This Privacy Policy explains how Brijesh Kumar ("Ritsora AI", "we", "us") — the operator of the Ritsora AI software — collects, uses, shares, retains, and protects information when you use our website and applications (the "Service"). We act as the data controller of the personal data we collect about you as a user of the Service.
1. Information we collect
- Account data: email address, display name, password hash, and authentication identifiers.
- Profile & preferences: country, currency, language, risk profile, and any goals or notes you enter.
- Financial data you enter or import: accounts, transactions, holdings, budgets, goals, documents.
- Usage & device data: pages visited, actions taken, device type, browser, IP address, timestamps.
- Support data: messages you send us and their metadata.
- Billing data (handled by Paddle): we do not receive or store your full card number. Paddle (see §4) collects payment credentials, billing address, and tax identifiers directly and shares limited transaction metadata (order ID, plan, status, country, last-four) with us.
2. Why we use it (purposes)
- Provide, operate, secure, and improve the Service and its features.
- Generate personalized insights, briefs, and educational recommendations you request.
- Manage your account, subscription, and communications about the Service.
- Detect, investigate, and prevent fraud, abuse, and security incidents.
- Comply with legal, tax, and regulatory obligations.
3. Legal bases (where applicable, e.g. UK/EEA users)
- Contract: to provide the Service you signed up for.
- Legitimate interests: product improvement, security, fraud prevention, service analytics.
- Consent: optional features such as marketing emails or non-essential cookies (withdrawable at any time).
- Legal obligation: tax, accounting, and lawful requests from authorities.
4. Payments and Paddle as Merchant of Record
Paid subscriptions are sold and processed by Paddle.com Market Ltd and its affiliates ("Paddle"), which acts as the Merchant of Record for all orders. Paddle collects your payment method, billing address, and applicable tax identifiers directly and is the data controller for that payment data. Paddle handles payments, invoicing, tax, chargebacks, and refunds. See Paddle's Privacy Notice.
5. Sharing and sub-processors
We do not sell your personal data. We share it only with:
- Hosting & database infrastructure (cloud hosting, managed database, storage).
- AI inference providers that process your prompts to generate responses in real time.
- Paddle (Merchant of Record) for payments, billing, tax compliance, invoicing, and refunds.
- Analytics and error-monitoring providers that help us keep the Service reliable.
- Professional advisers (legal, accounting) under duties of confidentiality.
- Authorities where required by law or to protect rights, safety, or security.
6. AI processing
AI features process your inputs in real time to generate responses. Your data is not used to train third-party foundation models. AI output is informational only and is not a substitute for professional advice.
7. International transfers
Personal data may be processed in countries other than your own, including where our sub-processors operate. Where such transfers occur from the UK/EEA, we rely on adequacy decisions or Standard Contractual Clauses as appropriate.
8. Retention
- Account & profile data: for as long as your account is active, then deleted or anonymized within 90 days of account closure.
- Financial data you entered: deleted with your account, or on request via Profile → Privacy.
- Billing & tax records: retained by Paddle and by us for up to 7 years to meet legal and tax obligations.
- Security & audit logs: retained for up to 24 months for fraud and abuse prevention.
- Support messages: retained for up to 24 months after the ticket is resolved.
9. Security
We use TLS in transit, encryption at rest, row-level access controls, hashed credentials, MFA where available, and audit logging. No system is perfectly secure — please use a strong password and enable MFA.
10. Your rights
Depending on where you live, you may have rights to access, rectify, erase, restrict, object to, or port your personal data, and to withdraw consent. You can exercise most of these directly in the app (Profile → Privacy) or by emailing support@ritsoraai.app. UK/EEA users have the right to lodge a complaint with their local supervisory authority.
11. Cookies
We use strictly necessary cookies for authentication and session management, and limited analytics cookies to measure usage. You can manage non-essential cookies in your browser settings.
12. Children
The Service is not directed to children under 18 and we do not knowingly collect their data.
13. Changes
We will notify you of material changes to this policy in-app or by email before they take effect.
14. Contact
Questions about this policy or your data? Email support@ritsoraai.app.