Privacy Policy

Who we are

Risksquad (“we”, “us”) is the controller of the personal data described in this policy: we decide why and how it is used.

This policy covers the websites risksquad.io and mediakit.risksquad.io, our media kit. The Risksquad platform is governed by each customer’s agreement, and this policy does not cover customer data inside the platform.

In short

• No cookies, no analytics scripts, no ads, and no third-party scripts or trackers. We learn about visits only from our CDN’s access logs.
• The site has no forms, accounts or sign-ups. Nothing you type or select on it is sent to us.
• The only personal data the site collects is in our CDN’s access logs, which are kept for about six months and then deleted automatically.
• We do not sell personal data.
• You have the right to object, and to ask for access, correction or deletion.

What we collect

When you browse

• We use no cookies, no analytics scripts, no ads, and no third-party scripts or trackers. We learn about visits only from the CDN access logs described below.
• The landing at risksquad.io uses no cookies, local storage or session storage. Its self-check is scored in your browser and is never sent. The media kit stores only your selected theme in local storage so that your preference survives a reload; it is not sent to us.
• Our hosting and CDN provider processes technical request data (your IP address, the page you request and your browser) to deliver the pages.
• Our CDN keeps access logs (IP address and port, date and time, the page requested, the page you came from, browser) for about six months; they are then deleted automatically.
• The media kit at mediakit.risksquad.io uses static hosting on Amazon Web Services and has no forms, cookies or analytics. Its hosting provider processes technical request data to deliver its files.

Why we use it

We use the CDN access logs for security, to investigate abuse, and to understand how the site is visited.

Until October 2026, the site also had a “Get a demo” form, whose requests reached our inbox by email, and our team received internal email reports of the site’s visits drawn from the CDN access logs. Both have been removed. Earlier requests are used only to follow up on what was requested; earlier reports, to understand visits during that period. Retention of these records is described in How long we keep it.

We do not sell personal data. We make no automated decisions about you with legal effects.

Legal basis

We rely on our legitimate interests: keeping the site secure and safe from abuse, understanding how it is visited, and following up on demo requests received before the form was removed.

• In Brazil, under the LGPD: article 7, IX, with article 10.
• In the European Economic Area and the United Kingdom, under the GDPR and the UK GDPR: article 6(1)(f).

You have the right to object to this use at any time, as the next section explains.

Who processes it

Two providers process personal data for us, under their data processing terms:

• Amazon Web Services: hosting and the CDN, with its access logs, in the United States (us-east-1).
• Google: Google Workspace, where demo requests and visit reports received before the form was removed are kept. Google may process data in the United States and other countries.

Risksquad decides how the data is used and is responsible for it. These providers process it on our behalf.

International transfers

Your data is processed in the United States, and Google may also process it in other countries. These transfers rely on the data processing terms of AWS and Google, which include standard contractual clauses.

How, why and for how long the data is processed, the providers, the security measures and your rights, including petitioning the ANPD, are described in the other sections of this page.

How long we keep it

• CDN access logs: about six months, then deleted automatically.
• Demo requests received before the form was removed: only as long as we need to answer and follow up on them, then we delete them.
• Visit reports received before they were discontinued: in our team’s inbox only as long as we need them, then we delete them.

Your rights

This website does not currently publish a contact channel for privacy requests. You can always complain to a data protection authority, such as the ANPD in Brazil or the ICO in the United Kingdom.

In Brazil (LGPD, article 18)

• confirmation that we process your data;
• access to your data;
• correction of incomplete, inaccurate or out-of-date data;
• anonymization, blocking or deletion;
• portability;
• information about who we share your data with;
• objection;
• petition to the ANPD, Brazil’s data protection authority.

In the European Economic Area and the United Kingdom (GDPR and UK GDPR)

• access;
• rectification;
• erasure;
• restriction;
• portability;
• objection (article 21, see Your right to object);
• complaint to a supervisory authority, for example the ICO in the United Kingdom.

Security

• HTTPS everywhere, with HSTS.
• A strict Content Security Policy that allows only our own origin.
• No third-party code on the site.
• No forms or endpoints that receive what visitors type.

More on how the site is protected is in Security.

Children

risksquad.io is not directed at children.

Do Not Track

We do not track you across sites, so a Do Not Track signal changes nothing here.

Changes to this policy

When we change this policy, we publish the new version on this page with a new “Last updated” date.