Privacy policy

1. Introduction

This Privacy Policy explains how Riska, Inc. ("Riska", "we", "us") handles personal data. It covers visitors to riska.io, people who contact us or apply for a job with us, and the people who use the Riska platform (the "Services"). We may update this policy from time to time, and the date at the top of this page shows the latest version.

2. Our role

For the personal data we collect about website visitors, prospective customers, job applicants and the users of customer accounts, Riska decides how that data is used, and is its controller.

Our customers use the Services to run their insurance business, and the records they keep in it, such as submissions, policies, insureds, claims and email, often contain personal data. For that data, the customer is the controller and Riska processes it on the customer's behalf and on its instructions, as set out in our agreement with that customer. If your personal data is held in a customer's Riska account, please contact that customer about it.

3. What personal data we collect

3.1 Data you give us

• Contact details, such as your name, work email, company and role, when you email us, book a demo or ask for support.
• Account details when your organization invites you to the Services, such as your name and email address.
• Applications you send us for a job, including your CV and anything else you choose to share.

3.2 Data collected automatically

• On riska.io. Our hosting provider records standard request logs, such as your IP address, browser and the pages requested, to operate and secure the site. riska.io does not use analytics, advertising or tracking cookies.
• In the Services. We use cookies that are strictly necessary to keep you signed in, and cookies that remember interface preferences such as panel layout. We record how the Services are used, including which records were changed and by whom, to operate, secure and support them. When an error occurs in the web application, we collect technical details about it, which can include your IP address and browser.

3.3 Data from accounts you connect

If you connect a Google or Microsoft mailbox or calendar to Riska, we access the email messages, contacts and calendar events that the connection permits, so that the Services can file, display and act on them for your organization.

3.4 Data from others

• Your organization, when it adds you as a user or assigns you a role.
• Your organization's identity provider, when you sign in with single sign-on or your account is provisioned through directory sync.
• Integrations your organization connects to the Services.

4. Data from Google user accounts

Riska's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Google user data only to provide and improve the user-facing features of the Services that the user enabled. We do not use it for advertising, do not sell it, and do not use it to train generalized AI models. Riska staff do not read it unless the user asks us to for support, it is necessary for security or to comply with law, or it has been aggregated and anonymised.

5. Lawful bases

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on these lawful bases:

• Contract, to provide the Services to you and your organization.
• Legitimate interests, to operate, secure and improve the Services, to respond to enquiries and to market to business contacts, where those interests are not overridden by your rights.
• Consent, where we ask for it, which you may withdraw at any time.
• Legal obligation, where the law requires us to process or keep data.

6. How we use personal data

• To provide, operate, maintain and support the Services.
• To authenticate users and keep accounts secure.
• To respond to enquiries and arrange demos.
• To send service messages, such as security notices and changes to our terms.
• To detect, investigate and prevent fraud, abuse and security incidents.
• To understand how the Services are used and to improve them.
• To evaluate job applications.
• To comply with the law and enforce our agreements.

We do not sell personal data, and we do not share it for cross-context behavioural advertising. Riska does not use customer data to train AI models.

7. Marketing emails

We may send business contacts occasional news about Riska. Every marketing email includes an unsubscribe link, and you can also opt out by writing to privacy@riska.io. Opting out does not stop service messages about an account you use.

8. Who we share personal data with

• Service providers that host and operate the Services for us, under written agreements. They are described on our Subprocessors page.
• Your organization, which can see the data held in its account, including your activity in it.
• Professional advisors, such as lawyers and accountants, under a duty of confidentiality.
• Authorities, where the law requires it or where it is needed to protect the rights, property or safety of Riska, our customers or others.
• A buyer or successor, if Riska is involved in a merger, acquisition or sale of assets, subject to this policy.

9. Where we process personal data

Riska is based in the United States, and the Services are hosted in the United States. Some of our service providers process data in other countries. Where we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we use the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.

10. Security

We use technical and organizational measures designed to protect personal data, described on our Security page. No system is perfectly secure, and we cannot guarantee the security of data sent to us over the internet.

11. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to how we use it, receive a copy of it in a portable format, and withdraw consent. California residents also have the right to know what personal data we collect and how we use and disclose it, and not to be discriminated against for exercising their rights.

To exercise a right, write to privacy@riska.io. We will verify your request and respond within the time the law allows. If your data is held in a customer's account, we will refer your request to that customer. You may also complain to your local data protection authority.

12. Retention

We keep personal data for as long as we need it for the purposes in this policy. We keep account data for as long as the account is active. Customer data is kept and deleted on the customer's instructions and in line with our agreement with them. We keep some data longer where the law requires it or to resolve disputes, and we may keep data that has been anonymised so that it no longer identifies anyone.

13. Children

The Services are for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18.

14. Third-party sites and services

riska.io and the Services link to, and connect with, sites and services that we do not control. This policy does not cover them, and we encourage you to read their privacy policies.

15. Contact us

For any question about this policy or your personal data, write to privacy@riska.io.