Risposti

Legal

Privacy policy

Last updated 27 September 2026 · Version 1.0

This policy explains what personal information Risposti collects, why, who we share it with, how long we keep it, and the rights you have. It is written against the Australian Privacy Principles (APPs) in the Privacy Act 1988 and shaped for GDPR/UK GDPR. Risposti is a product of HitCreate, built in Australia.

1. Who we are

Risposti is operated from Australia. Our contact for privacy is [email protected] — this is also our designated privacy officer inbox. Security matters: [email protected]. An EU/UK representative will be appointed (GDPR Art 27) before we sell into those markets.

2. What we collect

  • Account: name, email, password hash (via our auth provider).
  • Company knowledge: files or URLs you upload or import — your confidential business information.
  • Roleplay data: transcripts, audio, rubric scores and your skill profile.
  • Usage/technical: session metadata, IP address, device.

3. Why we use it, and the lawful basis

  • To provide the service and score your practice — contract.
  • To secure and improve the service — legitimate interests.
  • To send you product emails, with your consent — consent.
  • To meet legal obligations — legal obligation.

4. AI processing

The counterpart you practise against is an AI, and your results are produced by AI. To generate the buyer’s replies and your score, we send the relevant prompt, transcript and (for a voice session) audio to our AI sub-processors. Those providers are pinned to zero-retention and do not train on your data. We may keep your practice data to improve the service; you can opt out of any training use, and export or delete your data, at any time in the app or by emailing us. Automated-decision-making transparency applies to us under the Australian Privacy Act reform from 10 December 2026: decisions about your practice are made or substantially assisted by computer programs, and this policy discloses that.

5. Who we share it with (sub-processors and transfers)

We use a small set of sub-processors for hosting (EU), authentication, AI inference and voice (US), and our site/CDN. Their details are published in our sub-processor list. Our own infrastructure is hosted in the EU; the AI vendors are in the US, so international transfers rely on appropriate safeguards (Standard Contractual Clauses) with a transfer assessment. We will give notice and 30 days before adding a new sub-processor that touches your data.

6. How long we keep it

Practice data (transcripts, audio, scores, skill profile) is kept while your account is active, so your training record persists; account data is kept while active and for a limited period after closure. You can delete or export your data on request and in the product. We are rolling out a fixed deletion schedule for audio; until then, deletion on request is honoured promptly.

7. Your rights

You can ask for access to, and correction of, your information; erasure; portability; to object to processing; to withdraw consent; and to opt out of any sale or sharing (we do not sell your data). You can complain to the Office of the Australian Information Commissioner (OAIC), or to a supervisory authority in the EU/UK. If a data breach is likely to result in serious harm, we will notify the OAIC and affected individuals without undue delay.

8. Security

Access is authenticated and tenant-isolated; data is encrypted in transit and at rest; access to customer material is least-privilege and logged. Our AI and voice vendors are zero-retention. We do not put secrets in the browser. More detail is on our security & data page.

9. Cookies

We use essential cookies only at present. We will ask for consent before using any analytics or marketing cookies.

10. Not for children

Risposti is a business tool, for people aged 18 and over.

11. Changes and contact

We will version this policy with dates. Questions or requests: [email protected].