Privacy Policy
How BITS Blackrock IT Solutions LLC collects, uses, and protects personal data in connection with the RisQore platform.
BITS Blackrock IT Solutions LLC · Last updated 2026-07-17
1.Who we are
BITS Blackrock IT Solutions LLC (“we”, “us”) operates the RisQore governance, risk & compliance platform. For personal data processed to run our business and website, we act as the data controller. For the data a customer’s users enter into the platform, the customer is the controller and we act as a processor under our Data Processing Agreement.
Registered office: 8 Ali Basha Zolfakar Street, Alexandria, Egypt. Registration: Commercial Register CR 191183 · Unified No. 1777619972 (Egypt). Questions: privacy@bits-solution.com.
2.What we collect
- Account data — name, work email, organisation, role, and authentication identifiers (via our identity provider, Clerk).
- Customer content — the compliance data your team enters (frameworks, controls, risks, policies, evidence files, audit records). We process this on your instruction as a processor.
- Usage & technical data — log data, IP address, device/browser, and audit events, used for security, debugging, and abuse prevention.
- Billing data — handled by Lemon Squeezy as merchant of record; we do not store card details.
- Communications — messages you send us (e.g. a support request).
We do not sell personal data, and we do not use customer content to train AI models.
3.Why we process it (legal bases)
- To provide the platform and fulfil our contract with your organisation (performance of a contract).
- To secure the service, prevent abuse, and keep an audit trail (legitimate interests / legal obligation).
- To communicate with you about the service (contract / legitimate interests).
- Where required, on the basis of your consent — which you may withdraw at any time.
Under the EU GDPR and the GCC/MENA data-protection laws our customers are subject to (including the UAE and Saudi PDPL), we rely on the equivalent lawful bases and honour the data-subject rights described below.
4.Where your data lives
The application is hosted in Germany, EU (Hetzner Online GmbH), and the primary database and file storage run in London, United Kingdom (Supabase, eu-west-2).
5.Sub-processors
We use vetted third parties to run the service. Each is bound by data-protection terms:
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Application hosting & delivery | Germany (EU) |
| Supabase Inc. (PostgreSQL) | Primary database & file storage | UK (London, eu-west-2) |
| Clerk Inc. | Authentication & identity | USA (SCCs) |
| OpenAI, L.L.C. | AI-assisted features you invoke (policy drafting, auto-linking) | USA (SCCs, no training on your data) |
| Lemon Squeezy, LLC | Billing & payments (merchant of record) | USA (SCCs) |
| Resend, Inc. | Transactional & report email | USA (SCCs) |
International transfers are covered by Standard Contractual Clauses or an equivalent safeguard.
6.How long we keep it
We retain customer content for the life of your subscription and delete or return it within 30 days of termination, unless a longer period is legally required. Logs and audit records are retained for a limited period for security and compliance.
7.Your rights
- Access, correct, or delete your personal data.
- Object to or restrict certain processing, and request portability.
- Withdraw consent where processing is based on it.
- Lodge a complaint with your supervisory authority.
If your data lives in a customer’s workspace, please raise the request with that organisation; we will assist them as their processor. Otherwise contact privacy@bits-solution.com.
8.Security
We enforce per-tenant access checks on every request, verified by automated coverage tests, with database-level row-level-security policies and tenant constraints beneath them, encryption in transit and at rest, least-privilege access, and audit logging of security-relevant actions. See our Security & Trust page for detail.
10.Changes
We may update this policy; material changes will be notified in-app or by email. Continued use after the effective date constitutes acceptance.