Privacy Policy
Last updated: 12 October 2026
Riviera (“Riviera,” “we,” “us”) provides a product layer for building and operating an MCP server’s agent-facing interface. This policy explains what data we collect, why, and how it is handled, for two groups: teams using Riviera to connect and manage their own MCP server (“customers”), and the AI agents/MCP clients that call a customer’s published interface through Riviera’s hosted MCP endpoint.
Data we collect from customers
When a team connects an MCP server to Riviera, we collect and store the connection details needed to reach and authenticate to that server (its URL and, where applicable, an encrypted credential), the tool definitions Riviera discovers and lets you edit (names, descriptions, schemas), and account/workspace information (name, email) needed to operate your Riviera account.
Upstream MCP connection credentials are encrypted at rest and are never returned by any Riviera API response after they’re saved.
Tool call data
When an MCP client calls a tool through Riviera’s hosted MCP endpoint, we record metadata about that call — which tool was called, the published interface version that served it, success/failure, duration, and timestamp — to power the product’s Observe feature. Raw tool-call inputs and results are stored only if a customer has explicitly enabled payload capture for that project (off by default); a customer can delete already-stored payloads at any time without deleting the surrounding call metadata.
How we use data
- To operate the Build, Test, Publish, and Observe features of the product.
- To authenticate MCP clients and customers and enforce project-level access control.
- To detect and prevent fraudulent or abusive use of the Service.
- To maintain and improve the reliability of Riviera’s hosted MCP endpoint and proxy.
We do not sell personal data to third parties.
Data sharing
We share data only with the subprocessors necessary to operate the service (hosting, database, authentication, payment processing, eval model inference, and product analytics). Payment details are collected and processed by Stripe; Riviera does not receive or store card numbers. See Vendors & Subprocessors for the full list.
Cookies and website analytics
On the public marketing pages we use Google Analytics to count visits. It sets cookies only if you accept them in the banner. If you decline, it sends Google a basic page view without cookies or a visitor identifier. It is never loaded in the signed-in product. You can change your choice at any time with “Cookie settings” in the footer. Separately, we use PostHog to measure use of the site and the product, with on-page text masked and no name or email attached.
Data retention
Tool-call metadata is retained according to your plan’s observability retention window (see Plan & Usage in the product); raw payloads, where captured, can be deleted independently at any time.
Your rights
You can request access to, correction of, or deletion of your personal data by contacting us at privacy@riviera.so.
Changes to this policy
We’ll update the “last updated” date above when this policy changes and, for material changes, take reasonable steps to notify customers directly.
Contact
Questions about this policy: privacy@riviera.so.