Privacy policy

The controller for the processing of your personal data is Softcompose Karol Piasecki, NIP 7991978123, REGON 389127710, 33A, 26-503 Bieszków Dolny, mazowieckie, Poland. You can reach our privacy team at privacy@risechat.ai.

We collect the following categories of personal data: (a) Account data: your email address, the password hash, and the authentication session. (b) Billing data: your billing name, billing address, tax identification number if provided, and the last four digits and expiry of the payment card, as received from Stripe. We do not see or store full card numbers. (c) Service data: the domains, URLs, brand names, and prompts you configure, the audit reports and Schema files we generate, and the monitoring results. (d) Contact data: the name, work email, company name, and message you submit through the contact form. (e) Usage data: pages viewed, features used, timestamps, and the IP address and user agent of the request, as collected by our hosting provider and Google Analytics.

We process your personal data for the following purposes, on the legal bases set out in Article 6 of the GDPR: (a) To create and maintain your account, provide the service, and process payments: performance of a contract. (b) To handle your support requests and respond to enquiries: performance of a contract and our legitimate interest in operating the business. (c) To send you essential service announcements, such as security alerts and material changes to the terms: performance of a contract and our legitimate interest. (d) To send you product updates and marketing communications, where you have given consent: consent, which you may withdraw at any time. (e) To monitor and improve the service, prevent abuse, and secure the platform: our legitimate interest. (f) To comply with legal obligations, including tax and accounting law: legal obligation.

We share personal data only with the following categories of recipients, under written agreements that meet GDPR Article 28: (a) OVH, our hosting and infrastructure provider, located in the European Union. (b) Stripe, our payment processor, located in the United States and the European Union, which processes billing data under its own privacy policy. (c) Google Analytics, our web analytics provider, located in the United States, which processes usage data under its own privacy policy. (d) NextAuth, the authentication library we use, which runs on our own OVH infrastructure. We do not sell personal data. We do not share personal data with advertising networks, data brokers, or social media platforms for advertising.

Some of our processors are located outside the European Economic Area. Where personal data is transferred to a country without an adequacy decision from the European Commission, we rely on the European Commission's Standard Contractual Clauses, supplemented by additional technical and organisational measures. The current transfers are: Stripe (United States, under SCCs) and Google Analytics (United States, under SCCs and IP anonymisation). A copy of the safeguards can be requested from privacy@risechat.ai.

We retain personal data for as long as needed to provide the service and comply with legal obligations: (a) Account data: for the life of the account, plus thirty days after deletion to allow recovery, after which it is permanently deleted. (b) Billing data: for ten years from the invoice date, as required by Polish tax law. (c) Service data (audit reports, Schema files, monitoring data): for the life of the account; deleted within ninety days of account deletion, unless you ask for earlier deletion. (d) Contact form submissions: for twenty-four months from the last interaction, to handle the relationship. (e) Analytics data: fourteen months (Google Analytics default). (f) Server logs: ninety days.

We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit (TLS 1.2+), encryption at rest on managed databases, access control on a need-to-know basis, audit logging of administrative actions, and regular backup. Access by our team is logged and limited to the smallest set of people required to operate the service. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within seventy-two hours and affected users without undue delay.

You have the right to: (a) access the personal data we hold about you; (b) correct inaccurate or incomplete data; (c) request deletion of your data, subject to legal retention obligations; (d) restrict or object to processing in certain cases; (e) data portability, in a structured, commonly used, machine-readable format; (f) withdraw consent at any time, where processing is based on consent; (g) lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland, or with the supervisory authority in your country of residence. To exercise any of these rights, email privacy@risechat.ai. We will respond within one month.

We use cookies and similar technologies on risechat.ai. The categories we use, and how to control them, are described in detail in our Cookie policy.

We do not use your personal data for automated decision-making that produces legal effects or similarly significant effects on you. AI models are used to generate content, audit reports, and Schema, but final decisions about your brand and your use of the service are made by you.

We may update this Privacy policy from time to time. Material changes will be announced at least fourteen days before they take effect, by email and by a notice in the dashboard, with a clear summary of what is changing and why. The date of the latest update is shown at the top of this page.

For any question about this Privacy policy or our processing of your personal data, contact privacy@risechat.ai. Softcompose Karol Piasecki, NIP 7991978123, REGON 389127710, 33A, 26-503 Bieszków Dolny, mazowieckie, Poland.