Privacy Policy

1Who is responsible for your data

The controller is ByteGuard S.L., established in Spain, and its full statutory identity is published in the legal notice. For anything related to privacy — access, deletion, objection, a question about a specific processing operation — write to [email protected]. We have not appointed a data protection officer, and we do not claim to be exempt from doing so: if that changes, this section changes with it.

2What data we collect

Some of it you give us, some is produced as you use the service. The public demo on the website is different: what you paste or upload there is processed in memory for that single request and no file and no history is created.

• Account: email address, name, sign-in method, country and app version.
• Preferences: style, gender, language, age, type of relationship, goals and your custom prompt.
• Content you submit: chat screenshots, conversation text, full chat exports in Analyse, messages to Coach and messages to support.
• Use and billing: generations, credits, ads watched, plan, purchases and renewals.
• Device and technical data: device identifiers, app version, and your IP address in server logs, promo-code redemptions and administrative access logs.

3The legal basis for each activity

Different parts of the service rest on different legal grounds under article 6 of the GDPR.

• Performance of the contract: your account, the generations you ask for, your history, subscriptions, credits and service communications.
• Legitimate interest: third-party data contained in the screenshots and exports you upload, security and anti-fraud, and product analytics inside the app (see the section on advertising and analytics).
• Consent: rewarded advertising where the law requires it, marketing communications, and all website analytics.
• Legal obligation: accounting and tax records for purchases.

4What is sent for AI processing

Every AI feature in RIZR — replies to screenshots and pasted text, icebreakers, Coach, Analyse, the relationship analysis and voice-note transcription — relies on a third-party artificial intelligence provider that processes the content on our behalf, and the app asks you to accept this before the first submission. What travels is the screenshot or text you submit, the content of a WhatsApp export in Analyse, the messages and images you send to Coach, the audio of a voice note you share for transcription, your chosen style, gender and language, your custom prompt and, in Coach, a profile of your way of writing derived from your recent generations. Your email address, account name, user id and IP address are not sent. A screenshot carries whatever it carries: the other person's name, photo and messages travel with it. If you dictate to Coach with the microphone, speech recognition is done by your phone's operating system, on the device when possible; that audio does not pass through our servers. We do not train our own models on your content.

5The other person's data

Screenshots, WhatsApp exports and voice notes usually contain other people's data — their name, profile photo, number and messages — and that person never agreed to anything. Only upload conversations you are entitled to share. We store their messages as part of your generation; the image file and the raw extracted text are deleted automatically after 30 days, and what remains in your history you can delete whenever you want. In Analyse the export file itself is never stored; we keep their display name, whole-conversation metrics and literal quotes inside the report. That data is used only to produce the result you asked for: it is never cross-referenced between users, never used for advertising or to build a profile of that person, and we never contact them. The legal basis is our legitimate interest in providing the service you requested, balanced against the impact on them; because informing each of those people individually would require a disproportionate effort, article 14.5.b of the GDPR allows this public notice to take its place. If you are that person, write to [email protected] to exercise your rights, even without an account.

6Who else receives your data

We do not sell your data. We share it only with service providers that help us run RIZR, each limited to what it needs and bound to process it on our instructions. By category:

• Artificial intelligence providers: all AI processing, as described above.
• Your phone's operating system: speech recognition when you dictate to Coach, on the device when the language is installed; otherwise the system provider may process the audio.
• Product analytics providers: in the app they receive your user id, plan, credit balance, language, country, default gender and notification preferences, together with usage events and errors — never your email or your name — and you can switch them off in Settings › Privacy › “Share usage data”. On the website they load only after you accept analytics, and one of them records interaction with the page (clicks, scrolling and mouse movement).
• Advertising networks: rewarded video ads for free users. Where the law requires it (EEA, UK and US states with privacy laws) the app asks for your consent first, and you can change it in Settings › Privacy › “Ad preferences”; without consent, ads are requested non-personalised. They receive the advertising identifier when you allow it and request data, and your user id travels in the reward verification.
• Campaign measurement and attribution partners: they tell us which ad campaign an install or a purchase came from. The social-network attribution tools start only after you answer the iOS tracking prompt and the ads consent, and the install-measurement tool receives the signals of that choice. Purchases are not sent by the app: our subscription provider reports them.
• Payment and subscription providers: subscriptions, charges and renewals. They receive your user id, purchase data and the attribution identifiers needed to link a purchase to a campaign, plus your email address for purchases made on the web. In the app stores, Apple or Google handles the payment.
• Device-integrity services of the mobile platforms: checking, through our own verification service, that requests come from the genuine app on a real device.
• Third-party sign-in: if you sign in with another platform's account, we receive only the identifier, name and email you authorise.
• Email delivery: the emails carrying your login code or link.
• Support ticketing: when you send feedback, a ticket is created containing your email, id, name, plan and the full text of your messages. Deleting your account does not delete that ticket; we delete it on request.
• Push notifications: your device token and the notification content, delivered through your phone's notification service.
• Bot protection: abuse prevention in the public demo, which exposes your IP address to the verification service.

7Advertising and analytics inside the app

Three separate things live in the app, each with its own control. Product analytics rests on our legitimate interest in understanding what works and fixing what breaks; it sends your user id and usage events, never your email or name, and you can switch it off at any time in Settings › Privacy › “Share usage data”. Ads: where the law requires it — the EEA, the UK and US states with privacy laws — the app shows a consent form before requesting ads, and you can change your decision in Settings › Privacy › “Ad preferences”; if you do not consent, ads are requested non-personalised. On iOS the system also asks whether you allow tracking (ATT). Attribution: the social-network attribution tools start only after you answer the tracking prompt and the ads consent, and the install-measurement tool receives the signals of that consent. You can also object to any of this by writing to [email protected], and limit tracking in your device settings.

8International transfers

Some of our providers — for example in artificial intelligence, analytics, advertising, attribution and payments — process data outside the European Economic Area, mainly in the United States. Where that happens we rely on the mechanisms of Chapter V of the GDPR: standard contractual clauses of the European Commission, or the EU-US Data Privacy Framework where the provider is certified. Write to [email protected] and we will tell you which provider and which safeguard apply to a specific processing operation.

9How long we keep it, and what deleting reaches

Uploaded images — chat screenshots, profile screenshots and images attached in Coach — are deleted automatically 30 days after upload, together with the raw text extracted from them. WhatsApp exports and voice notes are processed in memory and never stored. Your history (suggested replies, the analysis shown and the conversation needed to display or regenerate it) stays until you delete the entry — long-press it in History › Delete — or delete your account; Coach conversations stay until you delete them in Coach; Analyse and relationship reports stay until you delete your account or ask us. Sessions last up to one year unless you sign out or delete your account; email login codes expire after 24 hours; a minimal, pseudonymised record of the account deletion is kept for 365 days. Deleting your account from Settings immediately removes the account, your history and its content, your uploads and their files, Coach conversations, Analyse and relationship reports, feedback threads, credits and movements, ad sessions, push tokens and sessions.

• Not reached by that deletion, and deleted on request at [email protected]: the support ticket created from your feedback and the device roster.
• Promo-code redemptions, prize-draw entries and conversion events already sent are kept so they cannot be repeated, but they are unlinked from you: your identifiers are replaced by irreversible values and the IP address is removed.

10Security

Traffic travels encrypted over TLS, passwords are stored hashed, sessions expire and rotate, and rate limits and upload validation protect the service. Uploaded screenshots are deleted after 30 days. Authorised staff can access generation content for support and moderation, and every one of those accesses is logged.

11Your rights

You have the right to access your data, to have it corrected, to have it erased, to receive it in a portable format, to object to processing based on legitimate interest, to ask for processing to be restricted, and to withdraw a consent you gave at any time without affecting what was done before. Write to [email protected] and we will reply within one month. If you believe we have handled your data badly, you can complain to the Spanish Agencia Española de Protección de Datos (www.aepd.es) or to the supervisory authority of your own country.

12Cookies, minors, automated decisions and breaches

Cookies and local storage on rizr.me are described in detail in the cookie policy, which is where you also change your decision. The contractual minimum age is 18 and we do not verify it with identity documents; when we learn that an account belongs to a younger person we close it, and a parent or guardian can write to [email protected]. We do not take decisions based solely on automated processing that produce legal effects or similarly significantly affect you within the meaning of article 22 of the GDPR — a generated reply is a suggestion you are free to ignore. In the event of a personal data breach we notify the Agencia Española de Protección de Datos within 72 hours and, when the risk to you is high, we tell you without undue delay.

13If you live in the United States

The CCPA as amended by the CPRA and the comparable laws of Colorado, Connecticut, Texas, Virginia and other states give you specific rights. In the statutes' own vocabulary, we process identifiers, commercial information, internet or network activity, content you provide, inferences and, potentially, sensitive personal information. We do not sell personal information for money. However, sharing device and advertising identifiers with advertising networks and attribution partners for personalised advertising and attribution qualifies as a share for cross-context behavioural advertising; you may opt out in Settings › Privacy › “Ad preferences”, through your device settings or by writing to [email protected]. Sensitive information is used only to provide the service you asked for. You have the right to know, access, correct, delete, port and opt out, to appeal a decision we make, and not to be discriminated against for exercising any of them. We honour the Global Privacy Control signal on our website. Under California's Shine the Light law: we do not share personal information with third parties for their own direct marketing purposes.

14Changes and contact

When this policy changes materially we announce it in the app or by email before the change takes effect, and the date at the top always tells you which version you are reading. For any question, request or complaint about your data, write to [email protected].