Privacy Notice

Last updated: 20 July 2026

Alethriko Labs ("we", "us", "our") makes The Risk Register, a service for tracking risks, business impact analysis, and key risk indicators, available at theriskregister.co.uk. This policy explains what personal data we collect, why we collect it, how long we keep it, and the rights you have over it.

Our two roles

We handle personal data in two distinct capacities, and your rights differ depending on which applies:

• As a controller for the data we need to run the service: your account and your organisation. This policy covers that data.
• As a processor for the content of the records your organisation creates in the service (for example, risk descriptions, mitigation actions, business impact analysis, and key risk indicator readings). Your organisation is the controller of that content. We process it only on your organisation's instructions, and requests about it should go to your organisation in the first instance.

What we collect and why

Account and organisation data

When you sign up we collect your name, work email address, and the organisation you belong to. We use this to create and secure your account and to associate you with your organisation's workspace. Lawful basis: performance of a contract.

Record content you create

The risks, mitigation actions, business impact analysis, and key risk indicator data you enter are stored in our database and may contain personal data your organisation chooses to include, such as the names of risk owners. We process this as a processor, as described above.

Usage analytics and advertising

We use Vercel Web Analytics to count visits and page views in aggregate. It does not use cookies or store any identifier on your device, and it does not track you across sites or sessions, which is why it does not appear in the cookie banner. Our lawful basis is our legitimate interest in understanding how the website is used.

With your consent, we use Google Analytics to understand how the website is used, with IP addresses anonymised. If you also allow the advertising category in the cookie banner, we enable Google's advertising features. Both categories are off by default and independent of each other. You can change or withdraw either at any time using the Cookie settings link in the footer. See our Cookie Notice for the full detail. Lawful basis: consent.

Support and correspondence

If you contact us at hello@alethrikolabs.co.uk we keep the correspondence so we can resolve your query. Lawful basis: legitimate interests in supporting our customers.

Where your data lives

Customer data, including all record content, is stored in our database hosted in the European Union (Frankfurt, Germany). Some of our sub-processors operate from or route traffic through other regions, including the United States. Where data leaves the UK or EU, it is protected by appropriate safeguards: the UK Extension to the EU-US Data Privacy Framework, the EU-US Data Privacy Framework, or Standard Contractual Clauses, depending on the provider.

Sub-processors

We use the following providers to deliver the service:

• Neon (database hosting, EU region): stores all application data, including your records.
• Vercel (application hosting and content delivery): runs the application and serves it to your browser.
• Clerk (authentication): manages sign-in, sessions, and credentials.
• Google (analytics and advertising): measures website usage and, with your consent, supports advertising features. Active only for the categories you allow.

We do not currently use an AI provider or a payment processor for this service. If we introduce either, we will update this page before doing so and, for material changes, notify organisation owners by email.

How long we keep data

• Account and organisation data: for the life of your account, then deleted within 90 days of account closure.
• Record content: for the life of your account. If you close your account, records remain available for 90 days so you can export them, then they are deleted.
• Support correspondence: kept for up to 2 years after the query is resolved.

Security

Data is encrypted in transit (TLS) and at rest. Access within each workspace is scoped to your organisation at the data layer, and sign-in supports multi-factor authentication.

Your rights

Under UK GDPR and, where it applies, EU GDPR, you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to our processing of it, and to receive it in a portable format. Where processing is based on consent (analytics and advertising), you can withdraw that consent at any time, using the Cookie settings link in the footer, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, email hello@alethrikolabs.co.uk. We respond within one month. If your request concerns data inside your organisation's records, we may refer it to your organisation, since they control that content.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk, or to your local supervisory authority if you are in the EU.

Children

The service is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18.

Changes to this policy

When we change this policy we will update the date at the top of this page. For material changes we will notify organisation owners by email before the change takes effect.

Contact

Alethriko Labs (maker of The Risk Register)
Email: hello@alethrikolabs.co.uk