Privacy policy

In short

We only collect what we need to check your link, answer your messages and run your account.
Our website does not keep the links you check. They are sent to RIEG's servers, which can hold a link for a while and keep your IP address for a short time to limit abuse. Section 3 gives the details. Tools that track you load only if you say yes.
You can ask to see, fix or delete your data at any time. Section 10 explains how.

1. Who we are

AEKZ Securiglobe India Pvt. Ltd. ("we", "us") makes RIEG, a tool that checks links for phishing. We decide why and how your personal data is used, so we are the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the "controller" under the EU General Data Protection Regulation (GDPR).

Address: 9/13, 3rd Cross Street, Narasingapuram, Maduvankarai, Guindy, Chennai, India
Privacy contact: rieg@securiglobe.co.in
Grievance Officer (DPDP Act): Securiglobe Team, info@securiglobe.co.in
EU representative or Data Protection Officer: none appointed. RIEG is aimed at people in India. If that changes, we will name one here.

2. What this policy covers

This website and its forms.
The free link checker on this website.
The RIEG apps (Windows, Android, iOS) and the browser extension.
Our email updates, if you choose to get them.

This policy covers the website, the RIEG apps and the browser extension. The apps and extension may also show a short notice inside the product when you sign up.

3. What we collect, and why

Where	What we collect	Why	Legal basis (GDPR)
Browsing this website	Technical data needed to deliver the site, such as your IP address and device details, handled by our hosting and security provider (Cloudflare). Our own code logs only an outcome code and timing, never your IP address or what you typed. Cloudflare's network logs follow its own retention policy.	To show you the site and keep it secure.	Legitimate interests (running and securing the site)
Free link checker	The link you paste. It is sent to RIEG's servers to be analysed. It is not added to an account or to scan history, because this check has no account. RIEG's servers may keep the link for a time and keep an IP address in a rate-limit record: see "The free link checker in detail" below. (Checks made while signed in to the RIEG app or extension are kept in that account's history: see the app's own policy.) Our website's own code does not write the link or your IP address to its logs. For its own limit on how many checks one person can run, our website keeps a one-way scrambled version of your IP address for about two minutes.	To tell you whether the link shows no known threats, warning signs or looks dangerous, and to prevent abuse and keep the service secure.	Legitimate interests (providing the check and preventing abuse)
Bot protection on our forms and checker	A security check from Cloudflare Turnstile that tells people from bots. It runs in your browser and may use signals such as browser and device information. We do not set cookies for it ourselves.	To stop spam and automated abuse.	Legitimate interests (security)
Contact form	Your name, email address, the topic and your message.	To reply to you. The message is emailed to our team. It is not added to any marketing list.	Consent, and legitimate interests (answering enquiries)
Website account (free link checker)	Your email address, mobile number and a password (stored only as a one-way scrambled value, so nobody can read it), when you agreed and to which wording, whether you ticked the optional box for scam alerts and news, how many checks you have made (a number only, never the links), and when you last signed in. If you ask to reset your password we also keep a one-time reset link for up to 1 hour (only a scrambled copy of it, deleted once used). We use a sign-in cookie, and, before you have an account, a cookie that counts your first 5 free checks. Both are strictly necessary.	To confirm your email address and to let you reset a forgotten password (we email you a one-time link through Zoho ZeptoMail), to let you keep using the link checker after your first 5 free checks, to keep your account secure, and to contact you about your account. If you ticked the optional box, to send you scam alerts and RIEG news. Your mobile number is not verified yet.	Contract (running your account), and consent for the optional emails
Scam alert emails	Your email address, when you ticked the box and which wording you agreed to, and whether you have clicked the confirmation link. Nothing is sent to your address until you confirm.	To send you scam alerts and RIEG news by email. We email you a confirmation link first, and nothing is sent until you click it. Every email has a one-click unsubscribe link.	Consent
Assistant chat	The questions you type into the assistant, and the last few messages of that conversation. Email addresses and long numbers are removed before sending. We do not store the chat on our website.	To write an answer to your question. Please do not type passwords, OTPs, card numbers or other sensitive details.	Legitimate interests (answering questions about RIEG)
Business early-access form	Your name, work email, company, role, team size, optional message, the campaign that brought you here (if the address had one), and a record of when and how you agreed.	To contact you about early access for your company and manage your request.	Consent
External beta programme application	Your name, email address, country, the group and browser you choose, your reason for joining and, only if you add them, your organisation or college, LinkedIn address and comments. We also note when and how you agreed. We never ask for passwords or browsing history. The application is emailed to our team inbox (Zoho Mail, sent through Zoho ZeptoMail), saved as a contact record in our Zoho CRM, and we email you a confirmation. It is not stored on our website itself. To ignore a repeat application, a one-way scrambled copy of your email address (not the address) is kept for up to 90 days.	To review your application, choose beta testers and send onboarding instructions. A repeat application from the same email address is ignored.	Consent
Beta testers' security reports	For a signed-in beta tester: your account ID and email, the link you report (kept exactly as you typed it, with a safe copy), what RIEG showed and what you expected, your browser, your description, optional technical details, an optional screenshot (PNG or JPG), and a record of when you confirmed that you sent no secrets. We never open, visit or fetch the link you report, and we do not send it to any other service without approval from our technical team.	To investigate wrong results, missed threats and scanning problems, and to improve RIEG. Screenshots are kept privately and only authorised team members can see them. Our team's investigation notes stay internal.	Consent
RIEG apps and extension	Account details (email address, name and sign-in method, including Google sign-in), a device identifier and app version, the web addresses of links you check and the result (your scan history), your settings, and sign-in and sign-out records with the IP address they came from, for security.	To check links for you and run your account.	Contract, and legitimate interests

The free link checker in detail

This part covers the free check on this website, which is a request to RIEG's service at POST /api/v1/trial/analyze. It does not cover a check made while you are signed in to the RIEG app or browser extension: those checks are kept in that account's history.

There is no account for this check. It does not set a sign-in cookie and does not ask for your name, email address or phone number.

Data	What happens	Why
The link you submit	Sent to RIEG's servers and analysed. It is not written to an account and not written to the scan-history database.	To return a verdict (no known threats, warning signs, or looks dangerous).
An IP address	RIEG stores the IP address of the connection that called the check, in plain text (not a scrambled copy), for about one minute, with the path `/api/v1/trial/analyze`, so one address cannot run more than 5 checks in a minute. For checks made through this website, your browser never calls RIEG directly: our website's server (hosted on Cloudflare) sends the link and does not pass your address on, so RIEG's service sees our server's address, not yours. The address is not sent to the website the link points at, because the check is made from RIEG's servers.	To limit abuse.

Where the link is kept

Queue (Redis). The link is the argument of the analysis job. That job record is not given an expiry. It can stay in Redis until we delete it.
Verdict cache (disk on the server). After a completed check, the verdict is cached for 24 hours. The cache entry includes the link itself, not only a hash.
Server logs. The worker log can include the link. How long log files are kept depends on the server's log settings.

A link that is rejected as invalid or not allowed is not queued and is not written to the verdict cache. The rate-limit counter for the IP address is still updated.

How long the IP address is kept

Normally the counter is kept in Redis for about 60 seconds. If Redis is unavailable, the same IP address and path are written to a row in the application database. That row is not deleted when the minute ends. A later check from the same address resets the count; it does not remove the address.

What we do not do on this check

We do not add the link to an account history.
We do not sell the link or the IP address.
We do not send the link or the IP address to an advertising or analytics tool from this check.
We do not send your IP address to the site you asked us to check.

To ask what we hold from a free check, or to ask us to delete it, see "How to use your rights" in section 10.

We use RIEG's link verdicts as automated warnings to help you decide. They don't make decisions about you that have legal or similarly significant effects.

4. Cookies, analytics and marketing tracking

Before you choose, only strictly necessary cookies and technologies run. Analytics and marketing tools are not loaded at all until you agree.
You can accept all, reject all, or choose by category. You can change your mind at any time using "Cookie choices" in the footer of every page. If you withdraw consent, we stop the tools and delete their cookies on our site.
We remember your choice in a cookie for up to 180 days, then ask again.
We never send the links you check, your email address or what you type in our forms to any analytics or advertising tool.

The tools we use are:

Tool and provider	Category	What it collects	Cookies (typical)
Cookie choice (RIEG)	Strictly necessary	Your cookie choice and when you made it. No personal data.	`rieg_consent`, up to 180 days
Cloudflare Turnstile and Cloudflare hosting	Strictly necessary	Security and bot-check signals, to keep forms and the checker safe: your IP address, browser details and how the page is used during the check. Cloudflare says it uses these only to tell people from bots, not for advertising.	None set by our own code. Cloudflare may set strictly necessary security cookies of its own while it checks (see Cloudflare's cookie policy).
Google Tag Manager (Google)	Loads only when you accept analytics or marketing	Loads the other tools below. It does not itself set marketing cookies.	None of its own
Google Analytics 4 (Google)	Analytics	Pages visited, our own events (link check submitted and its verdict word, downloads, form submitted, articles read, clicks to other sites), approximate location, device and browser. Never the checked link or form contents. Google Analytics 4 does not log or store full IP addresses. We keep Google signals and ad personalisation off, and keep this data for 14 months.	`_ga`, `_ga_*` (about 2 years)
Microsoft Clarity (Microsoft)	Analytics	Heatmaps and recordings of how pages are used: clicks, scrolling, mouse movement, pages visited, device and browser. What you type and the link you check are hidden from recordings. We use Clarity's strictest masking, so text and form fields are hidden in recordings. Microsoft stores the data on its own servers, which may be outside India.	`_clck` (about 1 year), `_clsk` (1 day)
Meta Pixel (Meta)	Marketing	Pages visited and actions such as submitting a form, so we can measure and improve our adverts on Facebook and Instagram. Meta also receives your IP address and browser details.	`_fbp` (about 90 days)
LinkedIn Insight Tag (LinkedIn)	Marketing	Pages visited and actions such as submitting a form, so we can measure our LinkedIn adverts. LinkedIn also receives your IP address and browser details.	Cookies set by LinkedIn, such as `li_sugr`, `bcookie` and `lidc`
Google Search Console (Google)	None on your device	Reports to us about how our site appears in Google Search. It doesn't run on your browser.	None

Google, Microsoft, Meta and LinkedIn act as service providers or as independent controllers of the data they receive, and process it under their own privacy policies. For measuring how the site is used they act on our behalf; for their own purposes (such as improving their services or showing adverts) they decide how the data is used and are responsible for it. Your data may be sent outside India, for example to the United States, where these companies operate, under the safeguards described in their own policies.

5. Email updates and marketing

We only send marketing email if you agreed to it. We do not send marketing email yet. If we do, it will go only to people who agreed to it, and every email will have an unsubscribe link. Account and confirmation emails are sent through Zoho ZeptoMail, which handles your email address on our behalf. Our Zoho account uses Zoho's India data centre.

We share personal data only with companies that help us run RIEG, under agreements that limit how they can use it:

Cloudflare: website hosting, delivery and security.
Zoho: email sending (ZeptoMail) and, for early-access requests and beta programme applications, contact storage (Zoho CRM).
Zoho: our customer relationship management (CRM) system, where early-access requests and beta programme applications are recorded as leads.
The chat helper answers from our own guides, inside your browser. What you type into it is not sent to us or to anyone else. If we later connect an AI service, we will say so here before we do.
Cloudflare: hosting, security and our database. Google: sign-in, and analytics only if you agree. Microsoft: the Microsoft Store and, only if you agree, Clarity.

We don't sell your personal data. We may share data if the law requires it, or to protect our rights or other people's safety.

7. Where your data is stored

We store personal data in India and the Asia-Pacific region (our CRM and email service use Zoho's India data centre, and our account database runs on Cloudflare in Asia-Pacific). Cloudflare's network also handles traffic in other countries. Some of our providers may process data in other countries. When data moves across borders we follow the DPDP Act and, for people in the European Economic Area, we use protections required by the GDPR such as standard contractual clauses. We rely on the safeguards in each provider's own terms, including standard contractual clauses for people in the EU and UK.

8. How long we keep it

Data	How long
Link checker (this website)	Our website does not store the links you check. On RIEG's servers, the job record in the queue has no expiry, the verdict cache (which includes the link) lasts 24 hours, and server log retention depends on the server's log settings. The IP address in the rate-limit record lasts about 60 seconds, but if Redis is unavailable it is written to a database row that is not deleted when the minute ends. Our website's own scrambled IP counter lasts about two minutes. For signed-in app users, see the app row below.
Website account	Until you delete your account on the Account page (which removes your email, mobile number and password record straight away) or ask us to. Sign-in sessions end after 30 days. The free-checks cookie lasts 30 days. We may delete an account that has not been used for 24 months, after emailing you a warning.
Scam alert emails	Until you unsubscribe. After that we keep only a record that you unsubscribed, so we do not email you again. Unconfirmed sign-ups are not emailed and can be deleted after 7 days.
Assistant chat	Not stored. The helper runs in your browser.
Contact messages	Up to 12 months after we answer, then deleted from our mailbox.
Early-access requests (Zoho CRM)	Up to 24 months after our last contact with you, or sooner if you ask us to delete them.
Marketing email subscriptions	Until you unsubscribe or ask us to delete them.
App and extension accounts and history	Account details: until you delete your account or ask us to. Scan history: kept while the account exists, and deleted with it. You can ask us to delete your history sooner. Sign-in and sign-out records with IP addresses: up to 12 months.
Website security logs	Our own code keeps no personal data in its logs. Network logs kept by our hosting provider follow its own retention policy.

9. How we protect it

Our website only works over HTTPS, and we use security controls such as strict browser security headers, limits on automated use, and keeping secret keys out of the website's code. No system is perfectly secure. Passwords are stored only as one-way hashes with a unique salt and a secret held on the server. All traffic uses HTTPS, the site uses a strict content security policy, forms are protected by bot checks and rate limits, and access to personal data is limited to people who need it. If you find a security problem, please tell us at rieg@securiglobe.co.in.

10. Your rights

Under India's DPDP Act

You have the right to:

get a summary of the personal data we hold about you and how we use it, and who we've shared it with;
ask us to correct, complete or update your data;
ask us to erase your data when it's no longer needed for the reason we collected it;
withdraw your consent at any time. It should be as easy to withdraw as it was to give;
use our grievance process and get a response; and
nominate another person to exercise your rights if you die or can't act for yourself.

Contact our Grievance Officer first: Securiglobe Team, info@securiglobe.co.in. If you're not satisfied, you can complain to the Data Protection Board of India. We aim to reply within 30 days.

Under the EU GDPR

If you are in the European Economic Area, you have the right to:

access your personal data;
have wrong data corrected;
have your data erased in certain cases;
restrict how we use your data in certain cases;
receive your data in a portable format, and ask us to send it to another provider, where it applies;
object to processing that we base on our legitimate interests;
withdraw consent at any time, without affecting what we did before you withdrew; and
complain to your local data protection authority.

How to use your rights

Email rieg@securiglobe.co.in and tell us which right you want to use. We may need to check who you are first. We'll reply within 30 days. There is no charge in most cases.

For the free link checker on this website, say that your request is about the free link checker and include the approximate time of the check. We may need the IP address you used to find the rate-limit record. The queue and the 24-hour cache cannot be looked up by name or email, because we collect neither.

If we start marketing in other countries, we will add the local rights and contacts here.

11. Children

RIEG is not aimed at children. You must be 18 or older to create an account. If you are under 18, please do not create an account or send us your details. If we learn that we hold a child's details without a parent's or guardian's consent, we will delete them.

12. Changes to this policy

If we make important changes, we'll update the date at the top and tell you in a clear way, for example with a notice on the site or an email to account holders.

13. Contact us

Questions about this policy? Use our contact page, or email rieg@securiglobe.co.in.