RISOS Privacy Policy

1. Scope, operator, and our privacy approach

RISOS is the operator name used for this online business research and decision-intelligence service. We process information to provide evidence-backed research, saved workspace state, monitors, reports, developer access, account administration, security, and related product functions. We aim to collect and retain only information reasonably necessary for those purposes and for legitimate security, compliance, and operational requirements.

This policy applies to personal information RISOS processes for its own service operations and explains when RISOS may also process data on behalf of a business customer. Third-party platforms and services remain subject to their own privacy practices.

2. Information we process

Account and workspace information. This can include email address, authentication identifiers, display name, workspace or organization membership, role, account settings, and security-related account metadata.

Content you provide. We process research questions, prompts, subjects, filters, saved items, reports, monitor settings, feedback, support messages, and other content you choose to submit.

Research evidence and source information. RISOS may process information from public sources, licensed datasets, structured data providers, official APIs, or user-authorized integrations. Evidence records may include source identifiers, URLs, timestamps, excerpts or derived facts, provenance, confidence, freshness, and technical metadata needed to support an inspectable result.

Developer and API information. If you use developer interfaces, we may process API-key metadata, scopes, request metadata, rate-limit and usage information, investigation identifiers, and security/audit events. Secret API-key values are designed for one-time disclosure and are not returned by normal metadata listings.

Technical and usage information. We may process IP-derived request information, browser or device information, request and response metadata, diagnostic events, performance information, model-usage telemetry, security signals, and logs needed to operate, secure, debug, measure, and improve reliability.

Billing and subscription information. RISOS includes a Stripe-based commercial billing integration that remains inactive until RISOS configures and enables self-service checkout. If activated, RISOS may process billing-account identifiers, plan and billing-cycle selections, subscription status, Stripe customer/subscription/invoice references, purchase-status metadata, and billing contact information needed to administer the subscription. Payment-card details are intended to be collected and handled by Stripe through Stripe-hosted checkout or billing surfaces rather than stored directly by RISOS.

3. Where information comes from

Information may come directly from you; from your organization or workspace administrators; from product interactions; from sources you ask RISOS to research; from approved public, licensed, or structured providers; and from service providers that help us operate the service. RISOS does not treat an unavailable or unapproved provider as permission to obtain the same data through prohibited circumvention or scraping.

4. How we use information

We use information to authenticate users; provide research and decision-intelligence features; preserve evidence lineage and workspace memory; generate, verify, save, and export outputs; operate monitors; enforce authorization, quotas, and cost controls; prevent abuse; diagnose failures; protect users and the service; respond to support and privacy requests; maintain records required for security or compliance; and improve product reliability and user-facing functionality.

5. Google API Services and Google user data

Where RISOS is authorized to use Google API Services, we request only the access needed for a currently enabled feature. We explain the purpose of access in the relevant product or authorization flow and do not request permissions merely to reserve them for possible future features.

Google Ads and search-demand research. Where approved, RISOS may use the Google Ads API and permitted Keyword Planner capabilities through RISOS-controlled access to obtain keyword-planning or search-demand information for RISOS research. The current RISOS provider model does not require customers to connect their private Google Ads accounts for this function. If that model changes, this policy and the relevant authorization disclosure will be updated before new user data is accessed.

User-authorized Google data. If RISOS offers a feature that asks you to authorize access to Google account data, RISOS will access and use only the data covered by the scopes you approve and only for the disclosed user-facing function. We do not sell Google user data; use it for targeted, personalized, or retargeted advertising; use it to determine creditworthiness or for lending; distribute it to data brokers; or provide it for third-party surveillance.

Limited Use. RISOS’s use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including applicable Limited Use requirements. For Google data subject to Limited Use, transfers are restricted to what is permitted for the authorized user-facing feature, security, legal compliance, or another policy-permitted purpose. Human access is restricted to circumstances permitted by Google’s policy, such as user-authorized support, security/abuse investigation, legal obligations, or appropriately aggregated internal operations.

RISOS does not use Google user data obtained through restricted or sensitive OAuth scopes to train generalized advertising profiles or generalized AI models. Credentials and tokens used to access Google APIs are treated as confidential authentication material and are handled server-side where applicable.

6. YouTube API Services

RISOS uses the official YouTube Data API v3 for currently enabled base public retrieval, including public video context, comments, and replies. Current raw public comments are display-only evidence while advanced analytics and derived-metrics permission remains pending. RISOS does not use prohibited scraping or undocumented YouTube interfaces to replace unavailable API access, and it does not represent unapproved YouTube capabilities as active. For information about Google's privacy practices, see the Google Privacy Policy.

For YouTube API Data, RISOS follows applicable YouTube requirements concerning authorization, display, refresh, storage, revocation, and deletion. Non-authorized raw API data is refreshed or deleted within the applicable 30-day policy window, with a RISOS refresh target before that deadline. Advanced derived metrics, long-term statistical storage, raw model processing, and raw embeddings remain disabled unless YouTube expressly accepts the relevant analytics use case. Where user authorization is involved, a user may also revoke Google permissions through Google’s security permissions page. Deleting information stored by RISOS does not itself delete content stored by YouTube; changes to YouTube-hosted content must be made through YouTube or another authorized client that supports that action.

7. TikTok API Services

If and when TikTok functionality is activated, RISOS may use approved TikTok APIs and products to obtain and analyze information permitted by TikTok for research, public-content discovery, trend and creator intelligence, commercial-content analysis, and related decision-intelligence features. RISOS will use only TikTok products, scopes, permissions, purposes, and geographic coverage that TikTok has approved for the relevant integration. RISOS will not use prohibited scraping, circumvention, or undocumented TikTok interfaces to replace unavailable or unapproved API access.

TikTok-derived data will be processed only for purposes permitted by TikTok and disclosed through RISOS. Access, storage, retention, sharing, deletion, model processing, and export controls are subject to applicable TikTok developer terms, data-use requirements, product-specific policies, and approval conditions. Where TikTok imposes shorter retention, deletion, revocation, geographic, or redistribution requirements, those provider-specific requirements control for the affected TikTok data.

RISOS does not treat TikTok authorization as permission to use TikTok data for unrelated purposes, sell TikTok-derived personal information, or train generalized advertising profiles or generalized AI models unless TikTok expressly permits that use and RISOS separately discloses and lawfully enables it. TikTok credentials, client secrets, and access tokens are treated as confidential authentication material and are handled server-side where applicable.

Current approved scope clarification. RISOS may activate a TikTok product or profile only to the extent it has been approved and production-qualified. Approval of Commercial Content or another specific product does not activate Discovery, TikTok One, customer-authorized profiles, or other capabilities that remain pending or fail-closed.

8. AI and model providers

RISOS may use AI/model providers to perform functions such as extraction, synthesis, classification, and independent verification. We limit information sent to a provider to what is reasonably necessary for the relevant function. Provider data subject to additional transfer or model-processing restrictions, including Google, YouTube, or TikTok data, is not transferred to an AI provider unless that transfer is permitted, necessary for a disclosed user-facing feature, and handled consistently with the applicable provider requirements.

Depending on the research path, configured provider availability, and source policy, RISOS may use OpenAI, Anthropic, xAI, or local processing. Not every source is eligible for every model route. The AI Terms describe these model-assisted features and user responsibilities.

9. Service providers and sharing

We may disclose information to infrastructure, hosting, database, security, observability, support, payment-processing, and model service providers acting for us when needed to operate the service. We may also disclose information when required by applicable law or valid legal process; to investigate abuse or protect RISOS, our users, or others; or in connection with a legitimate business reorganization subject to appropriate safeguards. We do not sell personal information.

Where RISOS acts as a processor for a business customer, current subprocessors are identified on the Subprocessor List.

10. Data retention

We retain information only for as long as reasonably necessary for the purpose for which it was processed, taking into account account status, workspace needs, security and fraud prevention, legal obligations, dispute resolution, provider-specific rules, and the need to maintain accurate evidence lineage. Some provider data may have shorter refresh or deletion requirements and is handled according to those applicable rules.

Current concrete examples include a 24-hour maximum age for the anonymous-research session cookie, a seven-day cancellable grace period before scheduled account-deletion processing begins, and the YouTube raw-data refresh/deletion rule described above. Other records use purpose-based criteria where a single universal period would be inaccurate.

11. Data export, deletion, and revocation

Authenticated users can use available controls in Settings to export supported account/workspace information and to schedule account deletion. The current account-deletion workflow includes a seven-day grace period during which a pending request can be cancelled before processing begins. Provider-specific revocation or deletion obligations, including obligations for authorized Google, YouTube, or TikTok data, may operate independently and on shorter or different timelines where required.

For a public explanation of these controls, see Data & Account Deletion. If you cannot access your account, contact hello@risos.co.

12. Security

RISOS uses administrative and technical safeguards intended to protect information, including encrypted transport, organization-scoped access controls, server-side credential handling, authorization checks, row-level data boundaries, audit/diagnostic controls, and restricted privileged-service access. No online service can guarantee absolute security, and users are responsible for protecting their own credentials and devices.

13. Your choices and rights

Depending on the feature and applicable law, you may be able to access or export certain information, correct profile information, revoke an integration, request deletion, or object to or restrict certain processing. You can also choose what questions and content you submit. To exercise a request that is not available in-product, email hello@risos.co. We may need to verify your identity or authority before acting on a request.

Depending on where you live, additional rights may include portability, consent withdrawal, an appeal of a denied privacy request, or a complaint to a privacy regulator. Authorized agents may submit requests where applicable law permits and appropriate authority can be verified. RISOS will not discriminate against you for exercising a non-waivable privacy right.

14. International processing

RISOS and its service providers may process information in locations different from where you live. Where applicable law requires safeguards for cross-border processing, we will use appropriate mechanisms for the relevant processing relationship.

RISOS is an online service available to users in multiple countries. Availability in a country does not mean RISOS has an establishment there. If a law requires a local representative, transfer instrument, or other jurisdiction-specific mechanism for a particular processing relationship, RISOS will apply the required mechanism to that relationship rather than claim a representative or safeguard that has not actually been established.

15. Children

RISOS is designed for professional and business use and is not directed to children. You must be at least 18 years old to create or use a RISOS account. We do not knowingly design the service to solicit personal information from children through provider account authorization. If you believe a person under 18 has provided personal information through RISOS, contact hello@risos.co.

16. Legal bases for EEA, UK, and similar regimes

Where applicable law requires a legal basis for processing, RISOS relies on the basis appropriate to the specific purpose: performance of a contract or steps requested before a contract for account access and requested service functions; legitimate interests for service security, abuse prevention, reliability, support, and proportionate product operations where those interests are not overridden by individual rights; consent where RISOS specifically asks for it for optional processing; and legal obligation where processing is required by law. A source-platform authorization or OAuth grant does not replace a legal basis where applicable privacy law separately requires one.

17. Cookies and session technologies

RISOS currently uses browser/session technologies primarily for authentication, security, access continuity, and anonymous research previews. We do not currently use cookies to build cross-site advertising audiences or for behavioral retargeting. Details, including the current anonymous-session and access-token lifetimes, are in the Cookie & Session Technologies Policy.

18. Other source platforms and public information

RISOS may process information obtained from approved public sources, licensed datasets, and official interfaces such as X, Bluesky/AT Protocol, Wikimedia, Stack Exchange datasets, GDELT, GitHub, SEC EDGAR, and public package registries. The exact information processed depends on the research question and provider policy. Public availability does not eliminate applicable privacy, license, attribution, retention, or platform-policy obligations.

RISOS maintains source-specific controls that can limit reuse scope, raw retention, embeddings, model routes, exports, attribution, and deletion/revision propagation. A provider becoming unavailable or restricted does not authorize RISOS to replace it with prohibited scraping or circumvention.

19. Sale, sharing, and targeted advertising

RISOS does not currently sell personal information or use personal information for cross-context behavioral advertising or retargeting. We do not currently deploy an advertising-cookie layer. If RISOS introduces a practice that qualifies as sale, sharing, targeted advertising, or another regulated advertising activity under applicable law, we will update the relevant notices and provide required choices before relying on that practice.

20. Business-customer processing

When a business customer determines the purpose of personal data it submits to RISOS and RISOS processes that data on the customer’s behalf to provide the service, RISOS may act as a processor or subprocessor. The Data Processing Addendum describes that relationship. For information RISOS processes for its own account administration, security, compliance, or other independently determined purposes, RISOS may act as a controller or equivalent business under applicable law.

21. Changes to this policy

We may update this policy as the product, provider integrations, or legal requirements change. The “last updated” date identifies the current version. If a material change affects the purpose for which previously authorized provider data is used, RISOS will provide any notice or renewed consent required before using that data for the new purpose.

22. Contact

Privacy, data, security, and platform-policy questions can be sent to hello@risos.co. You can also use the Contact page. RISOS does not currently publish a physical business address.