Privacy Policy

Last updated: October 15, 2026

This Privacy Policy explains what personal information Striveloom collects, why we collect it, how we use and share it, how long we keep it, and the choices and rights you have. It applies to striveloom.com, the Striveloom web application, our AI add-ons (including the AI Phone Agent), our free public tools, and our agency services, and our Shopify apps (see Section 15). We have written it in plain English. If anything is unclear, email hello@striveloom.com.

1. Who we are

Striveloom is operated by Rioco LLC, a Wyoming limited liability company doing business as Striveloom, 30 N Gould St STE R, Sheridan, WY 82801, United States (“Striveloom”, “we”, “us”). Website: striveloom.com.

Controller and processor roles

• We are the controller of personal information about our own website visitors, account holders, prospects, and customers (for example, your account details, billing information, and how you use our site).
• We are a processor (service provider) for the information our business customers put into, or collect through, the platform about their customers and contacts. Examples: the callers who speak with a customer's AI Phone Agent and their transcripts, chatbot conversations with a customer's website visitors, leads in a customer's CRM, and prospects contacted through AI SDR. For that data we act on our customer's instructions, under our Data Processing Addendum. If you are one of those end users and want to exercise your rights, please contact the business you interacted with; we will help them respond.

2. Information we collect

Information you give us

• Account information: name, email address, password (stored hashed by our authentication provider), phone number if you add one, organization name, and role. If you sign in with Google or Facebook, we receive your name, email address and profile picture from that provider.
• Billing information: billing name, email, address, tax details and subscription history. Card and bank details are collected and stored by Stripe; we never see or store full card numbers. If you use Reseller Mode, Stripe Connect collects the identity and payout information it requires.
• Forms and bookings: what you submit through our contact, booking, quote, intake and newsletter forms, such as name, email, company, website, budget, project details and preferred meeting times.
• Communications: emails, support tickets, chat messages and call notes when you contact us.
• Customer content: anything you upload or create in the platform: websites and themes, documents and knowledge-base files for chatbots, meeting recordings you upload for AI Meeting Notes, social posts, email campaigns and lead lists for AI SDR, business data you connect for AI Founder OS, voice samples you upload to create a custom voice, and settings and prompts for your AI agents.

Information collected when you use the AI Phone Agent and messaging add-ons

• Call data: caller and called phone numbers, call times, duration, call status, cost metering, the live audio stream (processed in real time to understand and answer the caller), the text transcript, AI-generated summaries, and details the caller shares (such as name, email, reason for calling and requested meeting time). Where a customer enables call recording, we also store the recording. Recordings are kept for 30 days by default (configurable by the customer) and then purged.
• Consent records: records of call, SMS and recording consent and do-not-call requests that the customer or caller provides.
• Messaging data: messages, sender identifiers and metadata exchanged through WhatsApp, Telegram, website chatbots and voice bots that a customer connects.

Information from connected third-party accounts

When you choose to connect another service, we receive the access tokens and data that service shares with us under the permissions you approve. Depending on what you connect, this can include: Google (see Section 5), Microsoft Outlook calendar, LinkedIn, Meta (Facebook, Instagram, WhatsApp Business), X (Twitter), TikTok, accounting tools (Xero, QuickBooks, Sage), CRM and team tools (HubSpot, Pipedrive, Slack, Microsoft Teams, Discord), and Stripe. OAuth refresh tokens and API secrets are encrypted at rest with AES-256-GCM. You can disconnect at any time.

Information collected automatically

• Usage and device data: IP address, browser and device type, operating system, pages viewed, referring URL, actions in the app, and timestamps.
• Cookies and similar technologies: see Section 8 and our Cookie Policy.
• Security data: sign-in events, audit logs of administrative actions, rate-limit counters, and bot-protection signals.

Free public tools

When you use free tools such as the website roast, LLM Recall (AI brand visibility checks) or the SEO audit, we process the website URL or brand name you enter, the results, and your IP address (for abuse prevention and rate limiting). If you enter your email to receive results, we use it to send them.

3. How we use information and our legal bases

For people in the European Economic Area (EEA) and the United Kingdom, we rely on the legal bases shown below.

We do not use your information to make decisions that produce legal or similarly significant effects about you based solely on automated processing.

4. AI processing

• To provide AI features, we send the relevant content (for example, a caller's speech, a chat message, a document, or a prompt) to the AI and voice providers listed in Section 6, which process it and return a result.
• We do not use customer content, call audio, transcripts or connected-account data to train our own AI models, and we do not sell it.
• We use these providers through their commercial APIs. Anthropic and OpenAI state in their API terms that they do not use API inputs or outputs to train their models by default. Each provider handles data under its own terms and may retain it for a limited time for abuse monitoring, so we send only the data a task needs.
• AI output can be inaccurate. Customers are responsible for reviewing AI output before relying on it.
• Voice clones are created only from voice samples you upload and are authorized to use. We send the sample to ElevenLabs to create the voice and keep only the resulting voice ID; you can delete a clone at any time.

5. Google user data

Striveloom accesses Google user data only when you choose to sign in with Google or connect a Google account, and only for the purposes below.

• Storage and security: OAuth refresh tokens are encrypted at rest (AES-256-GCM) in our database, access tokens are short-lived, and all data is transmitted over TLS. Calendar events we create live in your Google account; we keep the event ID and meeting details needed to show the booking in your dashboard.
• No sale, no advertising: we do not sell Google user data, and we do not use or transfer it for advertising, retargeting, or interest-based ads, or to determine credit-worthiness or for lending.
• No AI training: we do not use Google user data to develop, improve or train generalized or non-personalized AI or machine-learning models.
• Limited human access: our staff do not read Google user data unless you give us explicit permission (for example, in a support request), it is necessary for security purposes such as investigating abuse, or it is required to comply with applicable law.
• Sharing: we transfer Google user data only to provide or improve the user-facing features described above, to comply with law, or as part of a merger or acquisition with appropriate protections.
• Deletion: you can revoke access at any time at myaccount.google.com/permissions or by emailing hello@striveloom.com. When you disconnect, ask us, or delete your account, we delete the stored Google tokens and Google-derived data within 30 days, except where we must keep limited records by law.

Striveloom's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Separately, we use Google Search Console and Google Ads APIs only to manage Striveloom's own accounts; those connections do not involve your Google data.

6. How we share information

We do not sell personal information. We share it only as follows:

• Service providers (sub-processors) that host, process or deliver the service for us under contracts that limit their use of the data (table below).
• Third-party services you connect or direct us to use, such as publishing a post to LinkedIn, sending a WhatsApp message, creating a calendar event, or forwarding a lead to your CRM.
• Resellers: if you buy through a reseller workspace, that reseller can see your account and subscription information.
• Legal and safety: when required by law, subpoena or court order, or to protect the rights, property or safety of Striveloom, our customers or others.
• Business transfers: in a merger, acquisition, financing or sale of assets, subject to this policy.

Sub-processors

We may update this list as our service changes. Under our DPA, business customers get at least 30 days' notice of new sub-processors and can ask hello@striveloom.com to be notified of changes by email.

7. Call recording, telemarketing and end-user notices

Customers who use the AI Phone Agent, AI SDR, WhatsApp or other outreach features decide whom to contact and whether calls are recorded. Customers are responsible for giving any notices and obtaining any consents that the law requires, including call-recording consent in two-party/all-party consent states and countries, disclosures that the caller is speaking with an AI, and compliance with telemarketing, do-not-call and anti-spam laws (such as the TCPA, the FTC Telemarketing Sales Rule and CAN-SPAM). The platform provides recording-disclosure settings and do-not-call/consent records to help.

8. Cookies, analytics and advertising

• Essential: authentication and session cookies (Supabase), security and bot-protection, and your cookie-preference setting.
• Analytics (optional): PostHog product analytics (page views, page leaves and in-app events, linked to your user ID and email when you are signed in and have consented). Vercel Web Analytics and Speed Insights are cookieless, aggregate, performance-focused measurement and run for everyone.
• Advertising (optional): we use the Google Ads tag (gtag.js) to measure conversions (such as a completed purchase or booked call) and for remarketing, which may show you Striveloom ads on other sites. With your consent, Google may set cookies and collect your IP address and browsing activity for this purpose.

How consent works

• EEA, UK and Switzerland: we determine your approximate region from your IP address. In these regions, analytics and advertising cookies stay off until you opt in through our cookie banner. Until then PostHog does not set cookies, capture events or identify you, and the Google Ads tag runs in Google Consent Mode v2 with all consent signals set to “denied”, so it sets no advertising cookies and sends Google only cookieless conversion signals.
• Everywhere else: analytics and advertising cookies are on by default, and you can reject them at any time in the cookie banner. Rejecting switches PostHog off and sets all Google Consent Mode signals to “denied”.
• Global Privacy Control: we honor the GPC browser signal. If your browser sends it, we treat it as a rejection of analytics and advertising cookies, and as a request to opt out of the “sale” or “sharing” of personal information and targeted advertising, in every region. GPC also overrides a choice you made earlier without it; if you then turn these cookies on in our cookie settings while GPC is on, we respect that explicit choice.

You can change or withdraw your choice at any time through the “Cookie settings” link in the site footer. You can also control Google ad personalization at adssettings.google.com, opt out of interest-based advertising at optout.aboutads.info or youronlinechoices.eu, and block or delete cookies in your browser. Our Cookie Policy lists every cookie we use.

9. Data retention

• Account and customer content: for as long as your account is active. When you delete your account it is deactivated immediately and permanently deleted after a 30-day grace period (during which you can ask us to restore it); copies in backups roll off on our providers' backup schedule.
• Call recordings: 30 days by default, or the period the customer sets. Transcripts and call records are kept while the customer's account is active unless the customer deletes them.
• Billing and tax records: as long as required by tax and accounting law (generally up to 7 years).
• Leads, inquiries and booking requests that do not become customers: up to 24 months from last contact, unless you ask us to delete them sooner.
• Shopify app data: 12 months, then deleted automatically (see Section 15).
• Security and audit logs: as long as needed for security, fraud prevention and legal compliance.

10. Security

We use encryption in transit (TLS) and at rest, AES-256-GCM encryption for stored OAuth tokens and API secrets, row-level security to isolate each organization's data, multi-factor authentication for administrators, audit logging, rate limiting and bot protection. No system is perfectly secure; if we learn of a breach affecting your personal information, we will notify you and regulators as the law requires. Report security issues to security@striveloom.com. More detail is on our Security page.

11. International transfers

We are based in the United States and our main providers process data in the United States (and some in other countries listed in Section 6). When we transfer personal data from the EEA, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), or on the recipient's certification under the EU-U.S. Data Privacy Framework where applicable, together with appropriate safeguards.

12. Your privacy rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you and get a copy in a portable format;
• correct inaccurate information;
• delete your information;
• restrict or object to certain processing, including direct marketing;
• withdraw consent at any time, without affecting earlier processing;
• opt out of the sale or sharing of personal information and of targeted advertising;
• limit the use of sensitive personal information; and
• lodge a complaint with your local data-protection authority.

California (CCPA/CPRA) and other US state notice

In the last 12 months we collected the categories described in Section 2: identifiers, customer records, commercial information, internet and network activity, audio information (calls), professional information, and inferences from product usage. We collect them for the purposes in Section 3 and disclose them to the service providers in Section 6. We do not sell personal information for money. Our use of the Google Ads tag for remarketing may count as “sharing” for cross-context behavioral advertising under California law. To opt out, turn off marketing cookies through the “Cookie settings” link in our footer, enable Global Privacy Control in your browser (we honor it automatically as an opt-out of sale and sharing), or email hello@striveloom.com with the subject “Do Not Sell or Share”. We do not use sensitive personal information to infer characteristics about you. We will not discriminate against you for exercising your rights.

How to exercise your rights

Signed-in users can export their data and delete their account from Dashboard → Settings. You can also email hello@striveloom.com. We will verify your identity (usually by confirming control of your account email) and respond within 30 days (GDPR/UK GDPR) or 45 days (US state laws), extendable where the law allows. You may use an authorized agent; we may ask for proof of authorization. If we deny your request, you can appeal by replying to our decision, and we will respond within the time the law requires.

13. Marketing emails

You can unsubscribe from newsletters and marketing emails at any time using the unsubscribe link in each email or by emailing hello@striveloom.com. We will still send essential service and billing messages while you have an account.

14. Children

Striveloom is a business service and is not directed to anyone under 16. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, contact us and we will delete it.

15. Our Shopify apps

Rioco LLC (dba Striveloom) publishes two apps for Shopify merchants: Striveloom AI (an AI shopping assistant and AI product SEO tool) and Striveloom COD Confirm AI (cash-on-delivery order confirmation over WhatsApp). This section explains what data each app processes. It applies in addition to the rest of this policy.

Who is responsible for the data

The merchant who installs the app is the controller of their shoppers' and customers' personal data. Striveloom acts as the merchant's processor and processes that data only to provide the app, on the merchant's instructions and under our Data Processing Addendum. If you are a shopper and want to access or delete your data, contact the store you shopped with; we will help them respond. We are the controller only of the merchant's own account details (for example, the store name and the store owner's email).

Striveloom AI

• Shopper chat messages: what shoppers type into the store's chat and the assistant's replies, a random visitor id, the Shopify customer id if the shopper is logged in, and “helpful / not helpful” feedback. If a shopper asks for a person and gives an email address, that email is stored with the request and sent to the merchant.
• Product and store data read through the Shopify Admin API to answer questions: products, variants, prices, availability and the store's published policies. AI product SEO drafts are saved for the merchant to review and are only published when the merchant clicks Publish.
• Order status lookup: only after the shopper gives an order number and the email on that order, and both match. The assistant then shares the order's status and tracking only, never addresses, items or payment details. The verified email is stored with the conversation.
• Sales attribution: when the store's cookie consent allows analytics (or consent is not required in the shopper's region), the chat saves the visitor id in the browser and adds it to the cart. When an order is placed, we record the order id, number, total, currency and which recommended products it contained, so the merchant can see AI-assisted sales. No name, address or payment details are stored. Without consent, the visitor id is kept for the browser tab only and no order is attributed.

Striveloom COD Confirm AI

• Order data: cash-on-delivery orders read through the Shopify Admin API, including the order number, items, total, and the customer's name, phone number and shipping address, used to ask the customer to confirm the order and to update the order in Shopify.
• WhatsApp messages: the confirmation messages sent to the customer and their replies. They are sent and received through the merchant's own Meta WhatsApp Business (Cloud API) account, which the merchant connects to the app; Meta's terms and privacy policy also apply to those messages. Replies may be read by an AI model to understand whether the customer confirmed, cancelled or asked to change something.

How we use it, and what we don't do

We use this data only to run the features the merchant turns on and to show the merchant their conversations, orders and reports. We do not sell it, use it for advertising, or use it to train AI models ourselves. The AI providers below process it to generate replies under their own API terms; we send only what a reply needs.

Sub-processors for the Shopify apps

Retention and deletion

• Chat conversations and WhatsApp messages kept by the apps are deleted automatically after 12 months; COD order records are anonymized at that point (name, phone, email and address removed) so merchants keep only aggregate statistics.
• We support Shopify's mandatory privacy webhooks. When Shopify sends a customer data request, we compile that customer's data and send it to the store owner. When Shopify sends a customer redaction request, we delete that customer's data. When a merchant uninstalls an app, Shopify sends a shop redaction request 48 hours later and we delete all of that store's data.
• Merchants can also ask us to delete their store's data at any time by emailing support@striveloom.com.

16. Changes to this policy

We may update this policy as our services or the law change. We will post the new version here with a new “Last updated” date and, for material changes, notify account holders by email or in the app before the change takes effect.

17. Contact us

Rioco LLC (dba Striveloom)
30 N Gould St STE R, Sheridan, WY 82801, United States
Privacy requests: hello@striveloom.com
Security: security@striveloom.com

See also our Terms of Service, Cookie Policy, Data Processing Addendum and Acceptable Use Policy.