Privacy Policy

Riseklix Media is an India-based business providing AI Commercial Discovery software and related services for businesses and professional teams. This Policy applies to the Riseklix application, account and workspace administration, product research workflows, public share links, support, and related product communications.

This Policy does not govern third-party websites, AI providers, search engines, social networks, developer tools, or other services that have their own privacy policies. When you follow a link to or intentionally use a third-party service, that service may process information under its own terms.

When Riseklix decides how and why data is used

For account administration, authentication, service security, product telemetry, support, billing-related records when applicable, and our own product operations, Riseklix generally acts as the organization determining the purpose and means of processing. Depending on the law, this role may be called a controller, business, or Data Fiduciary.

When a business customer submits data for us to process on its behalf

In some workflows, a customer may submit personal information solely so Riseklix can perform requested processing for that customer. In those circumstances, applicable law or a separate written data-processing agreement may allocate controller/processor, business/service-provider, or Data Fiduciary/Data Processor responsibilities differently.

If your organization requires a data-processing agreement for its use of Riseklix, contact us before submitting regulated personal data.

Account and identity information

• Name, email address, account identifiers, avatar where supplied, authentication provider, and sign-in records.
• Password credentials when email/password authentication is used. Password handling is provided through our authentication infrastructure; Riseklix does not need to display your password to operate the service.
• Workspace name, role, membership, onboarding status, and account preferences.
• OAuth-related identity information received when you choose Google or Microsoft sign-in, limited to the scopes used for authentication.

Company and project information

• Company names, domains, markets, languages, websites, products, services, customer context, positioning, competitors, and business facts supplied or confirmed by a user.
• Buyer Situations, benchmark questions, prompt expressions, observation settings, research defaults, project status, and review decisions.
• Information you paste, upload, link, or otherwise submit into a project or support request.

Product-generated research records

• AI-provider answers, citations, retrieval status, extracted brands, source URLs, surface and model metadata, timestamps, and capture/error states.
• WHY findings, evidence strength, Blueprints, implementation packages, implementation status, Recheck results, Pulse events, Market events, and action recommendations.
• When you request Expert implementation: requested support level, budget band, timeline, website platform, optional brief notes, proposal and milestone state, delivery status, and payment identifiers needed for reconciliation. Riseklix does not need to store full card numbers or CVV codes to operate this flow.
• Provider-usage, token, search, scraping, billable-unit, and cost-control telemetry used to run and protect the service.

Public-source and third-party research information

• Public website text, public business facts, search results, news pages, source URLs, titles, snippets, dates, and other evidence relevant to a requested company, category, competitor, or Buyer Situation.
• Public professional information about individuals when it is materially relevant to business research, such as a person’s name, job title, professional role, public statement, authorship, or company affiliation.
• Public X post identifiers, account or authorship information, timestamps, URLs, and evidence/classification metadata used by Pulse or Market workflows.

Technical, security, and usage information

• IP-derived network information where available, device and browser information, timestamps, session records, request metadata, error data, and security logs.
• Product interactions and analytics events used to understand whether features work, prevent abuse, diagnose failures, and improve usability.
• CAPTCHA or anti-abuse signals when Cloudflare Turnstile or similar controls are enabled.

Communications

• Support requests, deletion or rights requests, feedback, and other messages you send us.
• Operational notification preferences and records of service communications.

Sensitive information

Riseklix is not designed to collect health records, government identifiers, financial account credentials, precise location, biometric data, criminal-history data, or other highly sensitive personal information as a normal part of Commercial Discovery. Do not submit sensitive personal data unless it is necessary, lawful, and specifically appropriate for the workflow.

We may obtain information:

• directly from you when you create an account, configure a workspace, start a project, contact support, or approve a workflow;
• from other members of your workspace or organization;
• from Google or Microsoft when you choose an OAuth sign-in method;
• from websites and online sources you ask Riseklix to research;
• from public search, web, news, and social sources used to verify commercial developments;
• from AI, search, hosting, authentication, security, and analytics providers used to operate the service; and
• automatically from your browser, device, session, or interaction with the application.

Public availability does not remove privacy protections. Where public-source information contains personal data, we aim to limit collection to information reasonably relevant to the business research purpose and apply applicable rights and legal-basis requirements.

Where law requires us to give privacy information directly to a person whose information we obtained indirectly, we will do so unless a lawful exception applies. For large-scale public-source research, an exception such as impossibility or disproportionate effort is not automatic: where relied on, it must be assessed in context and accompanied by safeguards required by applicable law. This public Policy is one way we make information about that processing accessible.

We use information to:

• create and administer accounts, workspaces, roles, sessions, and authentication;
• research a company and build or confirm Company Intelligence;
• identify and evaluate Buyer Situations, competitors, and commercial questions;
• run controlled AI observations and store the underlying evidence needed to interpret them;
• generate WHY findings, Blueprints, implementation packages, Rechecks, Pulse monitoring, Market research, and action recommendations;
• verify public market or competitor developments before presenting them as evidence;
• provide support, respond to rights requests, and communicate important service information;
• measure product reliability, diagnose errors, manage provider cost, and improve product usability;
• detect fraud, misuse, unauthorized access, attacks, abuse, or attempts to bypass product controls;
• enforce our Terms and protect Riseklix, customers, providers, and third parties; and
• comply with legal, regulatory, accounting, or security obligations.

Where laws such as the GDPR or UK GDPR require a legal basis, the basis depends on the activity. We may rely on one or more of the following:

• Contract. Processing needed to create your account, provide requested product workflows, maintain your workspace, and deliver the service you ask us to perform.
• Legitimate interests. Proportionate business purposes such as product security, fraud prevention, service reliability, cost controls, support, limited product analytics, and commercially relevant public-source research, where those interests are not overridden by the rights and interests of the individual.
• Consent. Where applicable law requires consent, including certain non-essential cookies or optional processing. You may withdraw consent for future processing where consent is the basis.
• Legal obligation. Processing required to comply with law, lawful requests, tax/accounting rules, dispute preservation, or regulatory duties.

Where Riseklix relies on legitimate interests for public professional information, the relevant interests generally include providing requested business research, verifying commercial evidence, preventing misleading conclusions, and securing the service. We aim to keep that processing targeted to professional/commercial context and avoid unnecessary sensitive or private information.

Riseklix uses AI systems to research, summarize, classify, extract, compare, draft, and reason over company and market information. Depending on the workflow, information may be sent to providers such as OpenAI, Google, Anthropic, or Perplexity, together with web evidence or structured project context.

Observation results are API-based research surfaces and are not represented as exact copies of the consumer ChatGPT, Gemini, Claude, or Perplexity applications. Consumer products can apply different routing, personalization, product instructions, search choices, geography, and other behavior.

Riseklix does not operate its own general-purpose foundation-model training pipeline as part of this product. Third-party AI providers process requests under the contracts, API settings, privacy terms, and retention controls applicable to their services. Those settings are not necessarily identical across providers.

Riseklix is not designed to make solely automated decisions about an individual that produce legal or similarly significant effects. AI-generated research can be incomplete or wrong and should be reviewed in context before being used for material business decisions.

Commercial Discovery may inspect public pages, search results, news, competitor sites, public social posts, and other public sources when a customer asks us to research a company, market, category, competitor, or Buyer Situation.

We may store source URLs, excerpts or cleaned evidence needed to support an observation, source metadata, classifications, dates, and the relationship between evidence and a finding. Retention depends on the workflow and the need to preserve an auditable research record.

For the current X evidence workflow, the product is designed not to persist raw post text as a standing archive. It may retain post identifiers, public account/authorship metadata, timestamps, links, query family, evidence classification, and related monitoring metadata. Public posts can still be changed or deleted at the source.

If you are an individual whose personal information appears in Riseklix public-source evidence and you believe it should be corrected, removed, or restricted, contact us with enough information to identify the source and record.

We use specialized providers to operate Riseklix. The exact provider used can depend on the workflow, configuration, geography, availability, and product version. Current categories and examples include:

• Hosting, deployment, and infrastructure: Vercel and Supabase.
• Database, authentication, sessions, and account services: Supabase, with Google and Microsoft available as optional OAuth identity providers.
• AI and reasoning providers: OpenAI, Google, Anthropic, and Perplexity.
• Web discovery and evidence: Firecrawl, Brave Search, and Serper/Google-search infrastructure where configured.
• Social-source research: X API for configured Pulse or Market evidence workflows.
• Abuse prevention: Cloudflare Turnstile where enabled.
• Analytics and measurement: Google Tag Manager and tags configured through that container.
• Payments: Razorpay for subscriptions, Expert milestone Payment Links, payment-status reconciliation, refunds, and related payment processing where configured.
• Expert implementation: vetted independent freelancers or agencies selected to scope or deliver an Expert Network request. We share only the project and contact information reasonably needed for the accepted work.

Providers receive only the information reasonably necessary for the relevant task, but the amount and type of data can vary by workflow. We may replace, add, or remove providers as the product evolves.

We may also disclose information when you direct us to share it, when reasonably necessary to investigate abuse or protect security, in connection with a corporate restructuring or asset transfer subject to appropriate protections, or when disclosure is required by law or valid legal process.

Workspace content is private by default to authorized workspace members, subject to our access-control model. Some product features let an authorized user intentionally create a public read-only Blueprint link.

A shared Blueprint link acts like a bearer link: anyone who obtains the link may be able to view the limited Blueprint information exposed through that share until sharing is revoked. Shared pages are designed not to expose account controls or the entire underlying workspace, but you should still treat the link as shareable information and distribute it only to intended recipients.

Riseklix uses browser storage and similar technologies for necessary functions such as authentication, session continuity, security, and interface preferences. For example, the application stores a local sidebar preference so the interface can remember whether the navigation is collapsed.

Riseklix uses a Google Tag Manager container in the application deployment. Tags configured through that container may collect analytics information such as page views, events, browser/device information, and related identifiers. Google Tag Manager is a tag-delivery mechanism; the data actually collected depends on the tags enabled in the container and their configuration.

Non-essential analytics or advertising technologies may require consent or opt-out controls in some jurisdictions. A privacy notice does not by itself replace any cookie-consent or preference mechanism required by applicable law.

We retain information for as long as reasonably necessary for the purpose for which it was collected, to provide the service, preserve benchmark and Recheck history, maintain evidence lineage, protect security, meet legal obligations, and resolve disputes. Retention differs by data type.

• Account and workspace data: generally retained while the account/workspace is active and for a limited period afterward where needed for recovery, security, legal obligations, or dispute handling.
• Active project research and outputs: retained while the project remains in your workspace so Company Intelligence, Baselines, WHY findings, Blueprints, Rechecks, Pulse, and Market history can function as a connected record.
• Projects deleted from a workspace: removed from ordinary customer access immediately and scheduled for deletion from active project storage after 30 days. During that limited retention window the project is restricted from normal customer access and recurring monitoring is stopped.
• Expert, payment, dispute, or legal-hold records: a deleted project connected to an Expert implementation, payment, refund, charge dispute, fraud review, legal claim, or other legal obligation may require longer restricted retention. We aim to retain only the information reasonably necessary for that purpose.
• Security, access, provider-usage, and audit records: selected operational records may be retained after project-content deletion where reasonably necessary for fraud prevention, security, accounting, service-cost reconciliation, troubleshooting, legal obligations, or dispute handling. Project-specific content and source metadata are minimized or removed when the project-content purge occurs.
• Public-source evidence: retained only as needed to support active research lineage, verification, dispute handling, or product integrity, subject to source-specific and legal requirements.
• Backups: deleted data may remain temporarily in protected backups until those backups rotate or are overwritten. Backup retention is separate from ordinary active-system access and is not used to continue normal product processing.

We may retain de-identified or aggregated information that no longer reasonably identifies an individual, subject to applicable law.

We use technical and organizational safeguards intended to protect personal information. Depending on the system, these include authenticated access, workspace-level authorization, row-level database controls, protected service-to-service execution paths, secret isolation, provider spend/rate guardrails, logging, monitoring, CAPTCHA/anti-abuse controls, and restricted public-share functions.

No internet service can guarantee absolute security. You are responsible for protecting your credentials, maintaining control of shared links, using appropriate access controls within your organization, and notifying us promptly if you suspect unauthorized access.

If a personal-data breach requires notification under applicable law, we will provide notifications in the manner and within the time required by that law.

Riseklix is based in India and uses providers that may process information in India, the United States, the European Economic Area, the United Kingdom, or other countries. As a result, information may be processed outside the country where you live.

Where applicable law restricts international transfers, we use or require appropriate transfer mechanisms where reasonably applicable to the relationship, such as adequacy mechanisms, contractual safeguards, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement/Addendum, or another lawful transfer mechanism.

The laws and government-access rules in another country may differ from those in your country.

India

India’s Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 are being brought into force on a phased timetable. As the applicable provisions take effect, eligible Data Principals may have rights that include access to information about processing, correction and erasure, grievance redressal, withdrawal of consent where consent applies, and nomination as provided by law.

European Economic Area and United Kingdom

Where the GDPR or UK GDPR applies, you may have rights to be informed, access your personal data, correct inaccurate data, request deletion, restrict processing, receive portable data in applicable cases, object to certain processing, withdraw consent where consent is the basis, and complain to the relevant supervisory authority. Some rights are subject to exceptions and legal conditions.

California

If the California Consumer Privacy Act applies to Riseklix and to your information, California residents may have rights to know/access, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive non-discriminatory treatment for exercising privacy rights, subject to statutory exceptions.

Riseklix does not operate as a data broker and does not sell private workspace content for money. The application is not designed around cross-context behavioral advertising. If a disclosure or tracking practice becomes a “sale” or “sharing” under applicable California law, we will provide the opt-out mechanisms required by that law.

Other jurisdictions

Other privacy laws may provide additional or different rights. We will honor rights requests to the extent required by laws that apply to Riseklix and the relevant processing.

Send privacy, access, correction, deletion, objection, or data-related requests to contact@riseklix.com. If your request concerns a public-source record and you are not a Riseklix user, include the source URL or enough context for us to locate the information.

We may need to verify your identity, account, authority, or relationship to the data before completing a request. Authorized agents may be asked to provide proof of authority where permitted by law.

We aim to respond without undue delay and generally within 30 days. Where a different statutory period, extension, exception, or verification process applies, we will follow the applicable law and explain material delays where required.

Some information cannot be deleted immediately or completely where retention is required for security, fraud prevention, legal compliance, accounting, establishment or defense of legal claims, or other lawful purposes.

Riseklix is a business and professional service and is not intended for children under 18. We do not knowingly ask children to create Riseklix workspaces or submit personal data for Commercial Discovery. If you believe a child has provided personal information to us, contact us so we can review and take appropriate action.

We may update this Policy as the product, providers, processing activities, or laws change. We will post the current version here with a revised “Last updated” date. If a change materially affects how we use personal information, we will provide additional notice where required by law or reasonably appropriate to the change.

For privacy questions, rights requests, or complaints, contact:

If applicable law gives you the right to complain to a data-protection authority, you may also contact the authority responsible for your jurisdiction after first giving us an opportunity to address your concern where appropriate.