Privacy Policy

Last updated: March 28, 2026

1. Who we are

Riskjar ("we", "us", "our") is a risk management software service operated from Switzerland. We are committed to protecting your personal data in accordance with the Swiss Federal Act on Data Protection (FADP/DSG) and the EU General Data Protection Regulation (GDPR).

Contact: privacy@riskjar.com

2. Data we collect

We collect and process the following personal data:

2.1 Account data

• Email address — required for authentication and communication.
• Name — as provided by you during account setup.
• Organisation name — the account name you choose.

2.2 Usage data

• Projects, risks, and actions — the content you create within the service.
• Comments and activity — interactions within your team's workspace.

2.3 Technical data

• IP address — for security and abuse prevention.
• Browser type and device information — for compatibility and debugging.
• Push notification tokens — if you enable web push notifications.

3. How we use your data

We use your personal data to:

• Provide and maintain the Riskjar service.
• Authenticate you via magic link (passwordless login).
• Send you notifications about activity in your account (email and push).
• Communicate service updates and important notices.
• Detect and prevent fraud, abuse, and security incidents.

4. Legal basis for processing

We process your data based on:

• Contract performance (Art. 6(1)(b) GDPR) — to provide the service you signed up for.
• Legitimate interest (Art. 6(1)(f) GDPR) — for security, abuse prevention, and service improvement.
• Consent (Art. 6(1)(a) GDPR) — for optional features like push notifications. You can withdraw consent at any time.

5. Data sharing

We do not sell your personal data. We may share data with:

• Infrastructure providers — hosting services that process data on our behalf, under strict data processing agreements.
• Email delivery services — to send transactional emails (magic links, notifications).
• Payment processors — if you subscribe to a paid plan (Stripe). We do not store credit card details.

All processors are bound by data processing agreements. We do not transfer data outside Switzerland and the EEA unless adequate safeguards are in place.

6. Data retention

• Account data — retained as long as your account is active. Deleted within 30 days of account deletion.
• Project and risk data — retained as long as your account is active.
• Technical logs — retained for up to 90 days.
• Backup data — retained for up to 30 days after deletion from production systems.

7. Your rights

Under the FADP and GDPR, you have the right to:

• Access your personal data.
• Rectify inaccurate data.
• Delete your data ("right to be forgotten").
• Export your data in a portable format.
• Restrict or object to processing.
• Withdraw consent at any time for consent-based processing.

To exercise these rights, contact us at privacy@riskjar.com.

8. Cookies

We use essential cookies only. See our Cookie Policy for details.

9. Security

We implement appropriate technical and organisational measures to protect your data, including:

• Encryption in transit (TLS/HTTPS).
• Passwordless authentication (no password storage).
• Signed, httponly session cookies.
• Role-based access control within accounts.

10. Children

Riskjar is not intended for use by individuals under 16. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this policy from time to time. We will notify you of material changes via email or in-app notification. The "last updated" date at the top indicates when this policy was last revised.

12. Supervisory authority

If you believe we have not handled your data correctly, you have the right to lodge a complaint with:

• The Federal Data Protection and Information Commissioner (FDPIC) in Switzerland.
• Your local data protection authority in the EU/EEA, if applicable.

13. Contact

For privacy-related questions or requests:

Email: privacy@riskjar.com
Riskjar
Switzerland