Riverside

GDPR overview

GDPR implementation is concrete and documented rather than merely claimed. The privacy policy, last revised 15 June 2026, names RiversideFM, Inc. as controller, appoints PrivacyTeam Ltd. as external Data Protection Officer reachable at dpo@riverside.com, and designates Alexandre Bouaziz of DEEL IRELAND EOR LIMITED as the Article 27 representative in the European Union, with a separate representative at LETS DEEL LIMITED for the United Kingdom. Transfers rely on certification to the EU-US Data Privacy Framework and its UK and Swiss extensions, on Standard Contractual Clauses approved by the Commission, the ICO and the Swiss FDPIC, and on the adequacy decision covering Israel. A Data Processing Addendum and a named subprocessor list are both published. Access, erasure, portability, objection, restriction and complaint rights are set out and exercised by email.

Who owns the data?

Under the Terms and Conditions, your recordings and files stay yours: the content and any copyright or trademark rights in it remain your property and are used at your sole responsibility. You grant RiversideFM, Inc. a limited, non-exclusive, royalty-free worldwide licence to host, copy, display and reproduce that content, but only as far as delivering the platform requires. Where recordings contain personal data, Riverside acts as processor or service provider under its Data Processing Addendum. Two carve-outs matter: any feedback you send becomes Riverside's exclusive property, and the platform is explicitly not a storage, backup or archiving service, so keeping your own copies is on you.

Reuse rights

You can reuse everything the platform produces without asking Riverside for permission: raw multitrack files, edited exports, transcripts, AI-generated clips, show notes and thumbnails are yours to publish, sell or license, provided you actually hold the rights to what was recorded. The Terms make you warrant that you own or have cleared the content, including consent from every identifiable person appearing in it. On the vendor side the picture is less settled. The FAQ states that Riverside does not own or use your content in any way, while the privacy policy dated 15 June 2026 lists training its own AI and machine-learning models among its processing purposes, on a legitimate-interest basis. Voice and face samples fed to VideoDub are treated more strictly: they serve only the requested feature, subprocessors are contractually barred from training on them, and they are destroyed immediately afterwards.

Data retention & training

Hosting summary

Riverside states that it and its authorised service providers maintain, store and process personal data in jurisdictions including the United States, Canada, the European Union, the United Kingdom, Israel, Mexico, Argentina and the Philippines, among others. Core infrastructure runs on Amazon Web Services and Google Cloud in the United States, with MongoDB as the database provider. The published subprocessor list adds Austria (Auphonic) and Germany (CloudConvert) for media processing, and a series of United States AI vendors including OpenAI, ElevenLabs, HeyGen, Hedra and Pika. Group entities sit in Israel for research and development, Cyprus for payment processing and Canada for sales, with customer support handled from the Philippines. Transfers to Israel rely on the European adequacy decision, transfers to the United States on the EU-US Data Privacy Framework certification, and everything else on Standard Contractual Clauses. No data-residency option letting a customer pin storage to a chosen region is advertised.