Privacy Policy

1.Who we are

BITS Blackrock IT Solutions LLC (“we”, “us”) operates the RisQore governance, risk & compliance platform. For personal data processed to run our business and website, we act as the data controller. For the data a customer’s users enter into the platform, the customer is the controller and we act as a processor under our Data Processing Agreement.

Registered office: 8 Ali Basha Zolfakar Street, Alexandria, Egypt. Registration: Commercial Register CR 191183 · Unified No. 1777619972 (Egypt). Contact for data-protection matters: Karim Bremer, privacy@bits-solution.com.

2.What we collect

• Account data — name, work email, organisation, role, and authentication identifiers (via our identity provider, Clerk).
• Customer content — the compliance data your team enters (frameworks, controls, risks, policies, evidence files, audit records). We process this on your instruction as a processor.
• Usage & technical data — log data, IP address, device/browser, and audit events, used for security, debugging, and abuse prevention.
• Billing data — handled by Lemon Squeezy as merchant of record; we do not store card details.
• Communications — messages you send us (e.g. a support request).

We do not sell personal data, and we do not use customer content to train AI models.

3.Why we process it (legal bases)

• To provide the platform and fulfil our contract with your organisation (performance of a contract).
• To secure the service, prevent abuse, and keep an audit trail (legitimate interests / legal obligation).
• To communicate with you about the service (contract / legitimate interests).
• Where required, on the basis of your consent — which you may withdraw at any time.

Under the EU GDPR and the GCC/MENA data-protection laws our customers are subject to (including the UAE and Saudi PDPL), we rely on the equivalent lawful bases and honour the data-subject rights described below.

4.Where your data lives

The application and the primary database are hosted in Germany, EU (Hetzner Online GmbH); uploaded files are stored in London, United Kingdom (Supabase Storage, eu-west-2).

5.Sub-processors

The following providers support the service. Executed agreements, processing locations, retention settings, and transfer safeguards require provider-specific verification:

Listing a provider does not establish that an international transfer is authorized. Our personnel also administer the service from Egypt. The applicable transfer mechanism, executed terms, and assessment must be verified for the actual processing arrangement. Our Data Processing Agreement describes proposed contractual commitments and remains subject to legal review.

If you activate Sky voice, microphone audio is sent to Deepgram for transcription. Answer text goes to ElevenLabs for English and Arabic speech, or Deepgram for German. Transcripts become chat messages and may be processed by the selected AI model provider. RisQore does not save raw microphone audio. Provider retention and model-training settings must be verified separately. Ending the conversation closes microphone capture.

6.How long we keep it

We retain customer content for the life of your subscription and delete or return it within 30 days of termination, unless a longer period is legally required. Logs and audit records are retained for a limited period for security and compliance.

7.Your rights

• Access, correct, or delete your personal data.
• Object to or restrict certain processing, and request portability.
• Withdraw consent where processing is based on it.
• Lodge a complaint with your supervisory authority.

If your data lives in a customer’s workspace, please raise the request with that organisation; we will assist them as their processor. Otherwise contact privacy@bits-solution.com.

8.Kingdom of Saudi Arabia

We provide our services to business customers. If you are located in the Kingdom of Saudi Arabia and your personal data is processed in our platform, this is normally because one of our customers — for example your employer, or a consulting firm working for your employer — uses the platform to manage compliance information and has entered your data. In those cases our customer is the controller under the Saudi Personal Data Protection Law (Royal Decree M/19 as amended by M/148) and we act as its processor or sub-processor on its documented instructions. Please direct requests to access, correct or destroy your data, or to withdraw consent, to that organisation; we assist it in responding within the timelines set by the Implementing Regulation. For data we collect directly from you (for example when you contact us or use our website), BITS Blackrock IT Solutions LLC is the controller and you may exercise your rights by e-mailing privacy@bits-solution.com.

Please note: we are established in Egypt; we have no office, legal entity, data storage or appointed representative in the Kingdom of Saudi Arabia; our application and database are hosted in Germany and uploaded files in the United Kingdom, and our personnel access the systems from Egypt. Saudi customers that transfer personal data to us do so on the basis of the Standard Contractual Clauses issued by the Saudi Data & AI Authority and their own transfer risk assessment, as the Authority has not yet published a list of countries with an adequate level of protection. We do not host Saudi government data, and our services are not intended for organisations supervised by the Saudi Central Bank or the National Cybersecurity Authority unless those organisations have obtained the approvals their regulators require. A deployment hosted in the Kingdom is being prepared and will be described here once available.

If you are not satisfied with how we or our customer handle your data, you have the right to complain to the Saudi Data & AI Authority (SDAIA). Violations of the PDPL can be sanctioned by SDAIA with warnings or fines; this does not affect your right to seek compensation before the competent Saudi courts.

9.Security

We enforce per-tenant access checks on every request, verified by automated coverage and integration tests against a real database, with tenant constraints at the database layer beneath them, encryption in transit and at rest, least-privilege access, and audit logging of security-relevant actions. See our Security & Trust page for detail.

10.Cookies and local storage

We set only what the product needs to work, and we ask before anything beyond that. Our consent banner records your choice in your browser’s local storage (risqore_cookie_consent) and asks again after twelve months. Optional categories are off by default. If you open an authentication page directly, we record the necessary-only baseline without placing a banner over the sign-in controls.

• Strictly necessary — your sign-in session (Clerk), CSRF protection and security tokens. These cannot be switched off; without them you cannot stay logged in.
• Functional — interface preferences such as sidebar state, saved filters, onboarding progress and theme. Switching these off costs you convenience, not access.
• Analytics — product-usage measurement. We do not operate any analytics tooling today; the category exists so your preference is already on record if we introduce it. It is off unless you turn it on.

We run no advertising cookies and no cross-site tracking, and we do not sell personal data. You can change your choice at any time by clearing site data in your browser, which brings the banner back.

11.Changes

We may update this policy; material changes will be notified in-app or by email. Continued use after the effective date constitutes acceptance.