1. Data controller
This policy explains how we process your personal data when you use the website rivusinvest.lt (the “Website”) and our services. We process data in accordance with the General Data Protection Regulation (GDPR) and the laws of the Republic of Lithuania.
| Detail | Information |
| Data controller | MB Rivus Invest (brand name: Rivus Research House) |
| Company code | 307584094 |
| Registered address | Upės g. 88, Smiglių k., LT-14168 Vilniaus r., Lithuania |
| Email for privacy matters | rokas@rivusinvest.lt |
We have not appointed a data protection officer, as this is not required under Article 37 of the GDPR. For any questions, please write to the email address above.
2. What data we process and why
We collect only the data you provide yourself and the minimum technical data needed for the Website to work.
| Purpose | Data | Legal basis (GDPR Art. 6) |
| Answering questions in the AI assistant | Email, question, answer, date, language, IP address, browser identifier | Consent (point a) – you tick the box beforehand |
| Limiting the number of free questions and preventing abuse | IP address, browser identifier, email, number of questions | Legitimate interest (point f) |
| Fulfilling a tailored analysis order | Name, email, question, context, order and payment information | Performance of a contract (point b) |
| Responding to an ongoing coverage request and sending an offer | Name, email, content of the request | Steps prior to entering into a contract (point b) |
| Managing subscriptions and payments | Email, payment identifier, amount, date (card details – only at Stripe) | Performance of a contract (point b) |
| Accounting and taxes | Invoice and payment data | Legal obligation (point c) |
| Sending the newsletter | Email, language, date of consent, source, IP address | Consent (point a) |
| Handling contract withdrawal requests and complaints | Name, email, order details, content of the request | Legal obligation (point c) |
| Website operation and security | IP address, server logs | Legitimate interest (point f) |
You may withdraw your consent at any time. This does not affect the lawfulness of processing carried out before the withdrawal.
3. AI assistant questions
3.1. Questions and answers are processed by an artificial intelligence model provided by Anthropic PBC (USA). Anthropic receives the question without your email address or name.
3.2. We use questions without personal data to choose topics for our research and to improve the quality of the AI assistant’s answers.
3.3. Anonymised general questions and answers may be published on the Website as examples. Before publishing, we remove all information that could identify the author of the question. The author’s email address or name is never published.
3.4. Please do not include personal data, account numbers or other confidential information in your question.
3.5. Answers are generated automatically, but this does not produce legal or similarly significant effects for you within the meaning of Article 22 of the GDPR.
4. Newsletter
4.1. We send the newsletter only to people who have separately agreed to receive it: through the newsletter form or by ticking the optional box in the AI assistant. The subscription takes effect only after you click the confirmation link in the email (double opt-in).
4.2. Providing your email address to the AI assistant or for an order does not, on its own, sign you up for the newsletter.
4.3. You can unsubscribe at any time by clicking the link at the bottom of every email or by writing to rokas@rivusinvest.lt.
4.4. We send newsletters through the Brevo platform. It may record whether an email was opened and whether a link was clicked, so that we can assess how relevant our content is.
5. Who we share data with
We do not sell data. We share it only with service providers that help us deliver our services and act under contracts with us.
| Recipient | What they receive | Purpose | Where processed |
| Hostinger International Ltd. | All Website data | Website and email hosting | EU |
| Anthropic PBC | Only the text of the question asked to the AI assistant | Generating the answer | USA |
| Stripe Payments Europe, Ltd. | Name, email, payment details | Managing payments and subscriptions | EU and USA |
| Sendinblue SAS (Brevo) | Email address, name and language; the content of emails we send (newsletter, order and subscription confirmations, AI assistant messages) | Sending the newsletter and the Website’s service emails | EU |
| Accounting service provider [if any] | Invoice data | Accounting | Lithuania |
| Microsoft Ireland Operations Ltd. (Clarity) | Website browsing data (only with consent) | Website usage statistics | EU and USA |
We may also provide data to public authorities where the law requires it.
Transfers to the USA. When data is transferred to the USA, we rely on the EU-US Data Privacy Framework adequacy decision (if the recipient is certified) or on the Standard Contractual Clauses approved by the European Commission.
6. How long we keep data
| Data | Retention period |
| AI assistant questions and answers linked to an email address | 12 months from the question, then deleted or anonymised |
| Email address given to the AI assistant (without newsletter consent) | 12 months from the last question |
| Anonymised questions (without personal data) | Indefinitely |
| Newsletter subscription | Until you unsubscribe; unconfirmed addresses are deleted after 30 days. The email address of people who unsubscribe is kept as a “do not send” marker so that the newsletter is not sent to them again (legitimate interest) |
| Orders, requests and correspondence | 3 years from the provision of the service |
| Accounting documents and payment data | 10 years, as required by the Law on Accounting |
| Server logs | Our hosting provider (Hostinger) displays website access-log information, including IP addresses and User-Agent data, in its hosting analytics for the most recent seven days. The retention period for the provider’s infrastructure and error logs is set by the provider under its data processing terms and may vary; we use these logs only to keep the Website secure and working. |
When the period ends, the data is deleted or anonymised.
7. Cookies and browser storage
We use two types of cookies. Strictly necessary cookies and browser storage entries are needed for the Website to work, so no consent is required for them. Statistics cookies (Microsoft Clarity) are set only after you give consent in the cookie banner. We do not use advertising cookies.
| Name | Type | Purpose | Duration |
| hcdn | Strictly necessary cookie | Hostinger content delivery network (CDN): keeps the Website fast and secure | Session |
| pll_language | Cookie | Remembers the selected Website language (Polylang) | 1 year |
| rivus_lang_seen | Cookie | Ensures the language redirect happens only on the first visit | 1 year |
| rivus_order_lang | Cookie | Shows the confirmation in the order’s language after payment | 1 day |
| rivusVid | Browser storage | Random identifier for counting the free-question limit | Until you clear your browser data |
| rivusEmail | Browser storage | So the AI assistant does not ask for your email every time | Until you clear your browser data |
| cmplz_* | Strictly necessary cookie | Remembers your cookie choice (Complianz) | 1 year |
| _clck | Statistics cookie (only with consent) | Microsoft Clarity: recognises a returning visitor | 1 year |
| _clsk | Statistics cookie (only with consent) | Microsoft Clarity: links page views within one visit | 1 day |
| CLID, MUID, SM | Third-party statistics cookie (only with consent) | Microsoft Clarity: recognises the browser across different websites that use Clarity | 1 year |
Microsoft Clarity. If you accept statistics cookies, Microsoft Clarity records how you browse the Website: how far you scroll, where you click, which pages you view, as well as your device type, browser and approximate country. From this data we see overall usage heatmaps and anonymised session recordings, which help us improve the Website’s content and structure. All text entered in forms and in the AI assistant is masked, so Microsoft does not receive it. Microsoft keeps the data for up to 13 months and the recordings for up to 30 days. For more information, see the Microsoft Privacy Statement.
Managing consent. On your first visit to the Website, a cookie banner is shown where you can accept or reject statistics cookies – both buttons are equally visible. Until you make a choice, no statistics cookies are set. You can change your choice at any time by clicking the “Cookie settings” link at the bottom of the Website, or delete cookies in your browser. Withdrawing consent does not affect the lawfulness of earlier processing.
On the payment page, Stripe uses its own cookies to prevent fraud. These are described in the Stripe Cookie Policy.
8. Your rights
You have the right to:
- find out what data we process about you and receive a copy of it;
- ask us to correct inaccurate data;
- ask us to delete data (the “right to be forgotten”), except data we are required to keep by law;
- ask us to restrict processing;
- object to processing based on legitimate interest;
- receive the data you provided in a structured format (data portability);
- withdraw your consent at any time.
Send your request to rokas@rivusinvest.lt. We will reply within 1 month. We may ask you to confirm your identity, for example by writing from the same email address.
If you believe your data is being processed improperly, you may file a complaint with the State Data Protection Inspectorate (L. Sapiegos g. 17, Vilnius, vdai.lrv.lt). We ask you to contact us first – we will try to resolve the issue more quickly.
9. Security, minors and changes
9.1. We protect data with technical and organisational measures: an encrypted connection (HTTPS), restricted access to the administration system and password protection. We do not store payment card details.
9.2. Our services are intended for people aged 18 and over. We do not knowingly collect data from younger people.
9.3. We may update this policy. The current version is always available on the Website. We will inform subscribers and clients about significant changes by email.
9.4. This policy is effective from 15 October 2026.