Version 3.0 · Effective date: 31 October 2026 · Replaces: version dated 9 October 2026

At a glance

• Covers all Rishvi brands: Rishvi, Linnworks Custom, HyperStock, HyperStock AI (HAI) and UK eInvoice. Each brand website also has a short privacy notice based on this Policy.
• Two roles: we normally act as controller for our own business data (enquiries, client contacts, marketing, billing, accounts) and as processor for personal data inside our clients’ systems.
• We do not sell personal data, and we do not use client operational or marketplace data for marketing or to train general-purpose AI models.
• AI is used with controls: approved providers, least-privilege tools, minimum necessary data and user oversight. See section 12.
• Calls may be recorded or transcribed, including by AI note-takers, and we tell participants when this happens.
• Amazon order data is handled under Amazon’s data protection rules, including its time limits. See section 13.
• You have rights to access, correct, delete and object. Email info@rishvi.co.uk.

1. Who we are

Rishvi Ltd (“Rishvi”, “we”, “us”, “our”) is a company registered in England and Wales, company number 08347225. Our registered and operational address is Suite 1, 1st Floor, 730 Romford Road, London, Greater London, England, E12 6BT, United Kingdom.

Rishvi is an e-commerce technology consultancy. We provide Linnworks consultancy, development and support; Odoo services; systems integration; automation, macros and scripts; electronic invoicing; hosting and managed services; and AI-enabled software. We operate these brands and services:

Brand / service	What it is	Website
Rishvi	Consultancy, development, integration and support	rishvi.co.uk
Linnworks Custom	Linnworks development, macros, scripts, apps and integrations	linnworkscustom.com
HyperStock	Inventory, warehouse and order operations software	hyperstock.app
HyperStock AI (“HAI”)	The AI layer on top of HyperStock and authorised connected systems	hyperstock.app
UK eInvoice	E-invoicing technology, integration and readiness services	ukeinvoice.co.uk

We operate an information security management system certified to ISO/IEC 27001:2022.

2. Scope, and how this Policy applies to past, current and future work

This Policy is our main privacy policy. It covers all Rishvi websites, applications, APIs, MCP services, integrations and brands listed above, and any service that links to it. Linnworks Custom, HyperStock and UK eInvoice each have a brand privacy notice on their own website, based on this Policy, giving detail specific to that brand’s website and services. If a brand notice and this Policy differ on something specific to that brand, the brand notice applies to it. Some Rishvi mobile apps, such as HabitFlow, Expense Tracker and Tracblu, have their own app-specific privacy policies. Those policies apply to the relevant app, and this Policy applies to anything they do not cover.

Our websites may link to other businesses in our network, such as effectiveaccountancy.com. These are separate companies with their own privacy policies, and this Policy does not cover them.

This Policy describes how we handle personal data we continue to hold or process, including information relating to:

• completed projects and past work;
• work in progress, open tickets and ongoing support;
• rework, fixes and change requests on previously delivered work;
• new enquiries, proposals and projects; and
• hosted solutions, apps and integrations we continue to operate.

This Policy explains our current practices. It does not retrospectively change any contract, give us any new right to use client information, or replace a client’s documented instructions or any data processing agreement. If we make a material change to how we process personal data, we will assess it and tell the people affected where the law requires.

Where we process data for a client under a signed contract, proposal or statement of work, our Standard Commercial Terms and Conditions, our Data Processing Agreement (DPA), HyperStock Terms or HAI Terms, those documents also apply. If they conflict with this Policy on processing done for that client, the signed agreement prevails.

3. Key terms

Term	What it means in this Policy
Personal data	Any information that relates to an identified or identifiable living person, such as a name, email address, phone number, IP address or order record containing a customer’s details.
Processing	Anything done with personal data, including collecting, storing, using, sharing, analysing and deleting it.
Controller	The organisation that decides why and how personal data is processed.
Processor	An organisation that processes personal data on a controller’s behalf and on its instructions.
Sub-processor	A service provider we use to help process data, such as a hosting or AI provider.
Client	A business that engages Rishvi for services or uses our software.
Client operational data	Business data in a client’s systems, such as orders, customers, inventory, suppliers and invoices.
HAI	HyperStock AI, the AI layer that works on top of HyperStock and authorised connected systems.
MCP	Model Context Protocol: a way of giving AI access to specific, defined functions rather than a whole system.

4. Our role: controller or processor

Our role depends on the processing activity, not just on the product or system involved. We normally act as controller for our own business contacts, billing, recruitment, marketing and account administration. We normally act as processor when we handle customer, order and other operational personal data on a client’s documented instructions. Where a different role applies, we explain it in the relevant product notice or agreement. The table shows our usual role.

Situation	Our usual role	Who to contact first
Website visitors, enquiries, quotations, marketing, client contacts, billing, app account registration, recruitment	Controller – we decide how and why the data is used	Rishvi
Data inside a client’s systems that we access to deliver services (e.g. Linnworks orders, customers, inventory, suppliers, invoices)	Processor – we act on the client’s documented instructions	The client (the business you dealt with)
HyperStock and HAI account data (users, roles, settings, usage)	Controller	Rishvi
HyperStock and HAI business data and prompts about a client’s operations	Processor	The client
Supplier, contractor and partner contacts	Controller	Rishvi

This works much like Linnworks itself: a merchant using Linnworks controls its end customers’ data, and the software provider processes it on the merchant’s behalf.

5. Laws we follow

We process personal data under UK data protection law, including the UK GDPR, the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025) and the Privacy and Electronic Communications Regulations (PECR). Where we serve clients or individuals in the EU, we also take account of the EU GDPR where it applies.

6. Personal data we collect

• Identity and contact data: name, job title, company, business email, phone number, business address, website.
• Business and project data: your platforms and setup (e.g. Linnworks, Odoo, Xero, Stream, marketplaces), order volumes, requirements, specifications, test data, meeting notes and project records.
• Financial data: billing address, invoices, payment status. Card payments are handled by our payment providers; we do not store full card details.
• Technical data: IP address, browser, device, operating system, pages visited, clickstream, referral source, timestamps, security and system logs, and records of how visitors interact with our web pages, such as clicks and scrolling (see section 29).
• Application account data: usernames, account IDs, roles, permissions, organisation membership, authentication status, settings and usage.
• HAI data: your prompts, AI responses, conversation history, tool calls the AI made, and technical logs.
• Client operational data (as processor): products, SKUs, inventory, stock, warehouses, orders and order lines, customers and delivery details, suppliers, purchase orders, sales, revenue, margins, returns, refunds, shipping, marketplace and invoicing data.
• Communications: enquiry forms, emails, support tickets, chat and messaging conversations, calls and video calls, including recordings, transcripts and AI-generated meeting notes (see section 17).
• Access credentials: API keys, tokens and service-account details that clients give us to connect systems. We treat these as highly confidential.
• Marketing and preference data: your marketing choices, cookie choices, email opens and clicks where permitted, and event or webinar attendance.
• Recruitment data: CVs, applications, interview notes and references, if you apply to work with us (see section 20).
• Supplier and partner data: contact, contract and payment details of the people we work with at suppliers, contractors and partners (see section 21).

We do not intentionally collect special-category data (such as health, ethnicity or religion) or criminal-offence data. If you send it to us unprompted, we limit its use and delete it where appropriate.

7. How we collect it

• Directly from you: website forms, emails, calls, video calls, live chat, messaging apps, consultations, proposals, support requests.
• From your organisation, when it engages us or adds you as a user.
• Through authorised connections to client systems: Linnworks, ERP, CRM, marketplace, accounting, shipping and invoicing platforms, using APIs and MCP tools.
• When you use HyperStock, HAI and our other apps.
• Through cookies and similar technologies on our websites (see section 29).
• From partners and referrers, events, webinars and conferences.
• From social media and professional networks, such as LinkedIn, when you interact with us there.
• From public sources, such as Companies House or business websites.
• From AI services, which may generate or retrieve information (see section 12).

8. Information you give us about other people

If you give us personal data about someone else, such as a colleague, your customer or a supplier, you must make sure you are allowed to share it and that they know how it will be used, for example by pointing them to this Policy. Where you are a client and we process your customers’ data on your behalf, you remain responsible for telling them how their data is used.

9. Why we use it and our lawful basis

Where we act as controller, we identify a lawful basis for each purpose. For enquiries and quotations we normally rely on legitimate interests, or on steps you ask us to take before entering into a contract. For the staff and contacts of our business clients, we normally rely on legitimate interests; where our contract is with you as an individual, we rely on that contract. We rely on legal obligation for tax and statutory records, and on consent where the law requires it, including for non-essential cookies. Where we act as processor, we process personal data on the client’s documented instructions, and the client is responsible for identifying its own lawful basis.

Purpose	Lawful basis (where we are controller)
Responding to enquiries, free consultations, discovery and quotations	Legitimate interests; steps before a contract
Delivering projects, support, hosting, subscriptions and apps	Legitimate interests (business clients’ staff and contacts); contract (where our contract is with you as an individual)
Processing client operational data	We act as processor on the client’s documented instructions; the client is responsible for its lawful basis
Rework, change requests and support on previously delivered work	Legitimate interests; contract where our contract is with you as an individual
Service messages (delivery notices, acceptance deadlines, security alerts, changes to terms)	Legitimate interests; contract where our contract is with you as an individual
Recording, transcribing and summarising calls and meetings	Legitimate interests (accurate records of requirements, decisions and approvals)
Inviting clients to leave a review on review platforms	Legitimate interests
Marketing and partner updates	Consent, or legitimate interests for existing business clients where PECR allows
Improving our websites and apps	Legitimate interests (usage and account data only – not client operational data)
Analytics, marketing and live chat cookies	Consent
Billing, accounting and tax	Legal obligation; legitimate interests
Managing suppliers, contractors and partners	Legitimate interests; contract where our contract is with you as an individual
Security, fraud and abuse prevention, audit logs	Legitimate interests; legal obligation
Recruitment	Steps before a contract; legitimate interests
Legal claims and disputes, including debt recovery	Legitimate interests; legal obligation

Where we rely on legitimate interests, we have considered your interests and rights and concluded that they do not override ours. You can ask for more detail about this, and you have the right to object (see section 31).

10. Linnworks and other connected platforms

Much of our work is done inside clients’ Linnworks accounts and connected systems. When you authorise us:

• we access only what your permissions, tokens and installed apps allow;
• we access your connected systems for authorised services and support, and for related security and operational tasks, using appropriate access controls;
• macros, scripts and integrations we build process your data only as designed and configured for you;
• we aim to limit access to what the work needs and use test data where practical. We don’t copy client data out of your systems unless the work needs it (for example, for testing or migration), and we delete working copies when they are no longer needed.

Linnworks, Odoo, Xero, Stream, marketplaces and other platforms are independent providers with their own privacy policies. They are not part of Rishvi. Your use of those platforms is governed by their terms.

11. HyperStock

HyperStock supports inventory, warehouse, order, sales, fulfilment and related operations. What it can access depends on your configuration, user permissions, connected systems and enabled features. You control which users have access and which systems are connected.

HyperStock mobile app. With your permission, the HyperStock mobile app may use your device’s camera, for example to scan barcodes, and send notifications, for example about orders or stock. We use these features only to provide the app’s functions. You can turn camera access and notifications off at any time in your device settings, although some features may then not work.

12. Artificial intelligence, including HyperStock AI

AI changes quickly. This section explains how we use it today and the commitments that stay in place as providers and models change.

12.1 What HAI does. HAI lets authorised users ask questions and run tasks in plain language about their business data, such as inventory, orders, sales, suppliers, purchase orders, returns and fulfilment. A typical request works like this: HAI checks the user’s permissions; calls an approved API or MCP tool; retrieves only the relevant records; sends the minimum necessary context to an approved AI model; and returns the answer to the user.

12.2 MCP and tool controls. HAI uses Model Context Protocol (MCP) tools, which give the AI access to specific, defined functions rather than a whole system. Controls may include per-customer and per-role restrictions; separation of read-only and write tools; confirmation or approval before higher-risk actions (such as changing stock, orders or settings); and logging of tool activity. Where HAI can change data in your systems, you decide which write functions are enabled. Available functions may vary between customers and may change as our services develop. Using an AI provider does not give that provider direct or unrestricted access to your source systems.

12.3 AI providers. Depending on configuration, we may use OpenAI, Anthropic, Google and OpenRouter (an AI routing service that may pass a request to an underlying model provider). Not every request goes to every provider. We choose providers based on security, contract terms, data retention, location, capability, reliability and cost. Providers and settings may differ by service. Our current AI providers are listed in section 23, and we update that list when the services we use change.

12.4 New providers and models. Before adding an AI provider, model or significant AI feature that processes client data, we review its terms, data use, retention and security settings, and record it in our internal AI provider register. We update section 23 of this Policy and, where a client contract requires, give advance notice.

12.5 No training on your data. We do not use client operational data, marketplace data, client personal data or HAI conversations to train general-purpose AI models. Any exception would need to be permitted by law, agreed in writing by the client and allowed by the relevant marketplace or platform rules. We use business or API arrangements with providers, which generally do not use API data for model training by default.

12.6 Data minimisation. We send AI providers only the information reasonably needed for the request. We restrict fields, use least-privilege tools, and avoid unnecessary personal data where practical. Some legitimate requests (such as resolving a specific order) may still involve information that includes personal data.

12.7 Provider retention. AI providers may process and briefly retain prompts and responses for service delivery, security, abuse prevention and legal compliance. Retention varies by provider and configuration. Where available and appropriate, we use restricted-retention settings, and we can restrict provider choice where a client’s agreement requires it.

12.8 Information from outside your data. AI output may include information that neither you nor we supplied. It may come from the model’s general knowledge, public sources, web search, retrieval systems or inference. An AI response could therefore mention a person or business we never provided. If such information becomes stored in Rishvi systems and relates to an identifiable person, we treat it as personal data under this Policy.

12.9 Accuracy and oversight. AI-generated information can be wrong, incomplete, out of date or attribute information to the wrong person. Authorised users should check it before relying on it for significant decisions, especially financial, legal, HR, compliance or major operational ones. We use proportionate safeguards for AI features, including user permissions and controls suited to the functions enabled.

12.10 Automated decisions. We do not intend to make solely automated decisions about individuals that have legal or similarly significant effects. Before introducing any such workflow, we would assess the legal requirements and put appropriate safeguards in place.

12.11 What not to enter. Do not enter passwords, API keys, private keys, payment-card details or unnecessary sensitive personal data into HAI, any AI chat, website forms or support messages. Credentials are handled through controlled mechanisms, never through prompts.

12.12 AI in how we work. Our team may use approved AI tools (for example, coding assistants, documentation, meeting note-takers and support tools) to deliver services faster. We use only tools and settings approved internally. We don’t put client credentials into AI tools, and client data is used in them only where needed for the work and permitted under our arrangements with the client.

12.13 Unexpected sensitive content. If an AI service unexpectedly generates or retrieves sensitive information, we may restrict access to it, stop further processing, redact or delete it, investigate the cause and adjust the configuration.

12.14 Corrections. If you think a Rishvi AI service has produced or stored inaccurate information about you, contact info@rishvi.co.uk. We will check whether it came from a client system, an external source or AI inference, and correct or delete what we control. We cannot change what a third-party model has learned, but we can stop our systems using or storing the information.

12.15 Secure connections and credentials. Connections between our systems, client systems and AI providers use secured APIs and authentication, such as API keys, tokens and service accounts. Secure API access reduces the risk of unauthorised access but does not by itself decide how an AI provider handles or retains information. That is why we also review provider terms, retention settings and data processing arrangements.

12.16 Marketplace data in HAI. HAI works with the data in a client’s connected Linnworks account, some of which may come from marketplaces such as Amazon. We do not use marketplace-sourced data to train AI or machine-learning models (see section 13). Clients are responsible for making sure their use of HAI is permitted under the terms of the marketplaces they sell on.

13. Marketplace data, including Amazon

We handle marketplace-derived personal data (such as Amazon order and customer information) only to provide authorised services, in line with the relevant marketplace’s rules and the client’s documented instructions. We do not sell it, share it with partners, use it for marketing or product development, or use it to train AI or machine-learning models. We apply each marketplace’s restrictions on storing, sharing, using and keeping data. For Amazon, order information containing personal data is kept for no longer than 30 days after order shipment, or any shorter period Amazon requires, and then securely deleted, unless the law requires us to keep it longer.

14. UK eInvoice

For e-invoicing services, we may process invoice data, supplier and customer details, tax identifiers and accounting records, as processor for the client. The client remains responsible for the accuracy of invoice data and its tax and legal obligations. Rishvi is not HMRC or a Government body.

15. Odoo, hosting and managed services

When we implement, customise, migrate or support Odoo, or host and manage applications, databases or integrations for a client, we act as processor for the client’s data in those systems. We access that data only to deliver, maintain, monitor, back up and support the agreed service. Data migrations are planned with the client, and temporary copies made for migration or testing are deleted when no longer needed. Where we host a solution, the hosting provider acts as our sub-processor (see section 23).

16. Support, remote access and test data

• Support tickets, emails and chat messages are used to investigate and resolve your issue and to keep a record of the work.
• With your permission, we may use remote-access or screen-sharing tools to provide support. We only view or control what is needed for the issue, and access ends when the support session ends.
• We use test, sample or anonymised data for development and testing where practical. Where live data is needed, we agree this with you and limit access to the people working on the task.
• Credentials and tokens you give us are handled through approved, secure processes, used only for authorised work, and removed or disabled when no longer needed, subject to agreed operational needs.

17. Calls, meetings and AI note-takers

Where the law allows, we may record or transcribe business calls and video meetings, including by using AI note-taking tools, so that we have an accurate record of requirements, decisions and approvals. We tell participants when a call is being recorded or transcribed and explain the options available, such as written notes instead, where practical.

Recordings, transcripts and AI-generated notes are stored securely, shared only with the people who need them, and kept in line with the retention period for the related enquiry or project records (see section 25). Where an AI note-taking tool processes client personal data on our behalf, it is treated as a sub-processor.

18. Website forms, live chat and messaging

When you contact us through a website form, live chat, WhatsApp or another messaging service, we use the details and messages you send to reply and to handle your enquiry. Please do not share passwords, credentials or sensitive personal data through chat or messaging.

• Live chat: the chat window on our website is provided by Tawk.to, which processes your chat messages and related technical data to provide the service.
• WhatsApp: if you contact us via WhatsApp, your messages and phone number are also processed by WhatsApp, which is owned by Meta, under its own privacy policy.
• Form protection: our forms may use Google reCAPTCHA to protect against spam and bots. reCAPTCHA collects device and usage information and is subject to Google’s privacy policy and terms.

19. Social media, events and webinars

If you follow, message or interact with us on social media or professional networks such as LinkedIn, Facebook, Instagram or X, we receive the information you make available to us there. Those platforms are independent controllers of the data they hold, and their own privacy policies also apply.

When you register for an event or webinar, we use your details to manage your place, send joining information and follow up afterwards. Webinars may be recorded; we will tell you at the start if they are.

20. Recruitment

If you apply to work with us, we use your CV, application, interview notes and any references to assess your application and communicate with you. Access is limited to the people involved in hiring. If you are unsuccessful, we keep your data for 6 months after the role is filled, unless you agree to us keeping it longer for future opportunities. If you join us, your data is kept as part of your staff record.

21. Suppliers, contractors and partners

We use the contact, contract and payment details of people at our suppliers, contractors and partners to manage our relationship, make and receive payments, and meet our legal obligations. Contractors who work on client projects are bound by confidentiality and data protection obligations and follow the same access and security controls as our staff.

22. Who we share data with

We do not sell personal data.

• Across Rishvi brands: contact and account data may be shared between Rishvi, Linnworks Custom, HyperStock and UK eInvoice where needed to serve you. For example, an enquiry made on one of our websites may be handled by another Rishvi team that is better placed to help. We make this clear when we collect your data, and you can object at any time. Client operational and marketplace data is not shared across brands for any other purpose.
• Platform and integration partners: technical or account information may be shared with Linnworks, Odoo, Xero, Stream or other platforms where needed to deliver an integration you’ve asked for. We tell you about this as part of your service agreement.
• Partners (with consent only): contact details only, and only after your clear, specific and freely given consent. We share only where the partner has agreed to handle your data in line with data protection law and the sharing is relevant to the services you enquired about. We never share client operational or marketplace data with partners. You can withdraw consent at any time by emailing info@rishvi.co.uk or using the unsubscribe link in any message.
• Service providers: hosting and cloud, databases, email, CRM and email marketing, analytics, monitoring and logging, backups, support tools, payment processors, accounting software, meeting and note-taking tools, and AI providers. They act on our instructions under contract. Where a provider processes client personal data on our behalf in our role as processor, it is a sub-processor (see section 23).
• Review platforms: after we have worked together, we may share your name and email address with review platforms such as Trustpilot, Clutch or Google so that they can invite you to leave a review. You can ask us not to do this at any time.
• Contractors: approved contractors working on client projects, under confidentiality and data protection obligations (see section 21).
• Professional advisers: lawyers, accountants, auditors (including ISO certification auditors) and insurers, under confidentiality.
• Debt recovery: where invoices are unpaid, we may share necessary details with debt-recovery agents or legal advisers.
• Legal requirements: courts, regulators, law enforcement or HMRC where the law requires, or to protect the rights, property or safety of Rishvi Ltd, our clients or others.
• Business changes: a buyer or successor in a merger, acquisition, restructuring, investment or sale of assets, under confidentiality.

23. Sub-processors

We use service providers for hosting, communications, analytics, payment processing, support and other business functions, including:

• Website hosting and cloud infrastructure providers
• CRM and email marketing platforms
• Analytics tools
• Monitoring and logging providers
• Payment processors
• Accounting software
• Communication, meeting and AI note-taking tools
• AI model providers and AI routing services

A provider is a sub-processor only where it processes client personal data on our behalf in our role as processor. Sub-processors are governed by our Data Processing Agreement, including its notice and objection arrangements, and may only process data on our instructions and for specified purposes. Not every provider processes data for every client; which ones apply depends on the products and configuration a client uses.

Our current AI sub-processors are:

Sub-processor	Purpose	Where used
OpenAI	AI model services	HyperStock AI and other Rishvi AI features, depending on configuration
Anthropic	AI model services	HyperStock AI and other Rishvi AI features, depending on configuration
Google	AI model services	HyperStock AI and other Rishvi AI features, depending on configuration
OpenRouter	AI model routing. It may pass a request to an underlying AI provider.	AI workloads configured to use it

Our websites also use these third-party tools:

Tool	Provider	Purpose
Google Analytics and Google Tag Manager	Google	Website analytics and managing website tags
Microsoft Clarity	Microsoft	Heatmaps and session recordings showing how visitors use our pages
Meta Pixel	Meta	Measuring and targeting our advertising
Tawk.to	Tawk.to	Live chat on our websites
Google reCAPTCHA	Google	Protecting our forms from spam and bots
WhatsApp	Meta	Messaging, when you contact us via WhatsApp

We also use trusted providers for cloud hosting, data storage, email, monitoring and support. A current list of providers and sub-processors is available on request from info@rishvi.co.uk.

24. International access and transfers

Personal data may be accessed or processed outside the UK, including where authorised members of our team or our service providers support our operations. This includes authorised Rishvi Ltd staff based in India, who work under our security controls and confidentiality obligations, and AI and cloud providers that may process data in the EU or US.

We apply the contractual, security and transfer safeguards the law requires. Where a restricted transfer takes place, we assess it and use an appropriate lawful mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. Clients with data-location requirements should agree them with us in writing. We do not claim that all data is hosted in the UK. You can ask us for more information about the safeguards we use.

25. How long we keep data

We keep personal data only for as long as needed for the relevant purpose and as justified by our retention schedule, contracts and legal obligations. The table shows our normal periods. Removing an item from an application screen may not immediately remove it from active storage or backups; we explain deletion arrangements to clients where required.

Data	Retention period
Enquiries and pre-sales data	2 years from last contact
Contracts, proposals, correspondence and project records	Length of engagement + 6 years
Call recordings, transcripts and AI meeting notes	In line with the related enquiry or project records
Accounting and financial records	7 years
Client operational data	Only as long as needed to deliver the service, then deleted or returned
Amazon order data	Up to 30 days after shipment (or shorter if Amazon requires), unless the law requires longer
Application account data	Subscription + 12 months
HAI conversation history	Kept while the client’s account is active. Conversations a user deletes are removed from our active systems in line with our retention schedule, and remaining conversations are deleted within a reasonable period after the account closes.
HAI tool-call and technical logs	Kept for limited periods for security and troubleshooting
Client credentials and tokens	Removed or disabled when no longer needed, subject to agreed operational needs
Marketing data	Until consent is withdrawn, or 3 years from last engagement
Website analytics	26 months
Supplier and contractor records	Length of relationship + 6 years
Recruitment data	6 months after the role is filled, unless you agree to longer
Backups	Access-restricted and overwritten in line with documented backup cycles; not restored for ordinary use

We may keep data longer where needed for legal claims, disputes or debt recovery, or where the law requires it. When data is no longer needed, we delete it securely or anonymise it.

26. Aggregated and anonymised data

We may use information that has been effectively anonymised (for example, how often a feature is used or average API response times) to run and improve our services, subject to our client agreements and any third-party data-use restrictions. We do not create it from marketplace data. Pseudonymised information remains personal data where individuals can still be identified.

27. Security

We use risk-based technical and organisational security measures suited to the information and services involved. These include HTTPS/TLS encryption in transit, role-based and least-privilege access, secure API authentication and secret management, separation of production and test environments, logging and monitoring, backups, staff confidentiality and training, incident management and secure deletion. We operate an information security management system certified to ISO/IEC 27001:2022. Further details can be shared with clients under suitable confidentiality arrangements.

No method of sending or storing data can remove all risk, so we also encourage clients to protect their own accounts, devices and credentials. To report a security vulnerability, email info@rishvi.co.uk.

28. Data breaches

If a personal data breach occurs, we will act to contain it and assess the risk. We will notify the regulator and affected individuals where the law requires. Where we are processor, we will notify the affected client without undue delay, as our agreement with them requires.

29. Cookies

Our websites use cookies and similar technologies:

• Essential: needed to run and secure our websites, including spam protection on forms (Google reCAPTCHA).
• Functional: support features such as live chat (Tawk.to).
• Analytics: help us understand how visitors use our websites, including Google Analytics and Microsoft Clarity. Clarity records interactions such as clicks, scrolling and mouse movement, and is designed to mask sensitive form input by default.
• Marketing: help us measure and target our advertising, including Meta Pixel.

When you first visit rishvi.co.uk, a cookie banner lets you choose Accept All, Reject Non-Essential or individual categories. Where consent is required, we do not load statistics or marketing technologies, or our live chat, until you have given consent. You can change your choice at any time using the Manage consent tab on the website. Full details of each cookie are in our Cookie Policy.

30. Marketing

We may send you industry insights, product and service updates, offers, events and, with separate consent, partner updates. You can unsubscribe at any time using the link in our emails or by emailing info@rishvi.co.uk. Service messages (such as delivery and acceptance notices, invoices and security alerts) will still be sent.

31. Your rights

Depending on the circumstances, you have the following rights over your personal data:

• Access: ask for a copy of the personal data we hold about you.
• Correction: ask us to correct inaccurate or incomplete data.
• Erasure: ask us to delete your data where we no longer have a lawful reason to keep it.
• Restriction: ask us to limit how we use your data in certain circumstances.
• Objection: object to processing based on legitimate interests, and to direct marketing at any time.
• Portability: receive data you gave us in a structured, machine-readable format, or ask us to send it to another organisation.
• Withdraw consent: where we rely on consent, withdraw it at any time. This does not affect processing already carried out.
• Automated decisions: not be subject to solely automated decisions with legal or similarly significant effects, and ask for human review.

32. Making a request

To make a request, email info@rishvi.co.uk. We will respond within one month, which may be extended where the law allows. Requests are normally free. We may need to verify your identity. Requests to delete HyperStock AI conversation data are handled manually by our team. If your request concerns data we process for one of our clients, we will pass it to that client, who is the controller, and help them respond.

33. Client responsibilities

Clients who connect systems to our services are responsible for: having authority to connect them and share the data; telling their own customers, staff and suppliers how their data is used; managing user access, including removing access when people leave or change roles; protecting credentials; not submitting unnecessary sensitive data; reviewing AI output; and meeting their own controller obligations. If you are a customer, supplier or employee of one of our clients, that client is usually responsible for your data, and your questions should normally go to them first.

34. Children

Our services are for businesses and are not intended for anyone under 18. HyperStock and HyperStock AI are designed for businesses and authorised business users. We do not knowingly collect personal data from children. If you believe a child has sent us personal data, please contact us and we will delete it promptly.

35. Third-party websites

Our sites link to third parties such as Linnworks, Odoo, Xero and Stream. We are not responsible for their privacy practices; please read their policies.

36. Keeping your data accurate

Please let us know if your contact details or other personal data change, so that our records stay accurate. App users can update most account details in the application; for anything else, email info@rishvi.co.uk.

37. Complaints

Please contact us first at info@rishvi.co.uk so we can try to resolve your concern. We will look into your complaint and tell you the outcome. You also have the right to complain to the UK data protection regulator, the Information Commission (formerly the Information Commissioner’s Office): ico.org.uk, 0303 123 1113.

38. Changes to this Policy

We review this Policy periodically and update it as our services, technology (including AI providers) and the law change. The current version and effective date are shown at the top, and earlier versions are available on request. Where a change requires us to notify you directly or take another step under the law or a contract, we will do so.

Version	Date	Main changes
3.0	31 October 2026	Single master policy for all brands; applies to past, current and future work; expanded AI, MCP, Linnworks, Odoo, hosting and e-invoicing sections; added calls and AI note-takers, support and remote access, chat and messaging, recruitment, suppliers and key terms; regulator name updated
2.x	9 October 2026	Added HyperStock AI, AI providers and Amazon data section
1.0	17 August 2024	First published

39. Contact us

Rishvi Ltd
Company number: 08347225
Suite 1, 1st Floor, 730 Romford Road, London, Greater London, England, E12 6BT, United Kingdom
Privacy, data protection and general enquiries: info@rishvi.co.uk
Phone: +44 20 8050 3432
Websites: rishvi.co.uk · linnworkscustom.com · hyperstock.app · ukeinvoice.co.uk