Privacy Policy

• Account: name, email and unique identifier (via Clerk authentication).
• Integration credentials: tokens, API keys and webhook secrets for the platforms you connect, used only to issue tax documents on your behalf.
• Sales data: identifier, customer, tax number, amounts, products and statuses, processed to create the invoice or credit note.
• Support requests: what you write in requests and in the Rioko Assistant chat, and the answers, kept in your account.
• Technical logs: timestamps, request identifiers and external API responses, for auditing and diagnostics.

• Create Invoices, Invoice-Receipts and Credit Notes in your invoicing software automatically.
• Ensure tax compliance (AT rules, VAT exemptions M01–M99, tax number).
• Show history and reconciliation in the dashboard.
• Send failure alerts and issuance reports.
• Provide technical support when you request it, including through the Rioko Assistant (Roko), an artificial intelligence assistant that answers in the dashboard chat when you use it.

We do not sell or share your data with third parties for marketing purposes.

• Cloudflare (hosting, DNS, D1, KV, Workers) — EU/global.
• Clerk (authentication) — EU/US.
• Shopify, Stripe, Lodgify, EuPago (sales source platforms) — according to the connection you configure.
• InvoiceXpress, Moloni, Vendus (tax document issuers) — Portugal.
• Stripe (processing payments for your Rioko subscription) — EU/US.
• Resend, with MailChannels as fallback (delivery of alert and report emails) — EU/US.
• Fly.io (fixed-IP egress relay required by Lodgify) — EU.
• Anthropic (artificial intelligence) — US. Used in two cases:
  • Automatic diagnosis attached to critical alerts: only a restricted, predefined set of fields (total and tax calculations, product and SKU names, the error text returned by the platform, and connection metadata). Customer name, email, tax number, order reference and user identifier are never sent in this case.
  • Rioko Assistant (Roko), in the dashboard chat once you accept it, and when the Rioko team asks it to look into one of your support requests: the request's messages, your connections' configuration (never credentials) and the data of the sales and documents it consults to answer, which may include your customers' name, email, tax number and order reference. The Assistant changes nothing in your account without your express approval.
  Under Anthropic's commercial terms, this data is not used to train models.
• Google (Google Analytics 4 and Google Ads, measurement of traffic and of the ads that bring sign-ups) — EU/US, under the EU Standard Contractual Clauses. Loads only with your consent.

We use only the subprocessors required by the connection you configure. A platform you do not connect neither receives nor processes your data.

Tax documents already issued reside in your invoicing account and are not deleted by us: their retention follows the applicable legal archiving periods and is your responsibility.

• Access your personal data.
• Correct inaccurate data.
• Request deletion ("right to be forgotten").
• Data portability.
• Withdraw consent at any time.
• File a complaint with CNPD (Portuguese Data Protection Authority).

To exercise any right, email [email protected].

Strictly necessary (always active, no consent needed): Clerk session — authentication; rioko_impersonate_id — admin impersonation only (1 day); rioko_attr — records signup origin (referrer/campaign) for abuse prevention (90 days).

Analytics and ad measurement (only with your consent): Google Analytics 4 — cookies _ga and _ga_* (~2 years) measure traffic; Google Ads — cookies _gcl_* (~90 days) record the click on a Rioko ad, so we know whether it led to a sign-up or subscription. Data may be processed by Google in the United States under the EU Standard Contractual Clauses. Loaded via Google Consent Mode v2 with everything denied by default — these cookies are set only after you accept.

You can change or withdraw your choice at any time via Cookie settings in the page footer. Your choice is stored locally on your device for 6 months, after which we ask again. We use no personalised advertising or remarketing cookies.

CIMAAL, Centro de Informação, Mediação e Arbitragem de Conflitos de Consumo do Algarve. Covers municipalities in the district of Faro.

Address: Ninho de Empresas, Edifício ANJE, Estrada da Penha, 3.º andar, sala 26, 8000 Faro
Phone: 289 823 135
Email: [email protected]
Site: www.consumidoronline.pt

The electronic Complaints Book is also available at www.livroreclamacoes.pt/inicio.

• when you sign up through the partner's page, that partner receives the account's company name, VAT number and email, only to confirm you are its client;
• only with your express permission does the partner access your account's data, including settings, documents and logs, and it handles them on your behalf;
• every permission, confirmation and withdrawal is recorded with the date, who made it and the version of the text accepted;
• you can withdraw access or leave the partner in My account, at any time.