Privacy
What Risk Letters keeps about you, why, for how long, and who else sees it.
Last updated 12 October 2026.
Risk Letters is run by Risk Signal, CVR 32849296 (Danish company registration number), Krogebjerg 40, 2720 Vanløse, Denmark. We are the data controller for the information described on this page.
Send questions about your data and requests for access, deletion or your other rights to privacy@riskletters.eu. A person reads that mailbox, and no AI model sees it. Everything else goes to support@riskletters.eu.
When you create an account we keep your email address, your name, your password as a bcrypt hash, the secret key for your authenticator app (encrypted), your ten recovery codes as hashes, your language and when you last signed in. If you fill in your organisation's profile (sector, country, technologies, NIS2 and DORA), we keep that too.
If you apply for free access as an NGO or a student, we keep your application: email, name, organisation, role and your message.
Purpose: to give you access and deliver the brief. Basis: the contract with you, GDPR article 6(1)(b). Applications are processed to enter into that contract (same point).
When an administrator buys seats for their organisation, the administrator enters colleagues' names and email addresses, and we send them an invitation. The administrator can see who in the organisation holds a seat.
Basis: the agreement with the organisation and our legitimate interest in delivering it, GDPR article 6(1)(b) and (f). If a colleague invited you, we received your details from them.
Paddle (Paddle.com Market Ltd) sells you the subscription as reseller. Paddle takes the card details, adds VAT, writes the invoice and is an independent controller for the payment details. Read Paddle's own privacy policy at paddle.com/legal/privacy.
We send Paddle your email, your name, your language and your member number. From Paddle we receive the customer and subscription numbers, the status, the next payment date and the amount of the latest payment. We keep Paddle's payment notifications as bookkeeping records. We never see your card number.
Paddle's checkout window loads only when you press pay. Until then the site does not contact Paddle.
If your card had a free trial and your account is deleted, we keep a keyed hash of the card for six years, so the same card cannot start another trial. The card number cannot be read from it. Basis: our legitimate interest in preventing abuse of the trial, GDPR article 6(1)(f).
Basis: the contract, GDPR article 6(1)(b), and the Danish Bookkeeping Act, point (c).
We send invitations, links to choose a password and two-factor, payment receipts and reminders, and the daily and Sunday brief. Mail goes through our own mail server.
For each mail we keep the recipient, sender, subject and whether it was delivered. We do not keep the content. The log is deleted after 180 days. Our mail servers also log the recipient and the time; that log is kept for about five weeks.
Our mails carry no tracking pixel, and we do not measure whether you open them. When you click from a brief in the mail to the dashboard or the PDF, we count the click in a total for that mail, without storing who clicked.
Basis: the contract, GDPR article 6(1)(b). You can unsubscribe from the brief in every mail.
When you write to support@riskletters.eu or under Support in the dashboard, we keep a ticket with your email, your name, the subject, the message and our reply. We do not keep attachments in the ticket; we note only the file name, type and size.
An AI model (Claude by Anthropic in the United States, bought through Microsoft Azure) reads the ticket's text and your name and suggests a category and a reply. Your email address and our internal notes are not sent. The model sends nothing itself. A person reads the suggestion, edits it and sends every reply.
Tickets are deleted five years after the last activity. An open ticket is not deleted. The original mail is deleted from the support mailbox on our mail server 90 days after it was added to the ticket.
Basis: the contract when you are a member (GDPR article 6(1)(b)), otherwise our legitimate interest in answering you (point (f)). The AI suggestion rests on our legitimate interest in answering quickly (point (f)).
The community closed on 26 October 2026. Posts, reactions and mentions you wrote while it was open are still with us. No other member can see them.
Posts are deleted twelve months after they were written. You can download everything you wrote under your data in settings. To have a post deleted sooner, write to support.
Basis: the contract, GDPR article 6(1)(b).
If you create a key for your own AI assistant, we keep the key as a hash and its name. For each call we keep the time, the tool, the search terms the assistant sent and how many rows came back. We do not keep the answers.
The call log is deleted after 180 days. Basis: the contract and our legitimate interest in preventing abuse, GDPR article 6(1)(b) and (f).
We log important events on your account, for example sign-in, a new password and a new authenticator. The log is kept for 12 months.
To slow down password guessing we remember your IP address and email address for 15 to 60 minutes when you sign in or ask for a link.
Sign-in log: when you sign in, or try to, we record the time, the result, your IP address, your browser's user agent, and the country and network provider we derive from the IP address with a database on our own server. Attempts with an address that has no account are kept only as a keyed hash. The purpose is to protect your account and the service against misuse, the legal basis is our legitimate interest (GDPR article 6(1)(f)), and we delete the records after 12 months.
If you sign in from a new country or a new browser, we send you a short mail so you can act if it was not you.
Our web server logs the IP address, the page address and the browser for each visit. A firewall in front of the website turns away known attacks and logs the requests it acts on, without the content of what you send. Both logs are kept for 14 days.
Basis: our legitimate interest in keeping the service secure, GDPR article 6(1)(f).
We count visits to the public pages with Umami, which we run ourselves on our own servers. Umami sets no cookies, does not store your IP address and does not follow you across sites. We see the number of visits, which pages, country, browser and device type.
The dashboard and the community have no statistics.
Basis: our legitimate interest in knowing which pages are read, GDPR article 6(1)(f).
There is no cookie banner because the site sets only cookies you need to sign in, or that remember a choice you made yourself. None of them is used for statistics or advertising.
The dashboard remembers in your browser whether you chose a light or dark theme and whether the side menu is collapsed (localStorage). This is not sent to us.
If you open Paddle's checkout window, Paddle may set its own cookies. Paddle controls those.
We share your details only with those who help us deliver the service:
The AI models that write the brief receive threat data from public sources. They receive nothing about you. Searches about threat actors go to Linkup in Paris and contain nothing about you either.
We do not sell data or pass it to advertisers.
Paddle.com Market Ltd is in the United Kingdom. The EU has decided that the UK protects personal data to the same level as the EU.
The AI model for support runs at Anthropic, PBC in the United States. When you write to support, we send it the ticket's text and your name, never your email address.
Everything else we process in the EU.
You have the right to:
Write to privacy@riskletters.eu. We answer within one month. You can correct your name, language and organisation profile yourself in settings, and under Settings in the dashboard you can download everything we hold about you as a file and delete your account. Both ask for your password and a code from your authenticator app. If you have a subscription that is still running, cancel it first.
We make no decisions about you based solely on automated processing.
If you are unhappy with how we handle your details, you can complain to Datatilsynet (the Danish Data Protection Agency), Carl Jacobsens Vej 35, 2500 Valby, Denmark, phone +45 33 19 32 00, dt@datatilsynet.dk, www.datatilsynet.dk.
If we change how we handle your details, we update this page and the date at the top. If the change is significant, we write to you first.