Privacy Policy
Last updated: 18 August 2026 · Beta version
The promise, before the legal talk: RIKI is funded by subscriptions alone. We don't sell data, we don't run ads, we don't profile your children. Your family's memory serves one purpose only: making RIKI work for you.
1. Who is the data controller
The data controller is KHG International FZE LLC, a Free Zone company registered in Ajman, United Arab Emirates, licence and registration number 2627918062888, registered office: 26th Floor, Amber Gem Tower, Sheikh Khalifa Street, P.O. Box 4848, Ajman, United Arab Emirates. RIKI AI is a project of KHG International FZE LLC, currently in private beta. For any question or request about your data: hello@helloriki.com.
Although the company is based in the United Arab Emirates, we apply the EU General Data Protection Regulation (GDPR) to every family we serve, wherever they live: same rights, same protections, same limits on what we do with your data. Families in the UAE are also covered by Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.
2. What data we collect and why
| Data | When | Why |
|---|---|---|
| Waitlist email | When you join the waitlist on the site | To send you the beta invite and important news. Nothing else. |
| Account email and password | When you create an account | To sign you in. Your password is protected with cryptographic hashing (scrypt): not even we can read it. |
| Family profiles (names, approximate age, preferences) | When you introduce yourselves to RIKI | To personalise games, stories and tone of voice. Parents enter this information and can change or delete it at any time. |
| Voice conversations | While you talk with RIKI | Your voice is transmitted securely to the AI service (Google Gemini) to generate responses. RIKI keeps the meaning of the conversation in your family's memory (e.g. "Luca loves the blue dragon"), not the audio recordings. |
| Payment data | If you activate Premium | Handled entirely by Stripe, one of the world's leading payment providers. We never see or store your card number. |
| Technical session cookie | When you sign in to the app | One signed cookie, to remember it's you. No tracking or advertising cookies, so no annoying banners. |
3. Children's data
RIKI is designed for families with children, so we apply one simple principle: children do not create accounts, do not independently provide registration data and do not make decisions about processing. Parents create and control the family profiles and consent to the service on their children's behalf. A child's spoken conversation is of course processed by the service, and how that works is described below. Parents create the profiles, decide what RIKI knows and can delete everything at any moment. Adult features (settings, purchases, parents' zone) are PIN-protected and blocked when the system recognises a child's voice.
Sleep analysis, when you enable it, happens entirely on your device: the night's audio is processed locally and never sent or saved. Only the report remains in the diary (e.g. "3 snoring episodes").
4. Where the data goes
Each family's memory is isolated: no family can see another family's data. Data is hosted by qualified providers: Railway (application and memories), Netlify (website and waitlist), Stripe (payments), Google (AI conversation processing via the Gemini API, and reCAPTCHA on the waitlist form). Some of these providers may process data in the United States, under the safeguards provided by the GDPR (standard contractual clauses and the EU-US Data Privacy Framework).
One clarification, because it is the only third-party script on this site: the waitlist form is protected by Google reCAPTCHA, which checks that the person filling it in is not a bot. To do that it collects technical signals from the browser and sends them to Google, under Google's own privacy policy. It runs only on the waitlist form, never inside the app your children use, and it is there for one reason: without it the form was being filled by automated senders.
5. How long we keep it
For as long as your family uses RIKI. If you delete your account, your family's memory is erased. Before doing so you can export stories and memories as a PDF. Waitlist emails are deleted when you receive your invite or upon your request.
6. Your rights (GDPR)
At any time you can ask us for: access to your family's data, correction, full deletion, export in a readable format, and objection to or restriction of processing. Just email hello@helloriki.com: we reply within 30 days. You also have the right to lodge a complaint with your data protection authority: in the UAE the UAE Data Office, in Italy the Garante, or the authority of your country of residence.
7. What we don't do, in writing
We don't sell or rent data to third parties. We don't show ads, to you or to your children. We don't use your family's data to train AI models. We don't profile children for commercial purposes. If any of this were ever to change (it won't), we would tell you first, in plain language, and you could leave with all your data.
8. Updates to this policy
We're in beta: this policy may be updated as the service grows. Substantial changes will be communicated by email before they take effect. The most recent version always lives on this page.
← Back to the siteHow RIKI works out who is speaking
RIKI adapts its tone and permissions to whoever is talking. It does this by inference: the model uses the audio of the conversation and, when the camera is on, the visual context, together with short text descriptions a parent can review and correct at any time (for example "adult woman, long dark hair, glasses"). RIKI does not create, compute or store biometric voiceprints or facial-recognition templates, and it does not use identity signals for advertising or profiling. Attribution can be wrong; that is why a parent can always correct it, and why adult-only features stay behind a PIN rather than relying on recognition alone.