This policy explains how FAKTS collects, uses, shares, and protects personal data. FAKTS is operated by [Legal entity name], with a registered address at [Registered address]. If you have any question about this policy or want to exercise your rights, write to yes@rizzgroup.org.
Who is the data controller
[Legal entity name] is the data controller for personal data processed through the FAKTS product, the fakts.rizzgroup.org website, and any related APIs, integrations, or embedded surfaces.
What data we collect
- Account and authentication data. Your email address, the fact that you signed in with a provider such as Google, session tokens, and a small profile record you can optionally populate with a handle, display name, and bio.
- Content you submit for checking. Documents, pasted text, URLs, media links, and any files you upload to have them verified by the consilium. This includes the extracted text, the generated verdicts, the pooled sources, and any records associated with the resulting certificate.
- Usage, rate-limit, and security data. A hashed IP address, the time of the request, the product surface used, and coarse counters we use to enforce free-tier limits and to block abuse. We do not store your raw IP address in a form we can reverse.
- Optional expert-marketplace data. If you apply to become a FAKTS expert, we store the fields on the application form, your CV or supporting files in a private storage bucket, and, if approved, your professional profile.
- Support and correspondence. Any message you send to yes@rizzgroup.org and our response, kept only as long as needed to answer you.
Why we process this data and on what lawful basis
- Contract. To create your account, run the checks you request, generate certificates, and let you download or share your results.
- Legitimate interest. To keep the service running: rate limiting, abuse prevention, product analytics on aggregated events, and improving the product itself.
- Consent. Where consent is the appropriate basis, for example if you opt in to a newsletter or a beta programme, we ask for it explicitly and you can withdraw it at any time.
- Legal obligation. Where a specific law requires us to keep or share records, for example a tax or accounting rule.
Content sent to third-party AI providers
To produce a verdict, FAKTS sends the specific claims extracted from your content, and in some cases the surrounding context, to a set of independent AI model providers acting as processors. These providers may briefly retain the request for operational reasons documented in their own agreements. FAKTS selects providers that support enterprise or API-tier terms and, to the extent the provider offers this option, opts out of using the data to train their models. [Confirm this is accurate before publishing.] For the current list of providers, see the Sub-processors page.
Hosting and where your data lives
The FAKTS database and file storage are hosted on Supabase in an EU region. Application servers run on Cloudflare's global edge. Content briefly leaves the EU when it is sent to a model provider that is US-based, and in that case the transfer relies on the European Commission's Standard Contractual Clauses, together with the additional safeguards described in each provider's terms.
Retention
We keep your account data for as long as your account exists. Content you submit for checking and the resulting certificates are kept until you delete the specific document, delete your account, or [confirm retention period] passes, whichever comes first. Hashed rate-limit records are kept for a short rolling window. Support correspondence is kept only as long as needed to answer you. Backups are rotated on a short cycle and, once rotated, no longer contain deleted records.
Your rights under the GDPR
If your personal data is processed by FAKTS you can, at any time, request:
- Access to the personal data we hold about you.
- A portable export of that data in a machine-readable format.
- Correction of inaccurate data.
- Deletion of your account and the data attached to it.
- Restriction of, or objection to, processing based on legitimate interest.
- Withdrawal of any consent you previously gave, without affecting past processing.
- A complaint to your national supervisory authority if you believe your rights have been violated.
You can exercise the first four of these rights yourself from inside the product on your account page, where the Export my data and Delete my account actions live. For anything else, write to yes@rizzgroup.org. We respond within one month.
Security
Your rows are protected by row-level security so that one account cannot read another's private data. Traffic is encrypted in transit. Data at rest is encrypted by the underlying provider. Access to production data is restricted to a small number of people who need it, with logs and reviews.
Children
FAKTS is not intended for people under the age of 16 and we do not knowingly collect personal data from them.
Selling data and training
FAKTS does not sell personal data. Content you submit for checking is not used to train models operated by FAKTS. [Confirm this is accurate before publishing.] Whether a specific third-party provider trains on data sent to its API is governed by that provider's agreement; see the Sub-processors page for the list.
Changes to this policy
We may update this policy from time to time. Material changes are announced on the product before they take effect. The date at the top of this page is always the effective date of the current version.
Contact
[Legal entity name] · [Registered address] · yes@rizzgroup.org