Privacy policy

Who we are

Riskhold provides a risk register for small companies. For the personal data inside a customer's register we are a processor, acting on that customer's instructions. For account and billing details we are a controller.

What we hold

• Account data — your email address, the company name, your role, and when you joined. Needed to sign you in and to say who did what.
• Profile answers before you sign up — if you answer the company profile without an account, the answers are held against your browser's session and nothing else: no name, no address. Saving them to an account moves them there; otherwise they are deleted within a day of the session expiring, thirty days after your last visit.
• Register content — the risks, controls and decisions you record. This is yours; we process it to provide the service and for nothing else.
• Activity records — an append-only log of changes, with the email address of whoever made each one. This is the evidence the product exists to produce, and it is why the log names people.
• Billing details — held by our merchant of record, not by us. They are the seller on your invoice, so the card, the billing address and any tax id are theirs to hold. We store an opaque customer reference and nothing else; there is no card number anywhere in Riskhold to lose.

We do not use advertising, and we do not profile you or sell anything to anyone.

Analytics and error reports

Product analytics, only if you allow them. We ask the first time you visit. If you allow them, PostHog, hosted in the EU, receives which pages you open and which buttons you press. All on-screen text and link targets are removed before anything is sent, so a click on a risk does not send its title. Each page is sent as its pattern, such as /risks/<id>/, rather than its address. Events are keyed by your account's id, never your email. There is no recording of your screen. If you say no, or never answer, PostHog's code is not loaded at all. You can change your mind at any time from Analytics choices at the foot of every page; saying no then removes PostHog's cookie.

Error reports. When something breaks, PostHog receives the kind of error, where in our code it happened, the page's pattern and the request method. Email addresses and the values that caused a database error are removed first, and nothing from your register is included.

Cookies. One records your analytics answer. If you allow analytics, PostHog sets its own to recognise a returning browser. The rest are what signing in needs, and what holds profile answers given before signing up.

Why we are allowed to

Account and register data: performance of our contract with you. Security logging, error reports and fraud prevention: our legitimate interest in running a service that works and can account for itself. Product analytics: your consent. Marketing email: consent, which you can withdraw — the weekly review digest is part of the service and can be turned off per person from a link in every message.

How long we keep it

For as long as the account exists. When an account is deleted, everything belonging to it is permanently removed after a 30-day grace period, and ages out of encrypted backups within the retention window in the security overview.

Workspaces created by an AI agent, before anybody claims them

Riskhold lets an agent create a workspace and draft a register into it before any person has signed up, so that whoever it is working for arrives at something already written rather than an empty form. See working with an AI agent for what that is and why.

An unclaimed workspace holds no personal data. That is by design rather than by luck: we are never given anybody's email address at that stage, and there is no way to give us one. No account exists, nobody can sign in, and nothing is sent anywhere. What the workspace holds is whatever the agent drafted — risks and controls describing a company, not people.

The only thing recorded about the caller that created it is a one-way keyed hash of the network address the request came from, kept so that one machine cannot create workspaces without limit. It is not reversible and we do not store the address itself.

It is deleted after 5 days if nobody claims it, and within 30 minutes if nothing is ever drafted into it — automatically, using the same erasure that deletes a real account. Nothing has to be requested and nobody has to remember.

The moment a person claims one, they give us their own email address and it becomes an ordinary account governed by everything above.

Your rights

You can access, correct, export and delete your data. Access, export and deletion are self-serve for account owners under Settings → Your data, and do not require asking us. The export includes everything we hold, in a machine-readable format, which covers portability.

If you are a member of a company using Riskhold and want your own personal data removed, ask an owner of that company — they control the register. If they cannot help, contact us.

Where it goes

Hosted in the EU. The subprocessors we use are listed on the subprocessors page. Where one processes data outside the EEA, standard contractual clauses apply.