Privacy Policy

1. Overview

This Privacy Policy describes how Riffora (“Riffora”, “we”, “us”) handles personal information when you use the Riffora website, web application and Chrome extension (together, the “Service”). The Service helps you create LinkedIn posts with AI and publish or schedule them through LinkedIn’s official API.

By using the Service you agree to the practices described here. If you do not agree, please do not use the Service.

2. Information we collect

Information you provide

• Account details: your name, email address, password (stored only as a secure one-way hash) and timezone.
• Content: topics, notes, drafts, posts, hashtags, prompt templates, writing preferences and the brand-voice description or example posts you choose to save.
• Files and links: documents (PDF, DOCX, TXT) and images you upload, and public web page URLs you ask us to import. We extract text from these to generate content.

Information from LinkedIn

If you connect LinkedIn, we receive your LinkedIn member ID, name, email address and profile picture URL, plus the access token and permissions you approve. If organization posting is enabled and approved, we also receive the list of LinkedIn Pages you administer. See LinkedIn integration.

Information collected automatically

• Usage records: the number of AI generations and tokens used (for plan quotas), and a history of AI requests and publishing attempts including results and error messages.
• Security logs: for sensitive actions (sign-in, password changes, connecting or disconnecting LinkedIn, admin changes) we record the action, time, IP address and browser user-agent.
• Session data: essential cookies that keep you signed in. See Cookies.

3. How we use information

• To provide the Service: create your account, generate and edit content, store drafts, publish and schedule posts, and show your history.
• To enforce plan limits and prevent abuse (for example rate limiting and quota tracking).
• To keep the Service secure, investigate errors and protect your account.
• To send essential emails such as password resets and email verification.
• To comply with legal obligations.

We do not sell your personal information, use it for advertising, or publish anything to LinkedIn without your action.

4. AI processing

When you generate, rewrite, shorten, expand or change the tone of content, we send the relevant input to our AI provider (an OpenAI-compatible service configured by us). This may include your topic or notes, text extracted from documents or web pages you supplied, your saved brand voice and examples, and — if you use image input and it is enabled — the image itself.

• AI requests are made only when you trigger them.
• The provider processes this data to return a result and handles it under its own terms and privacy policy.
• We do not use your content to train our own AI models.
• AI output can be inaccurate. We ask the AI not to invent facts and highlight claims to verify, but you are responsible for reviewing content before publishing.

5. LinkedIn integration

Connecting LinkedIn is optional. You authorize access on LinkedIn’s own sign-in page — we never see or store your LinkedIn password.

• Permissions requested: openid, profile, email (to identify your account) and w_member_social (to publish posts you approve). Organization permissions are requested only if Company Page posting is enabled.
• When we post: only when you click Publish now, retry a failed post, or a schedule you created becomes due.
• Tokens: stored encrypted at rest and used only to publish on your behalf.
• Disconnecting: removing the connection in Integrations deletes the stored tokens and cancels scheduled posts for that account. You can also revoke access anytime from your LinkedIn settings.

We use only official, documented LinkedIn APIs. We do not scrape LinkedIn, read your feed or messages, or sell LinkedIn data.

6. Chrome extension

• The extension stores your Riffora server address and a revocable access token in your browser’s local storage on that device.
• It reads the text you have selected on a page only when you click Use selected text, and the page title and URL only if you tick Mention this page. This text is sent to Riffora to generate content.
• It does not track your browsing, run on pages in the background, or access LinkedIn pages or credentials.
• Extension tokens expire after 90 days and can be revoked in Settings → Extension.

7. Cookies

We use only cookies that are strictly necessary for the Service to work:

We do not use advertising cookies or third-party analytics trackers.

8. How we share information

We share personal information only as needed to run the Service:

• AI provider — to process the content you submit for generation (see AI processing).
• LinkedIn — the posts and images you choose to publish.
• Infrastructure providers — hosting, database, storage and email delivery services that process data on our behalf.
• Legal reasons — if required by law, or to protect the rights, safety and security of users and the Service.
• Business transfers — if the Service is merged or acquired, subject to this policy.

9. Retention & deletion

• We keep your account data while your account is active.
• Delete your account anytime in Settings → Account. This immediately deletes your profile, posts, drafts, uploaded files, templates, LinkedIn connections and tokens, AI and publishing history, and extension tokens.
• Security audit records may be kept for a limited period after deletion for fraud prevention and legal compliance; they are no longer linked to your account.
• Copies may remain in encrypted backups for a limited period until they are overwritten.
• Deleting a post in Riffora does not delete it from LinkedIn — remove it on LinkedIn directly.

10. Security

We use industry-standard safeguards, including:

• HTTPS encryption in transit, hashed passwords and encrypted LinkedIn tokens and API keys at rest.
• Strict per-account access controls, so each user can access only their own data.
• Private storage for uploaded files, rate limiting, and protections against common web attacks.

No system is perfectly secure. If you believe your account has been compromised, change your password and contact us immediately.

11. Your rights & choices

Depending on where you live (for example under the GDPR or India’s Digital Personal Data Protection Act, 2023), you may have the right to:

• Access and correct your information — most of it is editable in Settings.
• Delete your account and data — available in Settings → Account.
• Export your content — each post can be downloaded as a text file; contact us for a full export.
• Withdraw consent — disconnect LinkedIn or revoke extension tokens at any time.
• Object or complain — contact us, or your local data protection authority.

To make a request, email no-reply@example.com. We may need to verify your identity first.

12. International transfers

Our service providers (including the AI provider) may process data in countries other than yours. Where required, we rely on appropriate safeguards for these transfers.

13. Children

The Service is intended for professionals and is not directed to children under 16 (or the minimum age required in your country). We do not knowingly collect their personal information. If you believe a child has provided us data, please contact us and we will delete it.

14. Changes to this policy

We may update this policy as the Service evolves. We will change the effective date above and, for significant changes, notify you by email or in the app before they take effect.

15. Contact us