This Privacy Policy explains how Rischio S.A.S. processes the personal data of the people who use rischio.io, the studio at studio.rischio.io, the free calculators, the Academy and our other services (the “Service”). It’s also our policy for the processing of personal data under Colombia’s Law 1581 of 2012 and its regulations (Decree 1377 of 2013, compiled in Decree 1074 of 2015). Where they apply, it also meets the EU and UK General Data Protection Regulations (GDPR) and other privacy laws.
1. Who is responsible for your data
The data controller (“responsable del tratamiento”) is:
- Rischio S.A.S., NIT 901787239-9, domiciled in Bogotá, Colombia;
- email for any privacy matter: hello@rischio.io, handled by Rischio’s data protection team;
- physical address for postal notices: available on written request to that email.
2. What data we collect
When you create and use an account:
- Account data: your name, your email, your password (stored only as a one-way hash) and, if you choose to give them, your company, role, country and how you heard about Rischio.
- Sign-in with Google or Microsoft: your account’s identifier, name and email address. We don’t receive or store your Google or Microsoft password or any access to your Google or Microsoft account.
- Acceptance: the version of these documents you accepted, and when.
- Plan and billing: your plan, trial and Education dates, your subscription status, and the payment records Paddle sends us: a customer identifier, invoices, and the card’s brand, last four digits and expiry date. We never receive or store full card numbers.
- Your content: your models (the engineering data you enter and their results), your report settings, and your letterhead (company name, details and logo).
- AI: the descriptions you write to create a model with AI, what the AI produced (its steps, assumptions and reply), and your rating of it.
- Feedback: the messages you send us, with the page you were on, your browser, the size of your screen and any recent errors, so we can reproduce the problem.
- Connected agents: the name of the AI agent app you connect, when you connected it, and its access tokens (stored as hashes).
- Sessions and security: for each sign-in, the IP address and the browser it came from.
- Product emails, only if you ask for them: that you agreed to receive them and when, and which ones we’ve sent you. To choose them we use what your account already shows (whether you’ve calculated a model or connected an agent, and your plan). Never the content of your models.
- Last use: the day you last used your account (signing in, opening the studio, or a connected AI agent working in it), recorded at most once a day, to apply the rule on inactive free accounts (section 6).
- Usage analytics in the studio: visits and actions, such as “created a model”, “calculated” or “opened the report”. They are recorded with your account (once you’re signed in), a shortened IP address (we never keep the full address for this), your browser, operating system and device type, the referring page and the campaign parameters of the link that brought you. No cookies are used for this, and you aren’t tracked across other websites.
When you visit rischio.io or use the free calculators without an account:
- Cloudflare Web Analytics measures visits in aggregate, without cookies and without identifying you.
- The calculators send only the model’s numbers to our servers, without any account or cookie. Your IP address is used only briefly, to limit abuse.
- If a page fails, Sentry receives the technical data of the error, without identifying you.
What we don’t collect:
- We don’t ask for sensitive data, and you shouldn’t include it in your models, descriptions or messages.
- We don’t use your location.
- The names, license numbers and signatures you add to a report stay in your own browser and never reach our servers.
3. What we use it for, and on what basis
| Purpose | Data | Legal basis |
|---|---|---|
| Create and run your account, provide the studio, calculate your models, produce your reports | account, content, AI, connected agents | performance of the contract; your authorization |
| Billing, subscriptions, invoices and taxes, through Paddle | account, plan and billing | performance of the contract; legal obligations |
| Security: preventing fraud, abuse, spam and attacks; enforcing the Terms | sessions, IP addresses, usage | our legitimate interest in protecting the Service and its users; legal obligations |
| Service emails: verification codes, password resets, trial and plan notices, replies to your feedback | account | performance of the contract |
| Product emails: tips to get started and news about Rischio | name, email, plan, and whether you’ve calculated a model or connected an agent | your consent, which you give with its own box at sign-up or in Settings and can withdraw at any time from Settings or from the link in each email |
| Support and fixing problems | feedback, account, content | performance of the contract; legitimate interest |
| Understanding how the Service is used and improving it | usage analytics, reviewed in aggregate | our legitimate interest |
| Complying with the law and answering authorities | what the law requires | legal obligations |
We don’t sell your personal data, we don’t share it for advertising, and we don’t send marketing emails without your consent. We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects, apart from closing an inactive free account under the rule in section 6, which we warn you about by email 30 days before. The academic email check that grants Education only compares your email’s domain with a public list of universities: if it’s wrong, write to us.
Under Colombian law, you give us your prior, express and informed authorization to process your data as this policy describes by ticking the acceptance box when you sign up, or by continuing with Google or Microsoft after the notice that says so. The studio then asks you to tick the box before you go on.
4. Who processes it with us
We share personal data only with the providers that help us run the Service. They act as data processors (“encargados”) under contract, except Paddle, Google and Microsoft, which act as independent controllers for their part. Each receives only what it needs for its task:
| Provider | What for | Data |
|---|---|---|
| Railway | hosting of the studio, its database and the engine | everything in the studio |
| Cloudflare | network, security, bot protection (Turnstile), storage of letterhead logos (R2), website analytics | IP addresses, technical data, logos |
| Paddle | payments as Merchant of Record: checkout, taxes, invoices, refunds | name, email, billing and payment data |
| Plunk | sending the service emails and, if you agreed, the product emails | name, email, the email’s content |
| Sentry | error monitoring, in the studio and on the website | technical data of errors, your user ID in the studio |
| Anthropic | the AI model that creates models from your descriptions | your descriptions and the model data needed |
| Google, Microsoft | signing in, only if you choose them | what section 2 lists |
| GitHub | tracking your feedback in a private repository | your message, the description you rated (when you rate the AI down), your plan, your user ID, the technical context |
Some details about specific providers:
- Paddle acts as an independent controller for the payment data it collects at checkout, under its own privacy policy.
- Anthropic doesn’t use the data we send it to train its models, under its commercial terms, and keeps it only for a limited period.
- GitHub doesn’t receive your name or email, though your message reaches it as you wrote it.
- Your AI agent: when you connect one, its provider (Anthropic, OpenAI or another) receives the model data you ask it to work with, under that provider’s own privacy policy.
When your models include other people’s personal data, we process it on your behalf, as your processor, under the Terms.
We may also disclose data to public authorities when the law requires it, to our professional advisers under a duty of confidentiality, and to a successor company in a merger or acquisition, which would be bound by this policy.
5. International transfers
Our providers process data in the United States and in other countries where they operate.
- Colombia’s Superintendence of Industry and Commerce (SIC) considers the United States to provide an adequate level of protection.
- For users in the European Economic Area and the United Kingdom, transfers rely on adequacy decisions (such as the EU–U.S. Data Privacy Framework, where the provider is certified) or on the Standard Contractual Clauses included in our providers’ data processing agreements.
By accepting this policy you authorize these transfers and transmissions.
6. How long we keep it
| Data | How long |
|---|---|
| Account, content, letterhead, feedback, connected agents | while the account exists; deleted within 30 days after it’s closed |
| Descriptions and results of the AI | while the account exists; when it’s closed, they are deleted, and only an anonymous record of the usage and its cost remains |
| Usage analytics in the studio | 24 months, then deleted automatically, or earlier if the account is closed |
| Sessions (IP and browser) | until you sign out, sign in on another device, or the account is closed |
| Accounts that never verified their email, or that signed up with Google or Microsoft and never accepted these documents | deleted after 7 days |
| Inactive free accounts (no paid subscription, trial or Education) | closed and deleted after 24 months without use (no sign-in, no use of the studio and no connected agent working in it), after an email 30 days before; signing in keeps the account |
| Feedback copied to our issue tracker (GitHub) | as part of our development history, without your name or email; we remove your message on request |
| Server logs, error reports and records of the emails we sent | the retention periods of our providers (Railway, Sentry, Plunk) |
| Invoices and payment records | with Paddle, as long as tax and commercial law requires |
Backups are overwritten in their normal cycle, so deleted data disappears from them as they rotate.
7. Your rights
Under Colombian law (Law 1581 of 2012, article 8), you have the right to:
- know, update and correct your personal data;
- request proof of the authorization you gave us, except where the law doesn’t require it;
- be informed, on request, of how we have used your data;
- revoke your authorization and request that your data be deleted, where no legal or contractual duty requires us to keep it;
- access your data for free;
- file complaints with the Superintendence of Industry and Commerce (SIC), after completing the inquiry or complaint process with us.
If GDPR applies to you, you also have the rights to:
- access, rectify and erase your data;
- restrict or object to its processing;
- data portability;
- withdraw your consent at any time;
- lodge a complaint with your data protection authority.
Other laws: depending on where you live, such as some US states, you may have similar rights to access, correct and delete your data. We don’t sell or share your personal information as those laws define it.
How to exercise them:
- Write to hello@rischio.io from your account’s email, saying what you ask for. We may ask you to confirm your identity. A complaint (“reclamo”) must include your identification, a description of the facts behind it, an address to answer you at, and any documents you want to rely on.
- You can also change your profile yourself in the studio, under Settings. You can export your reports as PDF or Word. A copy of all your data, or the closure of your account, is available on request.
- Response times:
- the terms run from the business day after we receive the request;
- inquiries (“consultas”) are answered within 10 business days, which can be extended once by up to 5 more, with notice;
- complaints and requests to correct, update or delete (“reclamos”) are answered within 15 business days, which can be extended once by up to 8 more, with notice. Within 2 business days of receiving one, we mark your data as “complaint in progress”. If a complaint is incomplete, we’ll ask for what’s missing within 5 business days; if you don’t send it within two months, the complaint is considered withdrawn;
- for GDPR requests, we answer within one month.
- Exercising your rights is free.
8. Cookies and similar technologies
In the studio we use only what is strictly necessary:
- a cookie that keeps you signed in until you sign out;
- a cookie that carries the security token of the forms;
- local storage in your browser for your preferences (theme, the view of your models) and for the report’s sign-off data, which never leaves your device.
We don’t use advertising or tracking cookies, and our analytics don’t use cookies.
On rischio.io we don’t set cookies. Your theme preference is saved in your browser’s local storage, and Cloudflare Web Analytics works without cookies. The home page also loads Paddle.js, from Paddle, for the payment updates described below.
Third parties may set their own cookies:
- Cloudflare, for security and bot protection, on rischio.io and in the studio;
- Paddle: in its checkout, on the studio’s billing page; on rischio.io’s home page, where Paddle.js lets a customer whose payment failed update it from Paddle’s emails; and, for customers who pay through Paddle, on the studio’s pages, where it warns of a failed payment or a card about to expire.
Since we only use what is strictly necessary, we don’t show a cookie banner.
9. Security
We protect your data with reasonable technical and organizational measures:
- encrypted connections (HTTPS) everywhere;
- passwords and access tokens stored as one-way hashes;
- protection against bots and brute-force attacks, and rate limits;
- access to personal data restricted to the people who need it to run the Service.
No system is completely secure. If a breach affects your data, we’ll notify you and the authorities as the law requires.
10. Minors
Rischio is for people aged 18 or older. We don’t knowingly collect data from minors. If we learn that an account belongs to someone under 18, we close it and delete its data. If you believe a minor has given us data, write to us.
11. Changes to this policy
We may update this policy. We’ll tell you about significant changes by email or in the studio at least 15 days before they take effect, and for those the studio will ask you to accept the new version. The version in effect and its date are at the top of this page.
12. Validity
This policy is in effect from October 14, 2026. Our databases are kept for as long as Rischio provides the Service and the purposes described here last, within the periods of section 6.
13. Contact
For any question or request about your personal data: Rischio S.A.S. · NIT 901787239-9 · Bogotá, Colombia · hello@rischio.io. This policy is offered in English and in Spanish. If they differ, the Spanish version prevails.