Privacy Policy

1. Who we are

Risecore ("we", "us") is an AI management assistant that helps you run a business by chat. It is operated by [company or person's legal name], [registered address], [country].

This policy explains what personal data we handle, why, and what choices you have. If you have a question, use the Contact page.

A word on roles: for your account and billing details we decide how the data is used, so we are the "controller". For your business records (your customers, products, sales and so on) you decide what goes in and why, and we process it on your behalf as your "processor". You are responsible for having the right to put your customers' and staff's information into Risecore.

2. What we collect

We collect only what Risecore needs to work. Here is everything, grouped by where it comes from:

• Your account: your email address, your name (if you give it), your password (kept only as a one-way hash, so we can't read it) and, if you choose Continue with Google, the email and basic profile Google shares with us.
• Free early access details: while paid plans are not open, we note that your account is on free access, the language you use and your country (from your browser or a general location check), so we can show the right allowance and tell you when paid plans open. We also keep a count of the AI requests each account makes (with an estimate of what they cost us) so that free access stays affordable, and, for one day, a scrambled (hashed) form of the IP address used to sign up, to stop one person creating many accounts.
• Your business: its name, country, currency, time zone, what you sell, locations and settings.
• Your records: products and stock, sales, expenses, receivables and payables, customers (names and contact details you enter, what they bought and owe), suppliers and purchase orders, and the notes and files you attach.
• Receipts: when you (or your staff) send a customer a receipt, the email address you type for it, a copy of what the receipt shows (the items, prices, totals, payment and date, never your costs or profit), the receipt number and a log of each send (when, by whom, delivered or failed). If you choose to save the address on the customer, it is kept with that customer. We keep the address only to send receipts: it is never added to a mailing list and never used for marketing.
• Your team: for each staff account, a display name, username, role and permissions, an optional photo, and a log of what they did in the app (for example sales logged and approvals). A staff PIN is turned into a password and stored only as a hash.
• Photos and files: pictures of products or people, spreadsheets and PDFs that you upload or attach to a chat.
• Voice recordings: if you use the microphone, the recording of what you say, which is turned into text.
• Chat messages: what you type or say to the assistant, its replies, and the records it looked up to answer.
• Payment details: when paid plans are active, our payment provider Paddle collects your payment details and billing address. We receive confirmation of your plan, your billing country and invoices, but never your full card number.
• Technical data: your IP address, device and browser type, and basic request logs, used to keep the service secure, stop abuse and fix errors.

3. Why we use it

We use your data only to run and improve Risecore for you:

• to provide the service: sign you in, store and show your records, answer your questions and carry out what you ask
• to send what you ask for or need: the email summaries and alerts you switch on, receipts you send to your customers, and account and security messages
• to take payment and manage your plan, and to tell you when paid plans open if you are on free early access
• to keep Risecore secure, prevent fraud and abuse, and fix problems
• to meet legal obligations, such as tax and accounting records
• to support you when you contact us

4. We don't sell your data

We do not sell your personal data, and we do not share it with advertisers or use it for advertising. We do not use your business records to train AI models of our own. Your data is shared only with the service providers in section 6, who may use it only to provide their service to us.

5. Where it is stored

Your data is stored with Supabase, our database, sign-in and file-storage provider. Our Supabase project is hosted on Amazon Web Services in Europe (Ireland). Each business can only reach its own records, and each team member only what their role allows. Data is encrypted while it travels between you and us.

The website itself is served by [hosting provider, e.g. Vercel], which handles requests and technical logs.

6. Who else processes your data

We use a small number of trusted providers. Each receives only what it needs:

• Supabase: database, sign-in and file storage for all your data.
• Anthropic: the AI that reads your question and your records and writes the answer. When you chat, the text of your messages and the records needed to answer are sent to Anthropic. [Legal to confirm Anthropic's current data-use and retention terms for API customers.]
• ElevenLabs: turns voice recordings into text. We send the recording only to transcribe it and do not keep the audio. [Legal to confirm ElevenLabs' retention terms and whether zero-retention is enabled.]
• Resend: sends the emails you switch on, receipts you send to your customers, and account emails. It receives the recipient's email address and the email content (for a receipt, the receipt and its PDF).
• Paddle: our payment provider and merchant of record. It collects payments, handles sales tax and issues invoices. Paddle is responsible for your payment details under its own privacy policy.
• Google: only if you choose to sign in with Google.
• Cloudflare: Turnstile, a bot check that may appear when you create an account.
• [Hosting provider, e.g. Vercel]: serves the website and keeps technical logs.
• Authorities and advisers: we may disclose data if the law requires it, to protect our rights, or to our lawyers and accountants, who must keep it confidential.

7. How long we keep it

We keep your data while your account is open, so that Risecore keeps working for you. In detail:

• Account and business records: until you delete your account (section 9).
• Free early access details and AI usage counts: until you delete your account, plus a short time afterwards for our records. The hashed sign-up IP address: one day. [Operator to confirm.]
• Voice recordings: not stored by us. They are processed to produce text and then discarded.
• Chats and uploaded files: until you delete them or your account.
• Receipts and their send log: until you delete your account. The link in a receipt email stops working after one year, or sooner if you revoke it.
• Billing records: kept by us and Paddle for as long as tax and accounting law requires, even after you delete your account. [Legal to confirm the period for your country.]
• Security and technical logs: kept for a short time, [for example 30 to 90 days]. [Operator to confirm.]
• Backups: deleted data may remain in encrypted backups for up to [30 days] before it is overwritten. [Operator to confirm.]

8. Your rights, and exporting your data

You can see and edit your data in the app at any time. You can export the tables in the app (such as products, sales and finance) to Excel or PDF whenever you want. If you would like a full copy of everything we hold about you, or want to correct, restrict or object to how we use your data, use the Contact page. We aim to reply within a month.

Depending on where you live (for example the EU, the UK, California and many other places) you have legal rights over your personal data, including to access it, correct it, delete it, receive a portable copy, and object to or restrict some uses. You can also complain to your local data protection authority. We will not treat you worse for using these rights.

If you are a staff member or a customer of a business that uses Risecore, the business owner is usually the right person to ask about your data, because they control what is stored. You are welcome to contact us as well, and we will point you in the right direction.

9. Deleting your account and data

The business owner can delete everything without asking us. In the app, go to Settings and choose "Delete my account and data". You confirm by typing your business name and your password. This permanently removes:

• your business and all its records: products, sales, customers, suppliers, purchase orders, finance records and chats
• every photo and file you uploaded
• the sign-in details of everyone on your team, and your own sign-in

Deletion happens straight away and cannot be undone, so export what you need first. Copies in encrypted backups are overwritten within the period in section 7, and we may keep billing records as the law requires. Deleting your account does not by itself cancel a paid plan with Paddle, so cancel the plan first (see the Terms).

Staff and managers can't delete the business; ask the owner. If you can't sign in, use the Contact page from the email address on the account and we will delete it for you.

10. Cookies and similar storage

Risecore uses only what it needs to work. We do not use advertising, tracking or analytics cookies. What we store in your browser:

• Sign-in cookies, so you stay signed in (up to 30 days after your last visit).
• Your language, theme, time zone and country, so the app looks right for you.
• Whether your sidebar is collapsed.
• For shared staff screens: a device cookie that remembers the business is set up on that device, an idle timer and a lock setting.
• Your microphone choice and spoken language, in your browser's local storage.

11. Children

Risecore is for people running a business and is not aimed at children. You must be at least 18 (or the age of majority where you live) to create an account. We do not knowingly collect personal data from children. If you think a child has given us data, use the Contact page and we will delete it.

12. International users and transfers

Risecore is available worldwide. Our database is in Ireland, and our providers (such as Anthropic, ElevenLabs, Resend, Paddle and Google) may process data in other countries, including the United States. When data leaves the EU, the UK or similar regions, we rely on approved safeguards, such as the European Commission's standard contractual clauses or an adequacy decision. [Legal to confirm the transfer mechanism used with each provider.]

By using Risecore you understand that your data is processed in these places.

13. Security

We protect your data with encryption in transit, per-business access rules, hashed passwords and PINs, limits on repeated sign-in attempts, and role-based permissions. No system is perfectly secure, so please use a strong, unique password and keep staff PINs private. If a breach affects your data, we will tell you and the authorities as the law requires.

14. Changes to this policy

We may update this policy as Risecore changes. We will update the date at the top and, for important changes, tell you in the app or by email before they take effect.

15. Contact us

Questions or requests about your data? Use the Contact page. Our address is [registered address]. [If required for your region: the name of your data protection officer or your EU/UK representative.]