Privacy policy

1. Who this policy covers

This policy explains how RIO handles personal data when you visit this website, create an account, or use the RIO apps.

An organization that uses RIO decides what it stores about its own people, customers and suppliers. For that data the organization is responsible for how it is used, and RIO processes it on the organization’s behalf and only to run the service. If you are, say, an employee or a customer of a business that uses RIO, contact that business first about your data.

2. What we collect

• Account details: your name, email address and a scrambled (hashed) form of your password. We never store your password itself.
• Organization data: the records you and your colleagues add to RIO, such as contacts, projects, documents, invoices and employee details.
• Billing details: your plan, the number of people billed, invoices and payment status. Card and bank details are entered with our payment processor and never reach RIO’s servers.
• Security and activity records: sign-ins, the changes people make (the audit log) and, with them, the network address and browser that made the request.
• Device details for notifications: if you allow browser notifications, a device token that lets us deliver them.
• Messages you send us: what you write in the contact form, with your name, email and company.

3. Why we use it

• To provide the service you signed up for: sign-in, the apps, sharing within your organization and notifications.
• To bill paid plans and keep the financial records the law requires.
• To keep RIO secure: preventing abuse, investigating problems and showing admins who changed what.
• To answer you when you contact us.
• We do not sell personal data, and we do not use it for advertising.

4. Cookies

RIO uses only the cookies it needs to work: cookies that keep you signed in (they cannot be read by scripts on the page) and a small preference for light or dark mode. This website uses no advertising or third-party analytics cookies.

Websites that organizations publish with RIO Sites may set one first-party cookie to show a visitor the same version of a page during a test. It is not set for visitors whose browser asks not to be tracked.

5. Who we share it with

We share personal data only with service providers that help us run RIO, under contracts that limit what they may do with it:

• Cloud hosting and database providers that store and run the service.
• A payment processor that takes payments for paid plans.
• A notification service that delivers browser and mobile notifications.
• Authorities, when the law requires it.

6. Where it is stored

RIO runs in data centres in India. Some providers may process data in other countries; where they do, we rely on their contractual and legal safeguards.

7. How long we keep it

• Account and organization data: while the account is open. An organization can ask us to delete its data at any time; we then delete it, except what we must keep by law.
• Audit log entries: 400 days.
• Billing records: as long as tax and accounting laws require.
• Contact messages: as long as needed to deal with them.

8. Your rights

Under India’s Digital Personal Data Protection Act, 2023 and other laws that may apply to you, you can ask for a summary of the personal data we hold about you, have it corrected or erased, withdraw consent you gave, and name someone to act for you. You can also complain to the Data Protection Board of India.

Most of your own details can be changed in your profile. For anything else, contact us and we will answer within 30 days.

9. Security

Organizations are kept apart, permissions are checked on the server, and sign-ins are protected against guessing. The security page describes these controls. No system is perfectly secure; if we learn of a breach that affects you we will tell you and the authorities as the law requires.

10. Children

RIO is a tool for businesses and is not meant for anyone under 18. We do not knowingly collect data from children.

11. Changes to this policy

When we change this policy we update the date at the top. For changes that matter, we also tell account owners inside RIO before they take effect.