Receviona

Privacy Policy

Last updated: October 23, 2026

This Privacy Policy explains how Zenthoria LLC("Receviona," "we," "us") collects, uses, and protects personal data in connection with the Receviona platform (the "Service"). It covers two kinds of personal data: data about the people who use Receviona on behalf of a customer organization, and personal data that may appear within the accounts receivable data (customer contacts, invoices, payments) that a customer uploads or connects to the Service.

1. Who we are

For data protection purposes, Zenthoria LLC, registered at 30 N Gould St STE R, Sheridan, WY 82801, USA, acts as the data controller for account and billing information, and as a data processor acting on the instructions of the customer organization for the receivables data (including any personal data of debtor contacts) that organization uploads to the Service.

2. Data we collect

We collect:

  • Account data — name, work email, and organization, provided when you sign up or are invited to a workspace;
  • Receivables data — customer records, invoices, payments, and related contact details that your organization imports or enters into the Service;
  • Usage and log data — sign-in timestamps, IP address, and actions taken in the product, recorded for security and in the audit log described below;
  • Support data — anything you send us when you contact support.

We do not collect payment-card or bank-account credentials through the Service. Paid plans are invoiced under an order form; if we later offer online payment, a third-party payment processor will handle those details and will be added to the list in §5.

3. How we use data

We use this data to:

  • Provide the Service — compute aging, risk scores, and collection priority, and generate draft recommendations and communications for your review;
  • Secure the Service — authenticate users, enforce role-based permissions, and maintain the audit log;
  • Communicate with you about your account, and, where you have agreed to receive them, product updates;
  • Improve the Service, using aggregated or de-identified data wherever practical.

We do not use one customer's receivables data to train models shared with other customers, and every organization's data is isolated from every other organization's at the data layer.

Where the GDPR or UK GDPR applies, we rely on these legal bases for the data we control ourselves: performance of our contract with you (account data and providing the Service), our legitimate interests in securing the Service and preventing abuse (usage and log data), compliance with legal obligations, and your consent where we ask for it (such as optional product updates). For receivables data we process on your organization's behalf, the organization determines the legal basis.

4. AI processing

Some product features (risk explanations, collection recommendations, draft communications) send relevant account data to an AI model provider to generate a response, which is then shown to you for review — never sent or acted on automatically. Financial totals, aging, and scores are always computed by deterministic application code, not by the AI model, and are not derived from or altered by AI output.

No decision about a person is taken solely by automated means. Risk scores and collection priorities are advisory indicators about accounts, and a user of the customer organization reviews and approves any communication or action before it happens.

5. Sharing and sub-processors

We share personal data with the infrastructure, database, email-delivery, and AI-model providers that operate the Service on our behalf, each bound by a data-processing agreement, and never sell personal data. We may disclose data if required by law or to protect the rights, safety, or property of Receviona or others.

Our current sub-processors:

  • Vercel Inc. — application hosting, serverless functions, and file storage;
  • Neon, Inc. — primary database (customer, invoice, payment, and account data);
  • Resend — delivery of transactional email (password reset, email verification, team invites);
  • Vercel AI Gateway — routes AI-generation requests to the underlying model provider (see §4);
  • Anthropic, PBC — the AI model provider currently reached through the gateway, used only by the AI-assisted features. We may change model provider, and will give notice of the change as described below;
  • Sentry — error tracking and diagnostics.

We will update this list as our sub-processors change, and you may request the current list at any time using the contact details in §13. The terms on which we process receivables data for a customer organization, including how sub-processor changes are notified, are in our Data Processing Addendum.

6. Data retention

We retain account and receivables data for as long as your organization maintains an active subscription. After termination we make it available for export for 30 days, then delete it, unless a longer period is required by law or by an unresolved dispute.

You don't have to wait for that period. An Owner of an organization can delete the organization at any time from Settings → Data & privacy: its customers, invoices, payments, collection history, audit log and imports, and every team member's account, are then deleted immediately and permanently, and its accounting-software connection is revoked. Individual users can likewise delete their own account from the same place.

When a user deletes their own account, their name, email address, password and any two-factor authentication secret and recovery codes are removed and they can no longer sign in. Records they created for their organization remain in that organization's data, and so do the audit log entries they authored, but those no longer identify them: the IP addresses and browser details recorded with them are erased, and the account is reduced to an anonymous identifier. The audit log otherwise remains for as long as the organization exists, for security and compliance purposes.

Copies held in backups, and in the point-in-time recovery history kept by our database provider, are overwritten on a rolling basis, within 35 days after a deletion, and are not used for any other purpose in the meantime.

7. Security

Data is encrypted in transit, and encrypted at rest by the infrastructure providers that store it; credentials for connected accounting software and two-factor secrets are additionally encrypted by the application. Access within the product is governed by role-based permissions scoped to your organization, every tenant-owned record is isolated to its own organization, and security-relevant actions are recorded in an audit log that the product does not allow anyone to edit. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

8. International transfers

We operate from the United States, so personal data from the European Economic Area, the United Kingdom or Switzerland is transferred there. Where that happens, we rely on Standard Contractual Clauses approved by the European Commission (with the UK Addendum and Swiss adaptations where they apply) or another legally recognized safeguard. Our Data Processing Addendum sets out how they apply to customer organizations.

9. Your rights

Depending on where you are located, you may have rights to access, correct, delete, or export your personal data, and to object to or restrict certain processing. Most of these you can exercise yourself, from Settings → Data & privacy:

  • Access and portability. Any signed-in user can download the personal data we hold about them — their account, memberships and the records they created — as a JSON file. An Owner or Admin can download everything held for the organization as one JSON file. Password hashes, two-factor secrets and recovery codes, one-time link tokens and accounting-software credentials are never included.
  • Erasure. Any user can delete their own account, and an Owner can delete the organization, as described in §6. Both ask you to confirm with your password.
  • Data uploaded by an organization. We act as a processor for the receivables data an organization uploads about its own customers and their contacts. If you are one of those contacts, please address your request to that organization, which controls the data; we will assist it on request.

For anything you can't do yourself — for example correcting information, or objecting to or restricting processing — contact your organization's administrator, who controls the underlying data; organizations and administrators can contact us directly at contact@zenthoria.tech. If you are in the European Economic Area or the United Kingdom you also have the right to lodge a complaint with your local data protection supervisory authority.

10. Cookies

The Service sets only cookies it needs to work: the session cookie that keeps you signed in, short-lived cookies that protect sign-in against cross-site request forgery and remember where to return after signing in, and two preference cookies (whether the sidebar is open, and whether you dismissed the getting-started checklist). We do not use third-party advertising or tracking cookies within the product.

Our website. Visiting the public pages of receviona.com does not require an account and sets no tracking or advertising cookies. Our hosting provider keeps standard server logs (such as IP address and request time) for security and operations. The typefaces are served from our own domain, so no third party receives your IP address when the page loads. The ROI calculator on the landing page runs in your browser and sends what you type nowhere.

11. Children

The Service is intended for business use and is not directed at children.

12. Changes to this policy

We may update this Privacy Policy from time to time. For material changes, we will provide notice before the change takes effect.

13. Contact

Questions about this policy or requests concerning your personal data can be sent to contact@zenthoria.tech.

This page is a template describing how the Service is designed to handle data and does not constitute legal advice. It should be reviewed by qualified counsel, with the bracketed details completed, before being relied on as a binding policy.