Risely Privacy Policy
Last updated: September 11, 2026
Risely is a cloud-based platform that uses artificial intelligence to help colleges and universities streamline administrative and manual processes. This Privacy Policy applies to the Risely website (www.risely.ai) and the Risely platform.
This Policy explains what personal information we collect from visitors to the Risely website and platform, how we use and share that information, and the rights and choices you have in connection with that information, including how you can limit certain uses and sharing of your information.
When we refer to "personal information," we mean information about an identified individual or about an individual whom we could identify. Subject to applicable law, personal information generally does not include publicly available information or anonymized or de-identified data.
This Privacy Policy does not apply to third-party websites, products or services, even if they link to the Risely site or platform. We recommend you review the privacy practices of those third parties before connecting or accessing third party websites and sharing any personal information.
Who You Are
| Role | Definition |
|---|---|
| Site Visitor | Anyone who views our public marketing website without logging in. |
| Advisor | Faculty or staff member who accesses the Risely platform under an institutional contract. |
| Admin | Staff member who access the Risely platform under an institutional contract with administrative privileges. |
Site Visitor Privacy
Types of Information We Collect About Risely Site Users and Why
We may collect the following categories of personal information about Risely Site Visitors, for the purposes stated in the chart.
| Category of Personal Information Collected | Examples | Purpose of Collection and Use |
|---|---|---|
| Device & Network Identifiers | IP address, browser type & version, operating-system string | • Establish secure connection (TLS handshake). • Detect fraud or malicious traffic. • Diagnose performance issues and errors. |
| Internet / Web Activity | Pages viewed, time on page, clicks, referring/exit URLs | • Measure site performance and content effectiveness. • Improve navigation and user experience. |
| Approximate Geolocation | City-level location inferred from IP | • Tailor website language or regional content. • Generate aggregate traffic analytics by geography. |
| Cookie & Tracking IDs | Consent-choice cookie, analytics identifiers (Google Analytics, PostHog), visitor-identification identifiers (RB2B), first-party contact token | • Remember the cookie choice you made so we stop asking. • Produce limited cookieless Google measurements by default; analytics identifiers are stored only after you allow analytics storage. • Recognize a returning business contact only after you separately allow visitor identification. |
| Voluntary Contact Data (webforms only) | Name, email address, school/organization, phone (optional) | • Respond to demo requests or support inquiries. • Send product updates or newsletters when opted-in. • Create a business contact record for sales or partnership discussions. |
Risely does not collect sensitive categories such as Social Security numbers, student records, biometric data, or precise GPS location from Site Visitors.
Sources of Personal Information from Risely Site Users
| Source of Personal Information | How | Categories Captured |
|---|---|---|
| Directly from You | • You type data into a webform (e.g., "Request a Demo"). • You email us or book a meeting through our scheduler. | Voluntary Contact Data (name, email, organization, phone) |
| Automatically from Your Browser / Device | • Standard HTTPS requests log IP, user-agent. • A strictly necessary first-party cookie stores your privacy choices. • Optional analytics or identification cookies are set only under the choices described below. | Device & Network Identifiers · Internet / Web Activity · Cookie & Tracking IDs |
| Google Analytics (Consent Mode) | • Google's tag loads with analytics and advertising storage denied by default worldwide. • Before an analytics-storage choice is granted, it sends limited cookieless measurements and consent state; it does not set or read analytics cookies. • Advertising storage, advertising user data, personalization, and Google Signals remain disabled. | Internet / Web Activity · Device & Network Identifiers |
| Optional Analytics and Visitor Identification | • PostHog loads only after you allow analytics storage. • After that choice, PostHog may create a privacy-masked session replay. All form and embedded-tool areas are blocked; all input values are masked; query strings are removed; and console messages, network headers and bodies, canvas content, and cross-origin iframe content are not recorded. • RB2B and Risely's contact identifier load only after you separately allow visitor identification. • RB2B may match a visit to a company or known business contact. | Internet / Web Activity · Cookie & Tracking IDs |
| Cloud Hosting, Traffic & Security Logs | • Our content-delivery service records a minimized request log for security, rate-limiting, and aggregate traffic measurement. • Raw edge logs include IP address, browser user-agent, page path, referring URL, and coarse country; they exclude cookies and the requested page's query string and are deleted after three days. The full referring URL is discarded during daily processing. • We replace raw network identifiers with a daily rotating pseudonymous journey key, keep the ordered page journey for up to 30 days, and link that journey to a contact only when the visitor submits a form or carries the reference into our meeting scheduler. • Daily visitor estimates remain directional. Network sharing, changing addresses, caching, and browser automation can merge or split apparent journeys. | Device & Network Identifiers |
Risely does not source Site-Visitor data from data brokers, social-logins, or third-party advertising networks.
Parties To Whom We May Disclose Information About Risely's Site Visitors
We disclose personal information about Risely's Site Visitors as follows, and we may have done so in the past 12 months:
We do not sell personal information about Risely's Site Visitors for money.
| Category of Third Party Recipient | Purpose for Disclosure | Categories of Personal Information Shared |
|---|---|---|
| Service Providers (cloud hosting, error logging, analytics, and visitor identification) | • Host and deliver our website content. • Monitor uptime, diagnose bugs, and compile aggregate traffic metrics. • Google Analytics uses denied-by-default Consent Mode; PostHog and RB2B remain separately consent-gated. | Device & Network Identifiers · Internet / Web Activity · Cookie & Tracking IDs |
| Sales and Communication Tools (Clarify CRM, Slack, Resend, Calendly) | • Route a demo request to the person who will answer it. • Book and confirm the meeting you asked for. • Keep a business contact record of the conversation. | Voluntary Contact Data (name, email, organization, message) · the page that referred you |
| Government or Law Enforcement Entities | • Comply with subpoenas, court orders, warrants, or other applicable law. | Any category required by the legal request (typically Device & Network Identifiers and basic log data). |
| Successor Entities | • Transfer company assets while maintaining continuity of service under this Policy. | All categories held at the time of the transaction, subject to same privacy commitments. |
Risely does not share Site-Visitor information with advertising networks, data brokers, or social-media "look-alike" partners.
Risely Platform User Privacy (Advisor and Admin)
Risely Platform Users are individuals who have signed up to use Risely, and who are using the Risely Platform when logged into their account.
Types of Information We Collect About Risely's Platform Users
We may collect the following categories of personal information about Risely Platform Users, for the purposes stated in the chart. We may have done this in the past 12 months.
| Category of Personal Information Collected | Examples | Purpose of Collection and Use |
|---|---|---|
| Account Profile | Name, institutional email, role (Advisor/Admin), SSO identifier, hashed password (if not SSO) | • Authenticate and authorize access. • Personalize workspace and notifications. |
| Institutional Assignment | Caseload roster, department/program affiliation, primary campus location | • Populate Cases Agent • Route alerts and tasks to the correct advisor or team. |
| Platform-Generated Content | Chat prompts, AI snapshots, meeting notes, success-plan documents | • Deliver core product functionality. • Maintain an auditable advising record for the institution. |
| Integration Data (Student Records) | Student ID, grades, attendance, alerts, holds, degree-audit status (pulled from SIS/LMS) | • Generate snapshots, risk alerts, success plans, and automated outreach on behalf of the institution. |
| Usage & Audit Logs | Login timestamps, API calls, actions taken (e.g., "sent nudge"), IP address | • Security monitoring, compliance audits, feature usage analytics. |
| Device & Network Identifiers | IP address, browser/OS user-agent, cookie/session ID | • Maintain secure sessions, detect fraud, optimize performance. |
Sources of Personal Information from Risely Platform Users
| Source of Personal Information | How We Collect | Categories Captured |
|---|---|---|
| Directly from User | Account creation, profile edits, chat inputs, uploaded files | Account Profile · Platform-Generated Content |
| Institution / Admin Provisioning | Bulk CSV import, SCIM, or SSO attribute mapping | Account Profile · Institutional Assignment |
| Connected Systems | API syncs from SIS, LMS, Financial-Aid, CRM | Integration Data (Student Records) |
| Automatic Collection | Browser session cookies, secure server logs | Device & Network IDs · Usage & Audit Logs |
| Co-Pilot Output | AI agents create summaries, success plans, automated emails | Platform-Generated Content (derived from Integration Data) |
How and With Whom We Disclose Platform-User Information
| Category of Third-Party Recipient | Purpose for Disclosure | Categories of Personal Information Shared |
|---|---|---|
| Institutional Administrators | • Provide oversight, audit trails, and reporting within the customer's tenancy. | Account Profile · Institutional Assignment · Platform Content · Usage Logs |
| Service Providers (cloud hosting, AI inference, error logging) | • Host the platform, run AI models, store backups, monitor performance. | All categories as needed, subject to data-processing agreements (DPAs); no selling or advertising use. |
| Government / Law Enforcement | • Comply with subpoenas, warrants, or other legal obligations. | Any category required to satisfy the legal request. |
| Successor Entity (merger, acquisition, bankruptcy) | • Enable continuity of service under equivalent privacy safeguards. | All categories held at transfer, governed by this Policy. |
We do not disclose Platform-User or student data to advertising networks, data brokers, or social-media companies.
Cookies, Analytics, and Your Consent
Google Analytics uses advanced Consent Mode with analytics storage denied by default worldwide and all advertising consent denied. Before you allow analytics storage, Google's tag may send limited cookieless page measurements and your denied consent state, but it does not set or read analytics cookies. Custom interaction events and PostHog remain off until you allow analytics storage. If you allow it, PostHog can collect clicks and page activity and, when session replay is enabled, a privacy-masked replay; form and third-party embed regions are excluded, input values are masked, URLs contain no query strings, and console messages, network headers and bodies, canvas content, and cross-origin iframe content are not recorded. RB2B and Risely's contact identifier are a separate visitor-identification choice and remain off unless you explicitly enable it. An active Global Privacy Control or Do Not Track signal overrides any stored optional grant. You can change either choice at any time through "Cookie Preferences" in the footer; withdrawal stops recording and deletes the relevant cookies already set.
These are the cookies this site can set, and what each one does:
| Cookie | Set By | Purpose | Loads |
|---|---|---|---|
| risely_consent | Risely (first-party) | Records the choice you made in the cookie banner so we stop asking. Expires after 12 months. | Always (strictly necessary) |
| _ga, _ga_* | Google Analytics | Distinguishes visitors so we can measure page views and traffic sources in aggregate. | Only after you allow analytics storage; cookieless measurement may occur before that |
| ph_* | PostHog | Measures pages, clicks, scrolling, and conversion steps and may create the privacy-masked session replay described above. | Only after you allow analytics storage |
| reb2b / _reb2b* | RB2B | Matches a visit to a business identity so our team can follow up with the visiting institution. | Only after you separately allow visitor identification |
| rt | Risely (first-party) | Recognizes a returning contact who clicked a link we sent them directly, so our team knows their visit belongs to an existing conversation. | Only after you separately allow visitor identification |
Some pages embed third-party tools that you actively use, and those tools set their own cookies under their own privacy policies: Calendly provides the meeting scheduler on our demo page, and Gem provides the application form on our careers page. These load because they are the service you came to that page to use.
We do not record session replay before analytics consent, and we exclude or mask the sensitive data and surfaces described above. We do not use advertising pixels or third-party advertising cookies. We do not sell personal information, and we do not share it for cross-context behavioral advertising.
Aggregated, De-Identified, or Anonymized Data
We may combine or strip identifying details from collected data to create statistics. This aggregated information cannot reasonably be used to identify you and may be shared publicly for research or marketing.
Your Privacy Choices
Site Visitors can:
- Choose analytics storage and visitor identification separately, and change either choice at any time via the "Cookie Preferences" link in the site footer.
- Send a Global Privacy Control or Do Not Track signal from their browser; we honor both automatically as a decline.
- Access or delete their contact data submitted via webforms by emailing privacy@risely.ai.
- Update communication preferences through the unsubscribe link in emails.
- Control cookies via browser settings; disabling cookies may limit site functionality.
- Exercise state-specific rights (e.g., CCPA, GDPR).
Data Localization
Risely hosts Site-Visitor data in the United States. If you access the site from outside the U.S., you consent to such transfer.
Data Retention
Raw CloudFront edge logs are deleted after three days. Pseudonymous first-party page journeys contain no raw IP address, browser user-agent, cookie, query string, or full referrer URL and are deleted after 30 days. Derived daily aggregate traffic counts may be retained for up to 12 months. When you submit a form or book a meeting, the resulting contact record may retain the journey and conversion references with the form submission until you withdraw consent or the business purpose lapses. Analytics providers retain data under their configured retention periods.
Data Security
We employ TLS encryption in transit, encryption at rest, least-privilege access controls, and periodic third-party penetration tests.
Links to Other Websites & AI Technologies
Our site may link to external sites and AI demos. We are not responsible for the privacy practices of those third parties. Please review their policies separately.
Children's Policy
Risely's website is not directed to children under 13. We do not knowingly collect personal information from children.
Notice to California Residents
California residents may request (i) categories of personal information collected, (ii) sources, (iii) business purpose, (iv) categories of third parties shared with, and (v) specific pieces of information collected. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising as those terms are defined by the CCPA/CPRA. We honor the Global Privacy Control signal as a verified opt-out. Google Analytics uses denied-by-default Consent Mode for limited cookieless measurement; analytics storage, PostHog, RB2B, and contact identification follow the choices described above.
How to Submit a Request
Email our Privacy Team at privacy@risely.ai. We will verify your identity (email confirmation or signed statement) before processing.
Updates to This Policy
We may update this Policy periodically. Material changes will be posted with a revised "Last updated" date and, where appropriate, notified via email or banner.
Contact Us
Questions? Reach us at privacy@risely.ai