RIA™ Privacy Policy

1. Overview

`Resilience Intelligence Advantage (RIA) ("we," "our," or "us") operates the RIA™ platform ("RIA" or the "Platform"). This Privacy Policy explains how we collect, use, share, and protect information when government entities, organizations, or individuals ("Users" or "you") access or use RIA.

RIA is designed to minimize personal data collection. We do not sell Personal Data, share Personal Data for advertising, or use Personal Data to train AI models.

This Policy applies to all use of the RIA platform and related services.

2. Information We Collect

2.1 Information You Provide Voluntarily

When creating or managing accounts, Users may provide:

• First and last name
• Email address
• Role or department
• Optional notes, tags, or internal comments
• User-generated content such as project notes or data entries

2.2 Automatically Collected Information

RIA logs limited information necessary for security and system performance:

• IP address and browser information
• Login date and time
• User actions (e.g., report generation, page views)
• System performance and diagnostic data
• Device type and operating system

2.3 Government or Organizational Data

Customers may upload or input non-personal data related to:

• Infrastructure
• Climate or hazard information
• Resilience actions
• Organizational processes
• Geospatial information
• Project-level notes

RIA treats all customer data as confidential.

3. How We Use Information

We use information only to:

• Authenticate Users and manage accounts
• Operate, maintain, and improve RIA
• Detect misuse or security threats
• Provide technical support
• Comply with applicable law
• Analyze usage patterns to improve functionality and user experience
• Maintain system performance and reliability

RIA does not:

• Sell Personal Data
• Rent or trade Personal Data
• Use Personal Data for advertising or marketing
• Use User data to train AI or machine-learning models
• Combine Personal Data across customers

4. Legal Basis for Processing (Government Entities)

When RIA provides services to state or local governments, we act as a Processor, processing data according to the Customer's instructions, as described in:

• This Privacy Policy
• The Terms of Use
• Any applicable Data Processing Addendum (DPA)
• The government contract or subscription agreement

RIA follows government privacy and data protection requirements.

5. How We Share Information

RIA shares Personal Data only in the following situations:

5.1 With Approved Subprocessors

We use service providers ("Subprocessors") to support:

• Hosting
• Cybersecurity
• Monitoring
• Email delivery
• Customer support

All Subprocessors are bound by confidentiality and security requirements. A current list is available upon request.

5.2 With Government Customers

Customer administrators may view:

• Account information for their Users
• Activity logs
• Data entered by staff
• Reports generated by their Users

RIA does not share data between customers.

5.3 Legal Compliance

RIA may disclose data if required by:

• Law
• Judicial process
• Public records laws (FOIA), after review

RIA will not disclose proprietary RIA materials, trade secrets, algorithms, or source code under FOIA or similar laws.

5.4 Business Transactions

If RIA undergoes a merger, acquisition, or sale of assets, data may be transferred to the acquiring entity. Any such entity will be required to maintain privacy protections at least as strong as those in this Policy.

6. Data Retention

RIA retains Personal Data only for:

• The duration of the subscription
• Required legal or audit periods
• Security and fraud prevention
• System integrity and maintenance

Upon termination, Customers may request deletion or anonymization of Personal Data. RIA may retain de-identified or aggregated data that cannot reasonably identify an individual.

7. Data Security

RIA uses administrative, technical, and physical safeguards, including:

• Secure cloud infrastructure
• Encryption in transit
• Password and identity management
• Role-based access controls
• Logging and monitoring
• Annual security training
• Incident response processes

No system is fully secure. RIA will notify affected Customers of a confirmed breach without unreasonable delay.

8. Cookies and Tracking

RIA uses limited cookies and similar technologies solely to:

• Authenticate sessions
• Maintain platform performance
• Enhance security

RIA does not use cookies for advertising or cross-site tracking.

9. Children's Privacy

RIA is not intended for children under 16. RIA does not knowingly collect Personal Data from children.

10. Government Records & FOIA

RIA understands some Customers are subject to public records laws. RIA will assist with lawful requests while protecting:

• RIA trade secrets
• Proprietary datasets
• Scoring logic
• Algorithms
• Source code
• Internal methodologies
• Confidential information of other Customers

11. International Use

RIA is intended for U.S.-based government and organizational use. All data is stored and processed in the United States, unless otherwise required by contract.

12. Your Rights

Depending on your jurisdiction, you may have rights to:

• Request access to your Personal Data
• Request correction
• Request deletion (subject to government retention laws)
• Limit processing for certain purposes
• Receive clear information about Subprocessors

RIA honors data rights requests through the Customer (government entity) when acting as a Processor.

13. No AI Training

RIA does not use:

• Personal Data
• Customer data
• Project notes
• Uploaded datasets
• Platform analytics
• Usage logs

to train AI or machine-learning models, including internal or external AI systems.

14. Changes to This Privacy Policy

RIA may update this Privacy Policy from time to time. We will post any changes within the Platform and update the Effective Date.

15. Contact Us

For questions about this Privacy Policy or data practices: