ("FOL Yazılım", "we") processes personal data in the RiverAI platform and the RiverAI mobile app (iOS and Android).

1. Who Is Responsible

RiverAI is an enterprise software platform that organizations provide to their own users. You can only sign in with an account created for you by your organization; accounts cannot be created inside the app.

For the business data your organization processes in RiverAI (forms, workflows, documents, reports), your organization is the data controller and FOL Yazılım acts as a data processor on its behalf and instructions.
If your organization runs RiverAI on its own servers (on-premises), your data stays on those servers and FOL Yazılım has no access to it.
For our website, support requests and the app's notification infrastructure, the controller is FOL Yazılım A.Ş., Abdulhak Molla Sokak No:29, Arnavutköy, 34345 Istanbul, Türkiye · info@river.com.tr.

2. Data the Mobile App Processes

Account data: your username, name, email address, organization and roles. Your password is sent only to your organization's sign-in server; the app does not store it. Session tokens are kept in your device's secure storage (iOS Keychain).
Face ID / Touch ID: biometric checks happen entirely on your device. Biometric data is never sent to the app, to us or to your organization.
Notification identifiers: to send you notifications, your device's push token (Apple Push Notification service / Firebase Cloud Messaging) and the update token of the Lock Screen notification panel are stored on your organization's RiverAI server, linked to your account. They are deleted when you turn notifications off in Settings.
Camera: only when you use it, to scan a QR code for web sign-in and for barcode / photo fields in forms. The scanned code or photo is sent to your organization's server only when you complete that action.
Microphone and voice assistant: only when you start the voice assistant or a video meeting. Your spoken question is sent through your organization's RiverAI server to Google Cloud Speech-to-Text for transcription, to Google Cloud Text-to-Speech to read the answer aloud, and to our AI provider Anthropic to summarize the answer. Recordings are not stored on the device.
Location: the app does not collect your location on its own. If a form of your organization contains a location field, your location is read only when you fill in that field and with your permission.
Content you enter: forms, tasks, approvals, comments, documents and messages are stored on your organization's RiverAI server.
Technical logs: server-side request logs (time, user, action, IP address) are kept for security and troubleshooting.

3. What We Do Not Do

We do not show ads or collect the advertising identifier (IDFA).
We do not track you across other companies' apps and websites.
We do not use third-party analytics or behavior-tracking tools.
We do not sell personal data.

4. Purposes and Legal Bases

We process your data to let you sign in securely, run your organization's business processes, send you task and approval notifications, answer your voice assistant questions, keep the service secure and handle support requests, on the basis of performance of a contract, legal obligations and legitimate interests (Turkish Personal Data Protection Law No. 6698, Article 5).

5. Sharing

Data is shared only as needed to provide the service: with your organization; with Apple and Google to deliver notifications; with Google Cloud and Anthropic for the voice assistant; and with the hosting provider if your organization uses our cloud deployment. Some of these providers are located outside Türkiye; such transfers follow Article 9 of Law No. 6698. Data may be disclosed to authorities where required by law.

6. Retention

Account and content data are kept while your organization uses RiverAI and for the retention periods your organization sets. Notification tokens become invalid and are removed from the server when you turn notifications off, sign out or delete the app. After that, data is deleted, destroyed or anonymized.

7. Your Rights and Account Deletion

You have the right to learn whether your data is processed, request information, and ask for correction, deletion or objection. Because your account is created by your organization, please contact your organization's RiverAI administrator first to delete your account and data. You can also send your request directly to info@river.com.tr; we will resolve it together with your organization within 30 days.

8. Security

Communication between the app and the server is encrypted with TLS, session tokens are stored in the device's secure storage and each organization's data is isolated. Access is limited by the roles and permissions your organization defines.

9. Children

RiverAI is intended for business use and is not directed at anyone under 18.

10. Changes and Contact

When we update this policy we change the date on this page. Questions and requests: info@river.com.tr · Contact