# Ristmark — Privacy Policy

**Last updated 21 October 2026 · Version 2026-10-21**

Ristmark is offered for business use, including sole traders. This notice explains personal data handled through Ristmark, including account creation, the hosted application, payment and support. The [terms and data-processing annex](/terms) set out our contractual obligations. You can [download this notice](/legal/2026-10-21/privacy.txt).

## 1. Responsible company and contact

**NUTLET SIA**, trading as Ristmark, registration **40203464033**, VAT **LV40203464033**, Pļavu iela 6, Sēbruciems, Babītes pag., Mārupes nov., LV-2107, Latvia, is responsible for the controller processing described here. Write to **support@ristmark.app** for privacy requests and concerns. We have not appointed a data protection officer; the SIA's service operator handles these requests.

## 2. Roles depend on the purpose

For personal data in documents, templates, saved block recipes, source images, input data and review corrections, we process on the customer's instructions under **Annex A to the terms**. The customer is a controller or a processor acting for another controller; we are its processor or sub-processor accordingly. Support troubleshooting of that content remains within the same instructed processing.

We are controller for account and membership administration, recording agreement, billing administration, service security and administering support correspondence. A support attachment does not become our controller data merely because it arrived by email: its use and purpose determine the role. Payment and identity providers may also act independently for specified legal/security purposes under their own notices; the [recipient list](/subprocessors) identifies those relationships.

## 3. Data, sources, purposes and legal grounds

| Data and source | Purpose | Our role and ground |
|---|---|---|
| Sign-in identifier, email and profile details from you/your identity provider | Create and authenticate your account | Controller: contract with an individual customer; legitimate interests in operating an organisation's account for its users |
| Workspace/customer name, membership, role and invitation address supplied by you or a workspace administrator | Administer access and invitations | Controller: contract where applicable; legitimate interests in providing and securing shared workspaces |
| Contract version, accepting identity, customer name, business-purpose declaration and acceptance time | Evidence the agreement and resolve contractual questions | Controller: contract and legitimate interests in keeping proportionate evidence |
| Billing details, tax information and transaction/invoice references from you and the payment provider | Process purchases, invoices, tax and refunds | Controller: contract; legal obligations for tax/accounting records |
| Support correspondence and contact details from you | Answer requests and administer the relationship | Controller: contract or legitimate interests in resolving support issues; document-content troubleshooting follows your instructions |
| Usage counters and job/account events generated by the service | Apply purchased limits and investigate errors | Controller: contract for individual customers; legitimate interests in accurate billing, reliability and abuse prevention for organisation users |
| Connection/request metadata and diagnostic events, including identifiers, sanitised routes, timestamps and error stacks | Security, fault diagnosis and maintaining the requested service | Controller: legitimate interests in protecting and operating the service |
| Documents, images, templates, saved block recipes, sample data, generated content and reviewer corrections supplied by customers | Migrate, edit, consolidate, generate and troubleshoot documents | Processor/sub-processor: the customer determines lawful grounds and instructions under Annex A |

Required sign-in and workspace details let us create and secure your account; without them we cannot provide the associated feature. Billing/address information is required to process a purchase and determine tax; a VAT number is optional. Document content is supplied at your choice, but the selected operation needs its input. Other correspondence and optional profile information are voluntary. We do not purchase marketing lists or obtain personal data from data brokers.

Browser errors may include a sanitised stack and a short sequence of routes, failed requests and controls activated. Reports can occur before sign-in and when a page closes. We avoid document bodies in logs and mask specified sensitive patterns; this is not a guarantee that no unforeseen personal data can ever enter a diagnostic record. Our error provider may add connection IP metadata even when our submitted report omits an IP address.

We do not use personal data for advertising profiles or decisions intended to produce legal or similarly significant effects without human review. Customers must assess their own uses of generated documents separately.

## 4. AI processing and sensitive content

Migration sends page images and reconstructed text to the AI provider identified in the recipient list. Anything visible in those pages, including sensitive personal data, may therefore reach that provider. AI reconstructs layout and applies proposed field bindings to a draft before the customer reviews it. Confidence scores can be wrong. Editing and document generation after template creation do not require an AI call for those operations.

We do not use customer content or corrections to train, fine-tune or evaluate shared AI models. Workspace corrections are used within that workspace. The AI provider's commercial API terms address training and retention. Its [published API policy](https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data) describes deletion within 30 days, with exceptions for separately agreed terms, services with longer customer-controlled retention, usage-policy enforcement and law. We do not claim zero retention or a universal 30-day maximum. When a deletion instruction covers content the provider may still hold, we carry it through the processing chain rather than only forwarding a request.

The standard service **excludes special-category personal data, criminal-offence records and similarly regulated sensitive data**, as described in section 16 of the terms. It also excludes payment-card data, passwords/private access keys and processing requiring an unagreed sector-specific arrangement, including a HIPAA business associate agreement. Ordinary business contact, invoice and contract data remains permitted if it does not contain excluded categories. These limits also apply to support attachments and names/labels entered in the service. We do not claim to automatically detect or remove every excluded item. If such data arrives inadvertently, we restrict its use, assess required incident/rights actions and arrange return or deletion; our protection duties still apply. Contact support without resending the content. Any later expansion requires separate written coverage and safeguards before processing.

## 5. Browser storage and cookies

The application uses browser storage to authenticate you, preserve requested work and remember display choices. We use storage needed to provide the features you request. Where a storage use requires consent, we must obtain it before that use begins. We do not install advertising or third-party analytics scripts.

| Storage | Purpose and lifetime |
|---|---|
| HttpOnly asset-grant cookie | Authorises workspace image/font/PDF requests; ordinary grants expire after 30 minutes and operator grants after 15 minutes. The cookie may carry grants for more than one open workspace |
| Sign-in state and OIDC tokens in localStorage | Shares login across tabs and can survive browser restart; explicitly sign out on shared devices. Credentials remain subject to server expiry/revocation |
| Redirect-return state and operator-impersonation state in sessionStorage | Completes a particular sign-in or operator session; scoped to the tab and cleared by the relevant flow or browser tab lifecycle |
| Pending purchase/plan state | Resumes a requested purchase across navigation; cleared when consumed or when account state is cleared |
| Review drafts, including field corrections and sample values, in localStorage | Recovers unfinished document review on that device; removed by successful save/approval or restart and on sign-out/account changes; browser site-data clearing also removes them |
| Theme, pane sizes/collapse, template-list view, tracing selection and onboarding/dismissal state | Remembers choices for the requested editor/navigation features; retained until reset, replaced or browser data is cleared |

Closing a browser is not sign-out. Server-side workspace deletion does not remotely erase every device's stored copy. On a shared device, sign out and clear site data if needed. An asset grant for a different workspace can remain until its short expiry; document links are not public access grants.

The identity provider's sign-in pages and our edge network may set their own cookies for sign-in sessions and protection against abuse. We do not set advertising or analytics cookies, and any cookie that is not strictly necessary is used only with the consent the law requires. Necessary storage is described here even where consent is not required. The browser's diagnostic visit identifier is held in memory, not persistent localStorage.

## 6. Recipients and changes

The [recipient list](/subprocessors) identifies direct and indirect processors/sub-processors, purposes, data, locations and transfer safeguards. Our service operator and authorised personnel may access data as needed for support, security and administration under confidentiality and access controls.

We send active written notice to the Owner/designated contact at least **30 days before** adding or replacing a content sub-processor we engage directly. For changes further down a provider's chain, we pass on its notice promptly before affected processing and provide a reasonable opportunity to object; that period may be shorter. We also update the list. During an unresolved objection we do not send the affected data to the disputed recipient and suspend affected processing if needed. Urgent replacements use an already-authorised recipient, specific prior permission or suspension. Annex A sets out the notice arrangements and remedies; mandatory rights remain available.

We send customer personal data to a recipient only once the required data-processing agreement and transfer safeguards are in place.

## 7. International transfers

Some recipients are outside the EEA or permit access from outside it. Storage in an EU region does not by itself settle all access and transfer questions. Edge/CDN processing is not confined to the EU.

The recipient list identifies the safeguard for each recipient, such as the Standard Contractual Clauses with any necessary additional measures, or an adequacy decision. Request a copy or description of the relevant safeguards at support@ristmark.app. UK-origin restricted transfers require a mechanism valid under UK rules where applicable.

## 8. Retention

We retain data only for the relevant service, legal obligation or substantiated claim, with restricted retention after the original purpose ends. The following distinguishes automatic mechanisms from records requiring operator/provider action.

| Category | Retention or criterion |
|---|---|
| Active workspace content and membership | While the workspace service continues and the content is needed; customer instructions and applicable rights can require earlier removal |
| Workspace requested for deletion | 30-day cancellable grace, followed by scheduled erasure in batches/retries; grace expiry is not an assertion that all copies disappear at that instant |
| Deleted templates | 90 days in trash before scheduled purge |
| Saved block recipes | Separate copies kept in the selected team library until a team manager deletes them or the workspace is erased. Recipe deletion has no trash period. Deleting a source template leaves saved recipes and their picture references in place |
| Generated PDF, DOCX and HTML exports | Streamed to you; no separate server archive of the generated export. Keep downloaded copies. Templates, sample data and stored source assets follow their own rows |
| Completed import jobs/events and associated job input | Normally 30 days after completion, subject to scheduled cleanup |
| Source-original assets / source-page images / reconstruction HTML | Default age-based cleanup thresholds of 90 / 30 / 14 days from writing. Cleanup can be delayed by document/version references, ongoing import or review, trash protection and scheduled retries; these are not maximum retention periods. Earlier instructed deletion is handled separately |
| Images, base PDFs, fonts and reference documents | No separate automatic age expiry. Template purge targets associated images, base PDFs and fonts; reference documents and other unlinked assets can remain for workspace erasure or operator cleanup |
| Reviewer decisions/spans | Workspace lifetime; template deletion alone can unlink rather than remove them |
| Application logs / server and browser error reports | 3 days / 90 days at the logging provider |
| Support correspondence/attachments | A support request, with its messages and attachments, is deleted automatically 12 months after it is resolved (a request we have put on hold with a recorded reason, such as a dispute, is kept until the hold is released); a request still open after 12 months is reviewed by a person, who resolves it or records why it stays open. Copies that reached our support mailbox are deleted on the same schedule by an operator review, not automatic mailbox expiry. Necessary dispute or accounting evidence may be kept longer |
| Identity-provider records | For authentication/security purposes and the provider's configured log window; workspace deletion alone does not delete an identity used elsewhere. Account deletion is handled separately |
| Contract acceptance and dispute evidence | For the agreement and the applicable claim/limitation period, with periodic review; not an unlimited right to retain document content |
| Invoices and accounting evidence | Under the SIA's legal retention obligations: ordinarily at least 5 years for other source documents and 10 years for accounting registers, with applicable longer/special rules; payment-provider hosting does not transfer that duty away from us |
| Transactional-mail delivery records and billing identity | While needed for delivery/reconciliation, legal retention or substantiated claims; operator review and third-party deletion are required |

Deletion jobs can take time to finish and may need retries. Records held by suppliers or in support mail also need follow-up. Ask support about earlier removal, a specific category or the progress of your request.

## 9. Copies and records outside ordinary workspace deletion

Off-site backups are held under a 30-day object lock. Our policy is to retire them within 180 days, but we have not yet verified that every stored version is removed on that schedule, so we do not state a maximum lifetime for backup copies. Backups are isolated from ordinary use, and outstanding deletions are re-applied before any restored data returns to service.

So that a restored backup cannot bring an erased workspace back, each erasure writes an entry to an erasure register held in our object storage outside the database and copied with the off-site backups. An entry holds the workspace and member identifiers, the storage location to clear and the erasure date, never document content. Entries currently have no end date, because removing one would let a later restore bring that workspace back; we will set a limit once backups have a verified maximum lifetime.

Workspace deletion does not itself remove independent billing/legal records, provider-held identity or AI data, every browser copy, or the erasure audit. We restrict surviving records to their necessary purpose, action third-party requests where required and verify completion appropriately. The erasure audit contains identifiers, dates/counts and a minimised billing pointer, not document bodies. Legal retention is assessed by category, not asserted as a blanket exemption.

## 10. Legal demands and business transfer

We assess legal demands, disclose only what applicable law permits/requires, and notify affected parties unless prohibited. A foreign order does not automatically authorise an international transfer. If the business is transferred, necessary data may pass to the successor subject to lawful grounds, confidentiality, notice and unchanged applicable rights. Further incompatible use requires its own lawful basis.

## 11. Incidents

Report suspected security or personal-data incidents to support@ristmark.app. The service operator follows the incident procedure under the SIA's responsibility. For controller data, applicable regulator notification is generally due within 72 hours of awareness where required, and affected individuals are notified without undue delay where the legal high-risk test is met. For customer content, we notify the customer without undue delay and assist its response; we do not wait for a finished investigation.

## 12. GDPR rights

For data we control you may request access/copies, correction, erasure, restriction and portability where applicable. Portability includes direct transmission where technically feasible and legally required; otherwise we provide a suitable machine-readable copy. You may withdraw consent for processing based on it without affecting prior lawful processing. Ordinary account/support/security processing uses the grounds above, not blanket consent to this notice.

**Right to object.** You may object to legitimate-interests processing on grounds relating to your situation. We assess the request and stop unless we demonstrate overriding grounds or a lawful claims reason. If we introduce direct marketing, the objection to that use is unconditional. We do not automatically reject objections to security or diagnostic records.

You may complain to Latvia's [Data State Inspectorate](https://www.dvi.gov.lv/en) or the supervisory authority available to you, including where you live or work. For customer-controlled content contact the customer/controller; if a request reaches us we route it and assist without unnecessarily disclosing another person's identity or content.

## 13. California

Where California privacy law applies, residents may request to know/access categories and specific pieces of information, delete, correct and receive a readily usable portable copy, and may exercise applicable sale/sharing and sensitive-information rights without prohibited discrimination. The data categories above include identifiers, commercial information, electronic/network activity and permitted content selected by customers. Excluded sensitive information may also reach us inadvertently and remains protected as described below. Sources, purposes, recipient categories and retention are described above. Business users are not excluded merely because they use the service for work; statutory business applicability must still be assessed.

We do not use customer information for cross-context behavioural advertising or operate a data-selling business. We would not begin a sale or sharing of personal information without first giving the required notice and opt-out, including honouring opt-out preference signals.

For information handled for a customer, Annex A's US provisions limit our use and require cooperation, monitoring/remediation and downstream protections. Sensitive document information is excluded from the standard service. If it reaches us inadvertently, we protect it, assess the disclosure and arrange lawful return or deletion; we do not use it for unrelated profiling or marketing. Any separately agreed future processing must satisfy the applicable sensitive-information restrictions and supplier requirements. An authorised agent may request on your behalf with appropriate proof. California access portability is not limited to data processed under GDPR contract/consent grounds.

## 14. Other jurisdictions

Other US states and countries may provide privacy rights subject to their own scope rules, including exceptions for some employment/business contexts. We assess the applicable law instead of assuming every user is an employee. Where applicable, request an appeal of a refusal by replying to support; we explain the outcome and available regulator contact. We do not currently offer the service to businesses established in the United Kingdom. Where UK data-protection law nevertheless applies to our processing, the rights it provides apply.

## 15. Requests and response times

Email **support@ristmark.app**, identifying the request and enough information to find the relevant account. We verify identity and authority proportionately and minimise any additional evidence collected. We do not ask for passwords or payment-card secrets. Requests are normally free, subject only to lawful exceptions.

We respond to GDPR requests within one month, with a permitted extension of up to two further months explained within the first month. California access/deletion/correction requests generally receive acknowledgement within 10 business days and a substantive response within 45 calendar days, with a permitted additional 45 days and notice. Shorter applicable opt-out deadlines and other local deadlines prevail. If we cannot act, we explain why and the relevant complaint/appeal route.

## 16. Security

The dated security schedule is **Annex B to the terms**. Measures include server-side workspace authorisation, restricted database credentials, digested API keys, short-lived file grants, transport/browser protections, minimised diagnostics and audited operator access. Backups are encrypted but currently operator-run. We maintain incident, rights and retention procedures. These are controls and obligations, not a claim of perfect security, SOC 2/ISO certification, guaranteed recovery time or regulatory suitability for every use. Request evidence appropriate to your intended permitted processing. Sensitive information remains excluded unless separately agreed in writing with the required supplier coverage and safeguards.

## 17. Children and vulnerable individuals

The contracting customer must have legal capacity. Documents may lawfully contain children's or vulnerable individuals' data; account-age restrictions do not imply that such content is never processed. Do not supply unnecessary information. If an account or document involves unlawful collection, contact support so that we can investigate and act under the appropriate controller/processor role.

## 18. Changes

**21 October 2026:** version aligned with the terms (generation is now charged per rendered page at the rate on the pricing page); no change to how we use your data.

**10 October 2026:** version aligned with the terms (generation now costs one credit per two rendered pages); no change to how we use your data.

**9 October 2026:** support requests: we now state that a request, with its messages and attachments, is deleted 12 months after it is resolved (attachments are no longer removed separately after 30 days), and that a request still open after 12 months is reviewed by a person.

**8 October 2026:** version aligned with the terms (template export now through the API or an in-app request); no change to how we use your data.

**7 October 2026:** the service is no longer offered to businesses established in the United Kingdom; described the erasure register kept beside backups, stated cookie use and transfer safeguards plainly, and corrected the download link to this version. No new use of your content.

**3 October 2026:** version aligned with the terms; no change to this notice's substance.

**29 September 2026:** clarified saved block recipes, generated-export storage, support retention and the outstanding UK representative assessment. This update does not introduce a new use of your content.

We date and describe material changes to this notice and provide advance information where required before a new purpose or materially changed processing begins. A new notice does not itself supply consent or authorise incompatible processing. Contract changes and sub-processor authorisation follow the separate terms. Previously issued versions remain available for reference.

## 19. Contact

**support@ristmark.app** · NUTLET SIA, registration 40203464033, VAT LV40203464033 · Pļavu iela 6, Sēbruciems, Babītes pag., Mārupes nov., LV-2107, Latvia.