Privacy Policy

Riabo is operated by Arukas Limited, with registered office at Sakura, Crossneen, Carlow, Ireland.

Privacy questions: hello@arukas.ie.

Depending on how you use Riabo, we may process:

• Account details — such as name, email address and password (stored securely by our authentication provider).
• Organisation details — such as organisation name, settings, staff roles and membership information.
• Work content — actions, assignments, submissions, comments, templates and related records entered by your organisation.
• File metadata and links — records that connect uploaded evidence to the right organisation and piece of work. Evidence files themselves are stored in your organisation’s connected Google Drive account when that feature is used.
• Branding assets — such as a logo uploaded for your organisation.
• Billing and licence information — purchase and activation details needed to provide access (payment card details are handled by Stripe, not stored by Riabo).
• Contact messages — if you write to us through the contact form or by email.
• Technical information — such as authentication session data needed to keep you signed in securely.

We do not run advertising analytics cookies or third-party advertising trackers on the Riabo website.

We use personal information to:

• create and manage accounts and organisations
• provide Riabo’s features and keep the service secure
• send operational messages such as invitations and reminders
• process licence purchases and activation
• respond to support and contact requests
• improve reliability and fix problems
• meet legal obligations where they apply

Where the GDPR applies, we rely on one or more of these bases:

• Contract — to provide Riabo to the organisation that signed up or purchased a licence.
• Legitimate interests — such as securing the service, preventing abuse and improving reliability, where those interests are not overridden by your rights.
• Legal obligation — where we must keep or disclose information to comply with the law.
• Consent — where we ask for it (for example, if an organisation connects Google Drive and authorises access).

Where an organisation uses Riabo with staff or pupil-related content, that organisation typically decides what to enter and acts as a controller for that content. See our Data Processing Information.

Content entered into an organisation’s Riabo workspace belongs to that organisation. Members only access organisations they belong to, and access is limited by role.

Evidence files uploaded through Riabo’s Google Drive connection are stored in the organisation’s own Google Drive account. Riabo keeps the related records and links needed to show those files in context.

We use trusted service providers to operate Riabo. Depending on the feature, these may include:

• Supabase — authentication, database and private storage used for features such as organisation branding (hosted in the EU).
• Stripe — payment processing for licence purchases.
• Google — when an organisation connects Google Drive for evidence storage (files remain in that organisation’s Google account).
• Hosting and email delivery providers — used to run the Riabo application and send operational messages such as invitations, reminders and purchase confirmations.

We do not sell personal information.

We keep personal information while an organisation’s account is active and for as long as needed to provide the service, resolve disputes, enforce our agreements and meet legal requirements.

If a subscription ends, the organisation may become read-only. Information is not automatically deleted at that point. If you want an account closed or personal data deleted, contact us and we will handle the request in line with this policy and applicable law.

We do not currently publish a single fixed retention period for all organisation data, because retention depends on the type of record and the organisation’s ongoing use of Riabo.

Core application data is hosted with Supabase in the EU. Some providers (for example payment or connected Google services) may process information in other countries under their own terms and safeguards.

Where international transfers occur, we take steps appropriate to the service involved and the protections available from that provider.

Riabo uses essential cookies needed for secure sign-in and session management. We do not use advertising cookies. Full details are in our Cookie Policy.

We use practical safeguards such as organisation separation, role-based access, encrypted transport (HTTPS) and secured authentication sessions. More detail is on our Security & Privacy page.

No online service can promise perfect security. Please use strong, unique passwords and remove access when staff leave.

Depending on applicable law (including the GDPR where it applies), you may have rights to access, correct, delete, restrict or object to certain processing, and to data portability.

To exercise these rights, email hello@arukas.ie. If you are a staff member of an organisation using Riabo, it is often best to contact your organisation first, because they control much of the content in their workspace.

You may also have the right to complain to the Data Protection Commission in Ireland if you believe your rights have not been respected.

Riabo is designed for organisations and their staff. It is not directed at children as end users. Organisations remain responsible for deciding what information they enter into Riabo and for complying with their own child-protection and data-protection duties.

We may update this Privacy Policy as Riabo evolves. The “Last updated” date at the top of this page will change when we do.

Arukas Limited
Sakura, Crossneen, Carlow, Ireland

Email: hello@arukas.ie

Or use our contact form.