Privacy Notice
Last updated: October 29, 2026
1 About this notice
(a) Purpose. This notice explains how Risk Aperture, Inc. ("Risk Aperture," "we," "us," "our") collects, uses, shares and retains personal data when we act as a controller — that is, when we decide why and how personal data is processed.
(b) Who it is for. This notice is for people who contact us, who are named on our commercial paperwork, and who are given access to our platform (the "Platform") by an organization that subscribes to it (a "Customer").
(c) What this notice does not cover. Risk Aperture provides the Platform to business customers. Where we process personal data contained in Customer Content on behalf of a Customer, we act as that Customer's processor, not as a controller, and our processing is governed by the data processing agreement between Risk Aperture and that Customer rather than by this notice. If you are an individual whose personal data appears in Customer Content and you wish to exercise rights in respect of that data, please contact the Customer. We will assist that Customer in responding as our agreement with it requires.
This notice also does not cover personal data we process about our own personnel — employees, contractors and advisers — or about applicants for work with us. That processing is addressed separately.
(d) Where other law applies. Sections 1 through 9 apply to everyone. Section 10 applies to residents of US states with comprehensive consumer privacy laws. Section 11 applies only where and to the extent that European Union or United Kingdom data protection law applies to our processing of your personal data.
2 Who we are and how to contact us
Risk Aperture, Inc.
2200 Kraft Drive, Suite 1050
Blacksburg,
Virginia 24060
United States
For anything in this notice, including a request about your personal data: privacy@risk-aperture.com.
3 The personal data we process
(a) Contact and relationship data. Name, business email address, telephone number, employer, job title, and the content of correspondence with us.
(b) Account data. For individuals a Customer authorizes to use the Platform ("Authorized Users"): name, email address, role and permissions, and authentication data including credentials and multi-factor authentication settings.
(c) Commercial data. Billing contact details, invoices, payment records, and the contracts and order forms on which an individual appears as a signatory or a named contact — together with the assent records generated when an agreement is accepted electronically, which include name, email address, IP address and timestamp.
(d) Request and report data. The requests, reports and notices we receive at our published contact addresses, and our responses.
(e) Meeting data. Where a meeting is recorded or where an AI assistant generates notes or a summary, the recording, transcript, notes or summary, and the identities of participants.
(f) Technical data. Information generated automatically when you interact with our websites or the Platform, including IP address and information about your browser or device. Our use of cookies and similar technologies is described at section 6.
4 Why we process it
We process personal data to:
provide, administer and secure access to the Platform for Authorized Users;
authenticate users, maintain access records, and detect and prevent fraud and misuse;
enter into and perform contracts, and administer the commercial relationship, including billing;
respond to enquiries, provide support, and handle requests, reports and notices sent to our published addresses;
communicate with people at organizations that may be interested in our products and services;
operate and improve our business, including by taking notes and summaries of meetings; and
comply with our legal obligations, and establish, exercise or defend legal claims.
Where the GDPR or the UK GDPR applies, the legal basis for each of these purposes is set out at section 11(c).
5 Where it comes from
Most personal data we hold comes from you, or from the organization you work for. We also receive personal data:
from a Customer, when it provisions an Authorized User;
from colleagues or counterparties who name you in correspondence or on documents sent to us; and
from public sources and business-contact sources, where we identify organizations that may be interested in our products and services.
6 Cookies and similar technologies
Our use of cookies and similar technologies is described in our Cookie Policy.
7 Who we share it with
We do not sell personal data, and we do not share it for cross-context behavioral advertising.
We share personal data with service providers who process it on our behalf, under written contracts that restrict their use of it to the purposes we specify:
| Service provider | What it does for us |
|---|---|
| Amazon Web Services, Inc. | Hosting, storage, compute, database and email delivery for the Platform |
| Google LLC | Corporate productivity suite: email, calendar, document storage and collaboration, video meetings |
| HubSpot, Inc. | Customer relationship management |
| DocuSign, Inc. | Electronic signature |
| ClickTerm | Presentation and recording of acceptance of our published agreements |
| Vercel, Neon and Resend | Hosting, database and notification email for our contract-workflow application |
| Intuit (QuickBooks) and Bill.com | Accounting, invoicing and bill payment |
| Stripe | Online payment processing |
| Calendar scheduling services | Scheduling meetings with us |
| Anthropic | AI assistant used by our staff for drafting and administration; model training is turned off |
| OpenAI | AI assistant used by some of our staff; model training is turned off. Being retired by November 16, 2026 |
We also disclose personal data where we are required to by law, where necessary to establish, exercise or defend legal claims, and to professional advisers under duties of confidentiality. If our business is sold or reorganized, personal data may be disclosed to the counterparty and its advisers as part of that process.
8 How long we keep it
We keep personal data for the periods below. These are maximum periods. Where a legal obligation requires us to keep a record for longer, we keep it for as long as that obligation lasts; where you ask us to delete personal data sooner and no legal obligation requires us to keep it, we do.
| What | How long |
|---|---|
| Contact records for people at organizations that have not become Customers | 24 months from our last direct contact with you |
| A minimal record of a request not to be contacted | Kept indefinitely, so that we can honor it |
| Authorized User account data | 90 days from the earlier of the removal of your access by the Customer, or the end of the Customer's subscription |
| Access and audit records | 24 months |
| Website and server logs | Up to 4 weeks |
| Support records | 24 months from the closure of the request |
| Other business correspondence | For as long as the record it concerns is kept, as set out in this section |
| Billing, invoicing and accounting records | 7 years from the end of the financial year to which the record relates |
| Contracts, order forms and assent records | For the duration of the agreement and 7 years afterwards, or longer where a longer limitation period or a surviving contractual obligation applies |
| Requests, reports and notices received at our published addresses, and our responses | 3 years from closure, kept in minimized form. Where the record relates to an enforcement action or a dispute involving a Customer, it is kept for the period applicable to contracts |
| Documents you provide to verify your identity | Deleted as soon as verification is complete. We record that verification occurred, not the document |
| AI assistant conversation history | Reviewed at least annually; conversations no longer needed for a business record are deleted |
| Meeting recordings, notes and summaries kept as business records | For as long as the record they concern is kept |
Deleted data may persist in backups until they expire. Automatic backups are kept up to 7 days, then overwritten. Occasional manual snapshots taken for maintenance are deleted when no longer needed. We do not restore deleted personal data from backups into active use except where necessary to recover from a system failure.
Retention periods yield to a legal hold and to any other legal obligation that requires us to preserve a record.
9 How we protect it
We maintain administrative, technical and physical safeguards designed to protect personal data against unauthorized access, use, disclosure, alteration, destruction and loss. The measures that apply to Customer Content in the Platform are set out in our subscription agreement and the data processing agreement that accompanies it.
No method of transmission or storage is completely secure, and we do not represent that our safeguards will prevent every unauthorized access.
10 United States
(a) When this section applies. This section applies if you are a resident of a US state with a comprehensive consumer privacy law.
(b) Your rights. Subject to the conditions and exceptions in applicable law, you may ask us to:
confirm whether we process personal data about you, and give you access to it;
correct inaccurate personal data about you;
delete personal data about you;
provide a copy of personal data you gave us, in a portable format; and
tell you about the categories of personal data we have collected, the purposes, and the categories of third parties we have disclosed it to.
(c) Selling and targeted advertising. We do not sell personal data, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising or for profiling with legal or similarly significant effects. There is accordingly nothing for you to opt out of in those respects.
(d) How to exercise your rights. Write to privacy@risk-aperture.com. We will respond within 45 days. Where we need longer, we may extend that period by a further 45 days, and we will tell you within the first 45 days if we do and why. We may ask you for information reasonably necessary to confirm your identity before we act on a request; section 11(e) describes how we approach that, and we apply the same approach here.
(e) No discrimination. We will not treat you differently, or provide you with a lesser service, because you exercised a right under this section.
(f) Appeals. If we decline a request, you may ask us to reconsider by replying to our response. We will tell you the outcome and, where applicable law provides one, the route to complain to your state's attorney general.
11 European Economic Area and United Kingdom
(a) When this section applies. This section applies where and to the extent that Regulation (EU) 2016/679 (the "GDPR") or the United Kingdom General Data Protection Regulation and the Data Protection Act 2018 (together, the "UK GDPR") applies to our processing of your personal data. Where neither applies, this section does not, and the rest of this notice governs. Nothing in this section applies to personal data we process as a processor on a Customer's behalf; section 1(c) addresses that data.
(b) Controller. For the personal data described at section 3, the controller is Risk Aperture, Inc., 2200 Kraft Drive, Suite 1050, Blacksburg, Virginia 24060, United States. You may contact us at privacy@risk-aperture.com.
(c) Purposes and legal bases. We process personal data for the purposes set out at section 4. Where the GDPR or the UK GDPR applies, we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Providing, administering and securing access to the Platform for Authorized Users | Our legitimate interests in administering the subscription a Customer has purchased and in keeping the Platform secure (Article 6(1)(f)) |
| Authentication, access logging and fraud prevention | Our legitimate interests in the security and integrity of the Platform (Article 6(1)(f)) |
| Entering into and performing a contract with you, where you contract with us in an individual capacity | Performance of a contract (Article 6(1)(b)) |
| Billing, invoicing, and maintaining accounting and tax records | Compliance with a legal obligation (Article 6(1)(c)), and our legitimate interests in managing our business (Article 6(1)(f)) |
| Responding to your enquiries, and handling requests, reports and notices | Our legitimate interests in responding to people who contact us (Article 6(1)(f)) |
| Marketing communications about our products and services | Your consent where applicable law requires it (Article 6(1)(a)), and otherwise our legitimate interests in promoting our business to commercial contacts (Article 6(1)(f)) |
| Taking notes and summaries of meetings | Our legitimate interests in keeping an accurate record of our business discussions (Article 6(1)(f)) |
| Establishing, exercising or defending legal claims, and complying with legal process | Compliance with a legal obligation (Article 6(1)(c)), and our legitimate interests in protecting our rights (Article 6(1)(f)) |
Where we rely on legitimate interests, we have assessed that those interests are not overridden by your interests or fundamental rights and freedoms. You may request a summary of that assessment at the address at section 11(b).
(d) Your rights. Subject to the conditions and exceptions in applicable law, you have the right to:
obtain confirmation of whether we process personal data about you and, if so, access to that data;
have inaccurate personal data about you rectified and incomplete data completed;
have personal data about you erased;
obtain restriction of our processing of personal data about you;
receive personal data you provided to us in a structured, commonly used and machine-readable format and have it transmitted to another controller, where our processing is based on your consent or on a contract and is carried out by automated means;
object to our processing of personal data about you where we rely on legitimate interests; and
withdraw your consent at any time, where our processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
You may object to our processing of your personal data for direct marketing purposes at any time, and we will stop. That right is not subject to a balancing test.
(e) How to exercise your rights, and how we verify who you are. Write to privacy@risk-aperture.com. We will respond within one month of receiving your request. Where a request is complex, or where you have made a number of requests, we may extend that period by up to two further months, and we will tell you within one month of receiving the request if we do so and why.
We verify identity in the least intrusive way available. Where a request comes from an email address already associated with you in our records, or where you authenticate in the Platform, we ask for nothing further. Where we have a reasonable doubt, we first send a confirmation to the address we hold. Only where doubt remains do we ask for a document, we ask for the least we need and accept it redacted, and we delete it as soon as verification is complete. We record that verification occurred, not the document.
(f) Automated decision-making. We do not carry out decision-making based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you, in respect of personal data we process as a controller.
(g) Where your personal data is processed. Risk Aperture is established in the United States, and personal data we process as a controller is processed in the United States. We engage the service providers identified at section 7, each of which processes personal data on our behalf under a written contract, including the standard contractual clauses adopted by the European Commission or the international data transfer addendum issued by the UK Information Commissioner where those instruments apply. You may request further information about these arrangements at the address at section 11(b).
(h) Retention. We retain personal data for the periods described at section 8.
(i) Complaints. You may lodge a complaint with the supervisory authority in the European Union member state of your habitual residence, place of work, or the place of an alleged infringement. In the United Kingdom, that authority is the Information Commissioner's Office. We would prefer the chance to address your concern first, at the address at section 11(b).
12 Changes to this notice
We may update this notice. The date at the top shows when it was last updated, and we keep prior versions available.
Where a change materially and adversely affects your rights under this notice, we will give at least thirty (30) days' advance notice before it takes effect. Where this notice is incorporated into a subscription agreement, we will give that notice in the manner that agreement requires.
13 Contact
Questions, requests and complaints: privacy@risk-aperture.com.
Risk Aperture, Inc., 2200 Kraft Drive, Suite 1050, Blacksburg, Virginia 24060, United States.