Privacy Policy

Account & profile: name, display name, email, avatar, and phone number(s) you add. When you change a phone number the prior one is deactivated and retained (not deleted) for security history.

Authentication & security: a hashed password and two-factor authentication data — authenticator (TOTP) secrets, SMS codes sent to your verified phone, passkeys (WebAuthn credentials), and backup codes.

Identity verification: performed through Stripe Identity. We store only your home city, state/region, and country — never a street address. Government-ID images are handled by Stripe and are not stored by Risalto.

Content you upload: resumes, job targets, and profile documents.

Learning & assessment activity: assessments, competency validations, knowledge checks, and resulting certifications (see “Learning data” below).

Connector data: when you connect a third-party account, we access only what the scopes you approve permit, to generate competency and attestation signals.

Payments: processed by Stripe; we do not store full payment-card numbers.

Technical & usage data: device, log, and activity information needed to operate and secure the service.

Support conversations: when you ask the in-app AI agent for help, the conversation is kept with your account so the agent and our support team can follow it. If the agent couldn’t answer your question, it also writes a one-line summary of the question with names, email addresses, numbers and account details removed. That summary is stored with only the page and the date — not your account or the conversation — and our content team reads it to write new help articles. Summaries are deleted after 90 days.

To provide and personalize the platform, generate your competency and certification results, verify identity where required, secure your account, process payments, and communicate with you about the service. AI-assisted grading of free-text responses is performed via Anthropic.

Your learning activity — assessment attempts, practice, and knowledge checks — is used only to operate and personalize the platform and to compute your own private results. It is not sold or shared with third parties, and it is not reflected in, nor exposed by, your certifications or competency signals. Certifications and competency signals are separate, validated outcomes; they do not reveal your underlying learning activity.

When you connect a provider (Atlassian/Jira, Monday.com, Google, GitHub, Slack, Microsoft Teams, Linear, or Anthropic), we access only the data the scopes you approve allow, and only to provide the features you request. You can disconnect any connector at any time. Where a provider offers a personal-data reporting or deletion mechanism, we support it.

Google Workspace. If you connect Google Workspace, Risalto reads only the metadata of your 25 most recently modified Google Drive files (their names and file types), never their contents, plus your Google account's name and email. From that list we derive whether you have recent files and how many, which adds a small confidence signal to your profile, and we keep up to 20 file names as an evidence sample. If you map the Google Workspace connector to a competency, that sample is sent to our AI grading sub-processor, Anthropic, solely to assess it against that competency's rubric. You can opt out of evidence sampling by turning off Allow artifact samplingin the connector's settings. We do not sell this data, use it for advertising, or transfer it to anyone else. Disconnecting revokes our access at Google and removes the connector's signal from your profile. Risalto's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell personal data. We share data only with: service providers (sub-processors) who process it on our behalf under contract; third-party integrations you explicitly connect; and where required by law. Certifications and competency signals may be made verifiable to parties you choose (for example, an employer), but that verification does not expose your raw learning activity or documents.

We use: Stripe (payments and identity verification), Twilio (SMS verification codes), Google Cloud / Firebase (hosting and authentication), Anthropic (AI-assisted grading), and Resend (transactional email), in addition to any connector provider you choose to link.

Location and identity data are stored at city level only (city / state / country). We never collect or store street-level addresses. Geocoding resolves to a city centroid.

We retain personal data while your account is active or as needed to provide the service, then delete or anonymize it subject to legal and legitimate-business retention needs. Deactivated contact records (e.g. old phone numbers) are retained for security history. De-identified summaries of questions the AI agent couldn’t answer are deleted after 90 days.

Depending on your location, you may access, correct, export, or delete your personal data and object to or restrict certain processing. You can manage much of this directly in your account privacy settings, disconnect connectors at any time, or contact us to exercise your rights.

We use administrative, technical, and organizational safeguards (including encryption of sensitive secrets and two-factor authentication) designed to protect personal data. No method of transmission or storage is completely secure.

Personal data may be processed in countries other than your own. Where required, we apply appropriate safeguards for such transfers.

The service is not directed to children and we do not knowingly collect their personal data.

We may update this Policy; material changes will be communicated through the service or by other reasonable means.