Privacy Policy

1. Who We Are

RIQ AI ("we", "us", "our") operates the Eva chat-bot service accessible at riqai.com.ng. Eva is an AI-powered academic assistant that answers questions using curated knowledge sources.

Contact: riqsoftware@gmail.com

2. What RIQ AI Does

Eva is a RAG (Retrieval-Augmented Generation) chatbot that helps users find information from academic and institutional knowledge bases. You ask a question; we search our knowledge sources and generate an answer with citations to those sources.

The service is available in two tiers:

• Free tier: Anonymous access with 5 free queries per month; signed-in users get 10 in their first month, then 5 each month. No payment required.
• Paid tier: Sign up via Clerk (using Google, email + username, or other supported sign-in methods) and purchase token packages to unlock more queries. Each message costs 1 token.

3. Information We Collect

What We Do NOT Collect

• We do not require your name, phone number, or physical address.
• We do not collect or access your contact lists or address books.
• We do not collect precise location data (only country-level from your IP for abuse prevention).
• We do not sell or share your personal information.

Data You Submit (Prompts / Queries)

When you type a question into Eva:

• Your prompt is sent to the RIQ AI backend, where it is combined with relevant knowledge sources and forwarded to a third-party AI provider for response generation.
• Your prompt and the generated response are stored as part of your chat history so you can review past conversations, and so we can improve the service by understanding what questions people ask and where our knowledge base has gaps. This history is also retained for abuse prevention. You can clear your history or request deletion at any time; we retain it otherwise as needed for the purposes described in this policy.
• Your prompt is not used to train AI models. RIQ AI uses API-based AI providers whose terms prohibit training on API-submitted data.

Account Data (Paid Users Only)

When you sign up via Clerk:

• We store your username and a unique user ID. Depending on your chosen sign-in method, we may also receive and store your email address, display name, and profile picture from the authentication provider (e.g., Google shares your name, email, and profile photo). You may use the email + username option to set your preferred name and credentials instead.
• We do not store your passwords or credentials - Clerk handles all authentication securely. RIQ AI never sees the login credentials you provide to Clerk.
• To delete your account and associated data, email riqsoftware@gmail.com from the address linked to your account. We action deletion requests within 30 days.

Payment Data

All payments are processed by Paystack. RIQ AI does not store your credit card number, bank details, or CVV. We only store:

• A record of your transaction (amount, package, timestamp).
• Your aggregate token balance.

Analytics Data

We use aggregate, cookieless analytics provided by Cloudflare (our CDN and security provider) to understand how many people visit and where they come from. This does not identify you and never includes your chat content. It may include:

• Page views and visited URLs.
• Device type, browser, and operating system.
• Referrer and country-level location.
• Session duration.

No personal data is shared or sold. We do not send your chat content to analytics.

Session & Technical Data

• Session cookie (anon_session): A session identifier for anonymous users; expires after 31 days (resets when you return).
• Authentication cookie (__session): For signed-in users, a secure cookie maintains your logged-in session (expires after 30 days).
• Server logs: IP address and timestamp retained indefinitely for security monitoring and abuse prevention. These logs are not tied to your account beyond what is necessary for rate limiting.

4. How We Use Information

We use your information only for:

AI model training disclosure: RIQ AI does NOT use your data to train, improve, or fine-tune any AI model. We forward your prompt to a third-party AI provider for response generation, and these providers' API terms prohibit training on customer-submitted data.

Marketing: We do not send marketing emails. For users who purchase tokens, you may receive transactional emails (purchase receipt and payment, balance notifications) via Resend.

5. Cookies

We use the following cookies:

We do not use advertising cookies, third-party tracking cookies, or social media marketing pixels. We do not engage in cross-site tracking.

6. Third-Party Processors

Your data is processed and stored with the providers below - including Railway (application hosting) and Neon (managed Postgres database).

7. Data Retention

8. Your Rights

NDPR (Nigeria)

Under the Nigerian Data Protection Regulation, you have the right to:

• Access the personal data we have about you.
• Rectify inaccurate or incomplete data.
• Erase your data (where not constrained by law).
• Restrict processing in certain circumstances.
• Object to processing.
• Data portability - receive your data in a structured format.

Requests: Email riqsoftware@gmail.com. We respond within 30 days. If you use RIQ AI anonymously (no account), minimal personal data exists to provide.

GDPR (EEA/UK Users)

If you access RIQ AI from the EEA or UK:

• Legal basis: processing is based on consent (cookies), contract (performance of our service), and legitimate interest (abuse prevention, analytics).
• You have rights under GDPR Articles 15–22 (access and rights above).
• You may lodge a complaint with your local supervisory authority.
• International transfers: data may be processed in the United States and the European Union. Where transfers occur they are governed by Standard Contractual Clauses.

Other Jurisdictions

We comply with applicable privacy laws in jurisdictions where we offer paid subscriptions. Contact us for region-specific requests.

9. International Transfers

RIQ AI operates from Nigeria. Our hosting, CDN, AI model, and analytics providers may be located in the United States, European Union, or other jurisdictions. We ensure that any data transfer is governed by adequate safeguards (such as Standard Contractual Clauses) consistent with the data protection laws affecting your location.

10. Children

RIQ AI is not directed at children under 13 years of age and we do not knowingly collect personal data from anyone under 13. If you believe a child has submitted personal data, contact us and we will delete it.

11. Security

• All communication is encrypted in transit via TLS/HTTPS.
• Data is encrypted at rest (provider-managed).
• Payments are handled entirely through Paystack; no payment data touches our servers.
• No passwords or credentials to leak - we use Clerk for authentication, which handles credentials and multi-factor security on its own infrastructure.
• We maintain a breach notification commitment: if a data breach affects your personal data, we will notify you promptly.

12. Changes

We will post changes with a new "Last updated" date. If significant changes occur, we will notify you by email (if you have an account) or via a notice on our website.

13. Contact

Email: riqsoftware@gmail.com

We respond within 30 days.