Privacy Policy
What personal data we process and why, who receives it, how long we keep it, and your rights.
Service: RivalLens (rivallenslabs.com) Version: 1.0 Effective date: 2026-10-23 Last updated: 2026-11-09
Authoritative language. The authoritative version of this Privacy Policy is the English version. Translations are provided for convenience; in case of any discrepancy, the English version prevails.
1. Who we are (Data Controller)
RivalLens is operated by Vasilii Danilin, a self-employed individual (autónomo) established in Spain, tax ID Z1086337Y, registered address Avenida San Carlos, 7, Bloque 8, 1A, 29630 Benalmádena (Málaga), Spain (the "Controller", "we", "us").
For any question about this Policy or to exercise your rights, contact us at privacy@rivallenslabs.com.
2. Scope
This Policy explains how we process personal data when you (a) use the RivalLens website and service (the "Service"), and (b) when your personal data appears in our competitor-analysis data even though you never registered with us (see Section 5). It applies to users and non-users in the European Economic Area, the United Kingdom, Switzerland, the United States, Canada, Mexico and the other markets we serve.
Region-specific notices supplement this Policy:
- California residents: see the California Privacy Notice (rivallenslabs.com/legal/california).
- Mexico: see the Aviso de Privacidad (rivallenslabs.com/legal/aviso).
3. Personal data we process
3.A — Data about our customers (people who register and buy)
| Category | Examples | Source |
|---|---|---|
| Account & profile | Email; password (stored only as a salted hash by our auth provider); optionally your full name, avatar, and company name; your browser's time zone, so that dates are shown in your time and our emails reach you during the day | You; the time zone from your browser |
| Your company (optional — "Compare with my company") | You provide only your company's website link (and optionally a Google Maps link). We resolve its identity from that link and analyse it from public sources the same way we analyse competitors, then store that analysis linked to your account | The link you give + public sources |
| Service inputs | Niche, region, business description, your own website URL, report parameters | You |
| Orders / billing | Purchase records, amounts, VAT, currency | You / Merchant of Record |
| Where you came from | The marks of the link that first brought you to our site (advertising campaign tags such as utm_source, Google Ads click identifiers), the name of the site you came from (not the page) and the first page you opened — saved with your account when you sign up |
Your browser |
| Your steps towards a purchase | When you signed up; began, left and came back to an order form (with what it said at the time: the niche and the number of competitors); started and received a free report; went to payment; paid (amount and kind of order) | Our systems, from your use of the service |
| Your answers to the survey after the free report | Whether you saw the invitation, took the survey or chose "Not now"; how far you got; the answers you picked and the words you wrote yourself (up to 500 characters per question). Every question is optional | You |
| Blog digest and waiting list (no account needed) | Your email address and the language of the emails; your browser's time zone, so that our emails reach you during the day; on the waiting list, if you choose to answer, which business you would check first (the words you write, up to 200 characters). The question is optional | You |
| Email choices | Whether you agreed to or refused each kind of email we send, and a record of every change: what changed, when, how (sign-up, checkout, Settings, the link in an email), and the version and language of the wording you saw. No IP address | You |
| Generated output | The competitor-analysis reports linked to your account | Generated for you |
| Support data | Ticket subject, messages, attachments | You |
| Technical data | IP address, device/browser data, system logs | Automatic |
We do not collect your phone number or business email, and we do not store your full payment-card data (handled by the Merchant of Record — see Section 6).
3.B — Data about third parties (people who never registered) — see Section 5
| Category | Examples | Source |
|---|---|---|
| Investor / founder names | Names of investors (and, where present, founders) of analysed competitor companies, where available from public sources | Public sources |
| Public company data | Company name, website, address, public pricing and services | Public sources |
| Review text | Public review content used for analysis | Public sources |
Data minimisation we already apply: review author names are removed before storage — we do not retain the names of people who wrote reviews. The principal third-party personal data we retain is investor/founder names, and only where found in public sources.
3.C — Data collected automatically
We set the strictly-necessary cookies needed to run the site and keep you signed in, and we use Google Analytics 4 to measure site usage. GA4 cookies are set only after you accept them through our consent banner — nothing analytics-related loads before that, and rejecting is as easy as accepting. We set no advertising cookies and run no remarketing. See the Cookie / Tracking Notice (rivallenslabs.com/legal/cookies).
Only if you accepted analytics:
- First visit. Your browser keeps a note of the link that first brought you here (see "Where you came from" in 3.A) until you sign up, so the right campaign is credited even if you sign up days later. Declining or withdrawing consent deletes it. Without consent we only read the address of the page you are on when you sign up — nothing is kept on your device.
- Purchases. When you buy a report, our server tells Google Analytics that a purchase took place — the net amount, VAT, currency, what was bought (report, extension or repeat) and a scrambled order reference — together with the analytics identifiers your browser already had. Your name, email and the subject of your report are never sent. If you declined analytics, nothing is sent.
4. Purposes and legal bases (GDPR Art. 6)
| Purpose | Data | Legal basis |
|---|---|---|
| Create and operate your account | 3.A account/profile | Contract — GDPR Art. 6(1)(b) |
| Deliver the report you purchased | 3.A service inputs/output | Contract — Art. 6(1)(b) |
| Process payment, billing, tax | 3.A order data | Contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c) |
| Generate competitor analysis from public data, incl. investor/founder names | 3.B | Legitimate interests — Art. 6(1)(f) (providing competitor intelligence; balanced against the rights of the individuals — see Section 5 and our internal LIA) |
| Security, fraud prevention, debugging | 3.A technical | Legitimate interests — Art. 6(1)(f) |
| Respond to support and data-rights requests | 3.A support | Legal obligation — Art. 6(1)(c); legitimate interests — Art. 6(1)(f) |
| Service emails (receipts, refunds, status) | 3.A | Contract — Art. 6(1)(b) |
| Marketing emails — tips, product news, offers, reminders about an unfinished order or a free report | Consent — Art. 6(1)(a) (opt-in at sign-up or in Settings; withdrawable at any time) | |
| Emails about reports you bought — reminders to refresh them, offers to extend or repeat them | Email, order history | Legitimate interests — Art. 6(1)(f), within the rule for existing customers in Spanish law (LSSI art. 21.2): only about our own services similar to the one you bought, and you can refuse when you buy (an unticked box before payment), with one click in every such email, and in Settings |
| Blog digest and launch waiting list | Consent — Art. 6(1)(a) (the box on the subscription form) | |
| Learn which markets people want researched before we open | Your optional answer on the waiting-list form (3.A) | Legitimate interests — Art. 6(1)(f) (planning our own service; the question is optional; the answer is never shared or sold). See Section 9 to object |
| Keep a record of your email consents and refusals | Email choices (3.A) | Legal obligation — Art. 6(1)(c) with Art. 7(1) (we must be able to show consent); legitimate interests — Art. 6(1)(f) (showing we respected a refusal) |
| See where customers stop on the way to a purchase, which of our emails help, and who might need help finishing an order | Your steps towards a purchase (3.A) | Legitimate interests — Art. 6(1)(f) (improving our own site, emails and sales; counted in our own database, never shared or sold; no automated decisions about you). See Section 9 to object |
| Improve the reports and learn what our customers need | Your survey answers (3.A) | Legitimate interests — Art. 6(1)(f) (improving our own service; the survey is optional and can be refused with one click; the answers are read without your email address and are never shared or sold). See Section 9 to object |
| Learn which campaigns and pages bring customers | Where you came from (3.A) | Legitimate interests — Art. 6(1)(f) (measuring our own marketing: the marks of one link, no tracking across sites). Kept on your device before sign-up only with your consent (3.C) |
| Report a purchase to Google Analytics from our server | Order amount, analytics identifiers | Consent — Art. 6(1)(a) (only if you accepted analytics cookies) |
| Measure how the site is used (Google Analytics 4) | Usage/device data via analytics cookies | Consent — Art. 6(1)(a) (cookie banner; withdrawable at any time) |
We do not use your data for automated decisions producing legal or similarly significant effects on you, and we do not sell your personal data. We do not use your personal data to train AI models.
5. Notice to non-registered individuals (investors & founders)
If you are an investor or founder of a company analysed by RivalLens, your name may appear in a report even though you never registered with us. We want to be transparent about this.
- What we hold: your name in a professional/business context, linked to a company, taken from publicly available sources — and only where it was found in those sources.
- Why (legal basis): our legitimate interest (GDPR Art. 6(1)(f)) in providing competitor-intelligence reports. We have carried out a documented Legitimate Interests Assessment balancing this against your rights and reasonable expectations.
- We minimise: we use only professional/business-context data (not special-category data), we drop the names of review authors, and we include investor/founder names cautiously.
- Art. 14 transparency: because we obtain this data indirectly, we rely on the "disproportionate effort" provision of GDPR Art. 14(5)(b) to make this information available via this public notice rather than contacting each individual.
- Your rights — especially the right to object. You can ask us what we hold about you, ask us to correct or delete it, and object to our processing at any time (Art. 21). On a valid objection we will remove your name and prevent it from re-appearing, unless we can demonstrate compelling legitimate grounds that override your interests. Contact privacy@rivallenslabs.com — we operate a fast takedown path for such requests (see Section 9).
6. Recipients and sub-processors
We share personal data only with vendors that help us run the Service ("sub-processors"), grouped by category: hosting & content delivery, database & authentication, AI processing, payments, email delivery, error monitoring, analytics, and public-data collection. Each is bound by a data-processing agreement. We provide the full named list on request (and to supervisory authorities); a category-level summary is published at rivallenslabs.com/legal/sub-processors.
Payments / Merchant of Record. Payments are processed by Stripe, which acts as Merchant of Record for your purchase (the seller of record responsible for billing and applicable taxes). Stripe processes your payment data as a separate controller under its own privacy policy.
7. International data transfers
Your account data is stored in the European Union (Supabase, Paris region). Some sub-processors are located in the United States or elsewhere. Where we transfer personal data outside the EEA/UK/Switzerland, we rely on:
- the EU-US Data Privacy Framework (and its UK Extension / Swiss-US DPF) for vendors that are certified under it; and
- Standard Contractual Clauses (SCCs) plus, where appropriate, a transfer impact assessment, for vendors that are not DPF-certified.
You may request a copy of the relevant safeguards by writing to privacy@rivallenslabs.com.
8. Retention
We keep personal data only as long as necessary for the purposes above and to meet legal obligations. In summary:
| Data | Retention |
|---|---|
| Account & profile data | While your account is active; deleted when you close your account |
| Reports / company profile | While your account is active, or until you delete them |
| Order / payment records | 6 years, as required by Spanish tax and commercial-record rules |
| Third-party (investor/founder) data | While relevant to current analysis; removed on valid objection |
| Support tickets | 90 days after a ticket is closed; 14 days if a ticket is left awaiting your reply |
| Pipeline event logs (processing history of your reports) | 60 days |
| Cookie-consent records (no personal data — see the Cookie Notice §2.3) | 2 years |
| Record of emails we sent you | While your account is active. If you have no account (blog digest, launch announcement): 90 days |
| Record of your email consents and refusals | While your account exists, then 3 years after it is deleted — kept under your account number only, without your email address. For blog-digest and waiting-list addresses: 3 years after the address is removed |
| Where you came from (first visit) | With your account; deleted when you close it |
| Your steps towards a purchase | 2 years; deleted at once when you close your account |
| Your survey answers | 2 years; deleted at once when you close your account |
| Waiting-list entry (your email, the language and your optional answer) | 12 months after we send you the launch email, or 12 months after you unsubscribe — whichever comes first; earlier if you ask us to delete it or close an account registered with the same email address |
| Abandoned checkouts / unfinished orders | 24 hours / 7 days |
| Technical and hosting logs | Retained short-term by our hosting providers under their own retention policies |
When you delete your account, we hard-delete your account, profile, reports and tickets, and keep only the minimum payment records required by tax law and, for 3 years, the record of your email consents and refusals (under your account number only) — so that we can show we respected them.
9. Your rights
Subject to applicable law, you have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and objection (Art. 21), and to withdraw consent at any time where processing is based on consent.
To exercise any right, email privacy@rivallenslabs.com. We may need to verify your identity. We respond within one month (extendable by two months for complex requests, with notice). There is no fee unless a request is manifestly unfounded or excessive.
If you are a non-registered individual (investor/founder) and object to our processing, we operate a priority takedown path — see Section 5.
Emails. You can stop marketing emails and emails about your reports at any time — with the link at the bottom of every such email, or in Settings → Notifications. When you buy, an unticked box lets you refuse emails about similar services before you pay. A refusal is never undone by a later purchase: only you can switch those emails back on, in Settings.
10. Cookies and tracking
We use strictly-necessary cookies, plus Google Analytics 4 cookies that are set only with your prior consent. See the Cookie / Tracking Notice (rivallenslabs.com/legal/cookies).
11. AI-generated content
Reports are produced automatically using AI models. See the AI Transparency Disclosure (rivallenslabs.com/legal/ai). Reports may contain inaccuracies and are not professional advice — see the Terms of Use.
12. Children
The Service is not directed to children under 16 (or the applicable age of digital consent in your country). We do not knowingly process children's data.
13. Security
We use appropriate technical and organisational measures, including hashed passwords, row-level access controls, EU-region data storage, encryption in transit, and an error-monitoring setup configured not to capture user emails or IP addresses.
14. Complaints / supervisory authority
You may lodge a complaint with your local supervisory authority. In Spain this is the Agencia Española de Protección de Datos (AEPD), https://www.aepd.es. In the UK: the ICO (https://ico.org.uk). In Switzerland: the FDPIC. We ask that you contact us first at privacy@rivallenslabs.com so we can try to resolve the matter.
15. Changes
We may update this Policy. Material changes will be notified via the Service or by email. The "Last updated" date reflects the latest version.
16. Contact
Vasilii Danilin — privacy@rivallenslabs.com — Avenida San Carlos, 7, Bloque 8, 1A, 29630 Benalmádena (Málaga), Spain.