Who touches your data.
1. About This Page
To run its analysis features, Risos AI hands part of the processing to third-party providers. Under Personal Data Protection Law No. 27/2022 they are sub-processors: they process data on our instructions, not for their own purposes.
This page exists for one practical reason: when you upload an interview transcript, most of what you upload is someone else's data — your informant's. You are entitled to know where those text excerpts travel before you press any button.
Inside the product we deliberately do not display AI model names — we simply say "the assistant" or "the engine". This page is a deliberate exception, because it is about the providers themselves rather than about a feature. You cannot judge a privacy risk without names.
2. Sub-processor List
Every provider below is bound by business-tier terms that prohibit using your data to train their models.
| Provider | Data that reaches it | Processing location | Used for model training? |
|---|---|---|---|
| OpenAI | Text excerpts: chat conversations, research transcripts, analysis notes | United States | No |
| Anthropic | Text excerpts: chat conversations, research transcripts, writing drafts | United States | No |
| DeepSeek | Text excerpts: chat conversations, research transcripts, analysis notes | People's Republic of China | No |
| Groq | Text excerpts: short, low-latency tasks | United States | No |
| Google (Gemini) | Text excerpts and, if you use them, image files | United States and other regions where Google operates data centres | No |
| AssemblyAI | Interview audio files you upload, and the resulting transcripts | United States | No |
Beyond this list, two other parties process data that never contains transcripts: the payment gateways Tripay (QRIS) and NowPayments (crypto), which only receive a transaction reference and an amount.
3. Processing Locations & Transfer Basis
Your database records and files are stored on our servers in a Singapore data centre. That placement, and sending excerpts to the sub-processors above, constitutes a transfer of personal data outside Indonesia, governed by Personal Data Protection Law No. 27/2022 Article 56; placing electronic systems outside Indonesia is permitted for Private-Scope Electronic System Operators under Government Regulation No. 71/2019 Article 21. We remain subject to Indonesian law and guarantee data access for supervision and law enforcement by the competent Indonesian authorities.
4. When the Data Belongs to Your Informants
When you analyse a transcript, you are the controller of your informants' data and Risos is the processor. The basis for processing is the consent you obtained from your informants — not a basis of our own. Therefore:
- We ask about consent status and your ethics clearance reference before an analysis session begins, and we store your answer verbatim as a record.
- If you mark a session as holding sensitive data, anonymisation becomes a required item before raw text may be sent to any provider; if you still choose to send it as-is, that choice is recorded.
- In ordinary sessions anonymisation is offered once and your answer is recorded — we do not force it, but you never send informant data without knowing that you are sending it.
Details in the Privacy Policy §9.
5. Retention
Transcripts and recordings live as long as their analysis session lives. Deleting a session deletes its files from storage, not merely from a list. Machine work artefacts — cached results and context excerpts — are removed by a periodic sweeper, and diagnostic traces expire within 48 hours. The sub-processors above keep no permanent copies for their own purposes.
General account data retention is covered in Privacy Policy §6.
6. Changes to This List
This list may change when we add or replace a provider. Every change is recorded here with its effective date. Questions or objections: info@risos.id.