Loading
Last Updated: May 20, 2026
Effective Date: January 1, 2026
Riverstone & Willow (“we”, “us”, or “our”) is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.
The data controller responsible for your personal data is:
Riverstone & Willow
Online Coaching & Wellness Consulting
tbd
tbd
Email: [email protected]
Full Impressum / legal notice: /legal-notice
EU Representative (Art. 27 GDPR): Riverstone & Willow does not currently designate an EU representative under Article 27 GDPR. The controller relies on the exemption in Article 27(2)(a) on the basis that the processing volume is presently below the “large scale” threshold described in the WP29 Guidelines on the Data Protection Officer (WP243 rev.01). This reliance is reviewed quarterly and an EU representative will be appointed within 90 days of the first paid booking, or sooner if the active EU data subject count exceeds 75, the processing scope expands, or any supervisory authority inquiry is received.
Supervisory Authority (operator-jurisdiction): Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti (Serbia). EU/EEA-resident data subjects retain the right to lodge a complaint with the supervisory authority of their country of residence (Art. 77 GDPR).
Primary Data Storage in the EU
Your account, booking and session-record data is stored on EU-based infrastructure (Supabase, eu-west-1 — Dublin, Ireland; Vercel, EU region). Provider-level encryption at rest (AES-256) applies on both platforms. Both Supabase, Inc. and Vercel Inc. are US-controlled entities, so EU SCCs 2021/914 Module Two apply to any onward access by US personnel under the executed DPAs.
Necessary International Transfers
A small number of operational processors are established in, or may process data in, the United States. These transfers rely on the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework:
The site is currently in manual payment mode. Payments are coordinated off-site, so the website does not initiate on-site card or PayPal checkout at this time.
Session content itself (your spoken words during a call) is streamed end-to-end during the session and is not recorded by default. Only connection metadata (timestamps, participant identifiers) is handled by the video provider.
Remote Access by the Coach
The coach accesses client records from a non-EU location (Serbia) through the web browser only, over authenticated HTTPS / TLS 1.2+ connections to the EU-based infrastructure described above. No client records are downloaded, exported, or stored on local devices outside the EU — all primary storage remains within EU jurisdiction at all times.
We collect the following categories of personal data:
During coaching sessions, you may share information about your personal circumstances, wellbeing, or relationships. This information is treated with the highest level of confidentiality and is processed only with your explicit consent (Art. 9(2)(a) GDPR) for the purpose of providing coaching services.
Self-service forms do not collect special-category data. The booking form, the contact form, the discovery-call form, the account-deletion request, the pause request, and the public-review form are all configured so that health-related content cannot be submitted as free text (closed-list reasons, explicit on-screen warnings, and Terms-of-Service restrictions on review content). Special-category data therefore enters our records only through live spoken conversation in a session — which is not recorded — or through messages you choose to send to us by direct email outside the website forms.
We process your personal data based on the following legal grounds (Art. 6 GDPR):
Riverstone & Willow does not actively collect, request, or store health data, medical history, diagnoses, symptoms, medications, or clinical assessments. Live coaching sessions are not recorded and session content is not stored. The application captures only contract-necessary personal data (name, email, payment, appointment metadata) under Article 6(1)(b) GDPR. As a precaution, the booking and discovery-call flows include an Article 9(2)(a) explicit-consent checkbox covering the possibility that clients may voluntarily disclose health-adjacent information during live video sessions (which are never recorded or stored), or via the three free-text input fields described in § 7 below.
We publish client reviews on our website to help prospective clients make informed decisions. The following describes how we handle data submitted through the review feature.
Only the following is visible on the public review card: your name (according to the display preference you chose — full name, first name only, or anonymous), the rating, the review text, the content warning (if any), and the date. Your email address and IP hash are never shown publicly.
Reviews submitted via a personal token sent to enrolled clients after a completed session are marked as verified. Reviews submitted through the public form require email verification but are still marked as unverifiedbecause email verification does not confirm that the author was a client. The label appears on each review card so readers can weigh them appropriately.
You may remove your review at any time. Visit /reviews/remove to request removal. After publication we send a removal link to the email address you provided; if you lose that link, request a new one through the same page.
The review content itself remains public until you remove it. The associated guest_email and guest_ip_hash fields are automatically nulled 24 months after publication, unless the review has been reported — in which case they are retained for the duration of moderation review.
We use the following EU-compliant third-party services:
| Service | Purpose | Data Location |
|---|---|---|
| Supabase | Database & Authentication | EU (eu-west-1, Dublin, Ireland); transfers under GDPR Standard Contractual Clauses for US-controller access |
| Vercel | Website Hosting | EU (Frankfurt) |
| Pluot, Inc. (d/b/a Daily.co) | Video / audio session hosting | US; transfers under GDPR Standard Contractual Clauses |
| Resend, Inc. | Transactional email delivery | US; transfers under GDPR Standard Contractual Clauses |
| Functional Software, Inc. (Sentry) | Error monitoring & reliability | US or EU (depending on region); transfers under GDPR Standard Contractual Clauses |
| Upstash, Inc. | Rate limiting (abuse protection) | EU |
| Cloudflare, Inc. | DNS resolution, edge protection & inbound email routing for [email protected] | Global; transfers under GDPR Standard Contractual Clauses |
We use providers that offer GDPR-compliant data processing terms, with Standard Contractual Clauses applied to any onward transfers outside the EU/EEA where required.
Current payment mode: The site is in manual payment mode. Payments are coordinated off-site, so the website does not currently send payment data to PayPal. If online payment mode is enabled in the future, PayPal (Europe) S.à r.l. et Cie, S.C.A. will act as an independent data controller for that checkout flow; see § 9.
The application accepts user-supplied free text in three places:
Riverstone & Willow is the data controller for your personal data. Certain vendors process personal data on our behalf, on documented instructions, under their respective Data Processing Agreements (DPAs). Where personal data is transferred outside the European Economic Area, the transfer relies on the European Commission's Standard Contractual Clauses (Commission Decision 2021/914, Module Two) unless the vendor is EEA-based. We have reviewed each vendor's published DPA and consider their technical and organisational measures appropriate for the data categories involved.
| Vendor | Purpose | Data processed | Location | Transfer safeguard | DPA / Subprocessors |
|---|---|---|---|---|---|
| Daily.co (Pluot, Inc.) | Live video and audio session hosting |
| US — covered by EU SCCs 2021/914 Module Two | EU SCCs 2021/914 Module Two | DPA · Sub-processors |
| Resend, Inc. | Transactional email delivery |
| US — covered by EU SCCs 2021/914 Module Two | EU SCCs 2021/914 Module Two | DPA |
The website is currently operating in manual payment mode. Payments are coordinated off-site, so the site does not initiate on-site payment processing through PayPal at this time.
If online payment mode is enabled and you make a payment through the on-site checkout, we share the necessary personal data (name, email address, transaction amount, billing details) with PayPal (Europe) S.à r.l. et Cie, S.C.A.(22–24 Boulevard Royal, L-2449 Luxembourg). PayPal processes that data as an independent data controller, not as a processor acting on our instructions. PayPal independently determines the purposes and means of processing for payment execution, fraud detection, anti-money laundering compliance, and dispute handling.
PayPal's own Privacy Statement governs how PayPal handles personal data it collects and processes. You may exercise your GDPR rights in respect of PayPal's processing directly with PayPal.
The legal basis for our sharing payment data with PayPal, when that online payment flow is used, is Art. 6(1)(b) GDPR (processing necessary to perform our contract with you — executing the payment you requested).
We keep personal data only as long as is necessary for the purposes for which it was collected, or as long as is required by applicable law. Retention is governed by the principle of data minimisation (GDPR Art. 5(1)(c)).
Active vs. Archived: If a client has not booked a session for 12 consecutive months, their records are moved to a secure archived state — removed from day-to-day systems and held in a restricted-access vault until the applicable retention period ends.
You may request earlier deletion under Art. 17 GDPR; records subject to legal retention (e.g. tax and bookkeeping) will remain in a minimised form until their statutory period ends.
Under GDPR, you have the following rights:
Right of Access (Art. 15)
Request a copy of your personal data
Right to Rectification (Art. 16)
Correct inaccurate data
Right to Erasure (Art. 17)
Request deletion of your data
Right to Restrict Processing (Art. 18)
Limit how we use your data
Right to Data Portability (Art. 20)
Receive your data in a portable format
Right to Object (Art. 21)
Object to certain processing activities
To exercise these rights, contact us at: [email protected]
Right to Lodge a Complaint: You have the right to lodge a complaint with the data protection supervisory authority of your country of residence (or place of work, or place of the alleged infringement) if you consider that the processing of your personal data infringes the GDPR.
If you believe that we have handled your personal data in a way that infringes data protection law, you have the right to complain. You can raise your concern with us first, and you may also escalate to your supervisory authority at any time — you are not required to come to us first.
Send your complaint by email to [email protected] with the subject line “Data complaint”. Please include:
If sending email is not workable for you, contact us through the channels listed at /legal-notice and we will arrange an alternative intake route.
Independently of complaining to us, you have the right to complain to your local data protection supervisory authority. If you are not satisfied with our response, you should escalate within one month of receiving it.
Our website uses the following types of cookies:
We use Vercel Analytics for privacy-focused website analytics. This tool is designed to be GDPR-compliant and does not use cookies for tracking visitors across websites.
We implement the following security measures to protect your data:
Our services are intended for individuals 18 years of age or older. We do not knowingly collect personal data from individuals under 18. If you are a parent or guardian and believe a minor has provided personal data, please contact us at [email protected] and we will delete it.
We may update this Privacy Policy from time to time. Significant changes will be communicated via email or website notice. The “Last Updated” date at the top of this policy indicates when it was last revised.
For privacy-related inquiries:
admin_audit_logtable. The row captures the actor’s account identifier and email, the verb-style action name (e.g. review.hide, enrollment.update), the target table and row identifier, and an aggregate, non-identifying payload (for example: state-diff enum values). It does not store free-text message bodies, third-party names, or raw IP addresses.Anyone may report a review using the “Report” link on each review card. Reports are reviewed within 48 hours in accordance with the EU Digital Services Act notice-and-action requirements.
Content reports submitted under Article 16 of Regulation (EU) 2022/2065 are processed in line with the procedural rules of Articles 16 to 21 of that Regulation: the submitter receives a confirmation of receipt, a statement of reasons accompanies any moderation decision taken on a reported review, an internal complaint may be lodged within six months of the decision under Article 20, and a dispute may be referred to a certified out-of-court dispute settlement body under Article 21 (or to a court of competent jurisdiction) independently of whether the internal route is used.
Aggregate counts of notices received, decisions taken, complaints lodged, and government orders received are published on the public transparency report page. The report carries no personal data.
contact_messages.message, 5,000-character cap, stored in EU-hosted Supabase) — an advisory warning is displayed against medical disclosures.reviews.content + reviews.title, stored and publicly visible when not hidden by the operator) — an explicit Article 9 warning and consent gate are presented before submission.In all three cases, the user controls what they write; we discourage health disclosures via on-screen guidance but do not technically filter them.
| Supabase, Inc. | Postgres database, authentication, and storage |
| EEA — eu-west-1 (Dublin, Ireland) | EEA-based (no transfer) | DPA · Sub-processors |
| Vercel Inc. | Website hosting, server-side rendering, and edge function execution |
| EEA — Frankfurt (fra1); US for Vercel-as-Controller scope (billing, abuse detection) | EU SCCs 2021/914 Module Two (for Processor scope) | DPA · Sub-processors |
| Upstash, Inc. | Distributed rate-limiting key store (abuse and infrastructure protection) |
| EEA — region pending operator verification (expected eu-west-1 Ireland or eu-central-1 Frankfurt) | EEA-based (no transfer) | DPA |
| Functional Software, Inc. (Sentry) | Application error monitoring and performance tracing |
| US — covered by EU SCCs 2021/914 Module Two (EU region available on paid plans) | EU SCCs 2021/914 Module Two | DPA · Sub-processors |
| Cloudflare, Inc. | DNS resolution, edge network protection, and inbound email routing for [email protected] |
| Global — covered by EU SCCs 2021/914 Module Two | EU SCCs 2021/914 Module Two | DPA · Sub-processors |
You may also seek a judicial remedy. Complaining to us does not waive, replace, or postpone any of these rights.