Privacy Policy

Last updated: October 28, 2026

This policy explains, in plain language, which personal data Risplo processes, why, for how long and with whom, under Brazil's General Data Protection Law (LGPD, Law 13,709/2018), the Brazilian Internet Civil Framework (Marco Civil, Law 12,965/2014) and, where applicable, the GDPR.

1. Who is responsible

Risplo is a product of NS3, which develops, maintains and operates it.

2. In short

• Calls are never recorded without notice. Only the room host can record or generate meeting notes, and every participant sees a "Recording" notice for the whole capture.
• No ads and no third-party trackers. We don't use advertising pixels, Google Analytics or similar tools. The usage records described below stay in NS3's own systems.
• We don't sell data or share it for marketing.
• AI done in-house. Transcripts and meeting notes are produced on NS3's own servers in Brazil — meeting content is not sent to third-party AI services.

3. What data we process

3.1 During a call

Audio, video, screen sharing and chat messages go through Risplo's media server, which relays them between participants. Traffic is encrypted in transit (DTLS-SRTP and TLS). There is no end-to-end encryption: the server processes the stream to deliver it, but does not store it, except when the host records (section 3.4). Chat is not kept: it disappears when the call ends.

The name you type to join stays only in your browser and in the call session. In regular rooms it is not kept after the call ends (exception: partner rooms, section 5).

3.2 Account and subscription (optional)

Anonymous rooms require no sign-up. If you create an account, we store your email, name (if provided), password (only as an irreversible hash) and plan. Subscriptions are paid through Stripe: card details go straight to Stripe and never touch our servers. We send Stripe your email, name and an account identifier so it can bill you.

3.3 Access and security records

When you use Risplo — sign up, log in, create or join a room, start a recording, subscribe — we record:

• IP address, date and time;
• approximate location, at city level, and the carrier/network, derived from the IP (DB-IP database);
• browser, operating system and whether you're on a phone;
• the action and its result (for example, "login with wrong password"), and the account and room involved;
• where the visit came from (the website or campaign that brought you to Risplo), using a session cookie;
• for failed login attempts, an irreversible code (hash) of the email typed — never the email itself — to detect attacks on accounts.

We use these records to protect the service and accounts, prevent fraud and abuse, meet the legal duty to keep access records, and understand where our users come from. They stay in NS3's internal system, visible only to the team with access to Risplo's administration.

We also measure the technical quality of calls and of joining rooms (duration, packet loss, resolution, whether camera and microphone were allowed, browser and system). These measurements contain no IP, name, room or account.

3.4 Recordings, transcripts and meeting notes

The room host decides to record or to generate notes, and is responsible for having a legal basis to do so — for example, informing participants and getting their agreement. Risplo shows a "Recording" notice to everyone for the whole capture.

• The recorded video is available only to the host for 24 hours and is then deleted.
• In notes mode, the audio is deleted as soon as the transcript is ready.
• The transcript and notes are kept for 12 months for the host to consult, and can be deleted earlier on request.

Recordings are stored on Magalu Cloud, in Brazil. Transcription (Whisper) and notes (a language model) run on NS3's servers.

4. Why we may process this data (legal bases)

• Performance of a contract (LGPD, art. 7, V): to provide the call service and keep your account and subscription.
• Legal obligation (art. 7, II): to keep access records for 6 months (Marco Civil, art. 15) and tax records for the period the law requires.
• Legitimate interest (art. 7, IX, and art. 10): security, fraud and abuse prevention, quality measurement and visit origin — always with minimal data and no automated decisions that affect you.

5. Partner rooms

Partner companies (for example, WeeChat) can open Risplo rooms inside their own systems. In that case the partner is the controller of the data of the people it invites, and Risplo processes that data on the partner's behalf. The partner sends us each participant's name and an identifier; Risplo returns to the partner who joined and left (with times), the recordings and, if the host asked, the transcript and notes. We keep participant names and times and the history of these deliveries for 12 months. To exercise your rights over this data, you can contact the partner or us.

6. Who we share data with

We use these providers to run the service, each with only what it needs:

The only international transfer is to Stripe, for payments, backed by Stripe's contractual safeguards (LGPD, art. 33). We may also provide data to authorities when the law or a court order requires it.

7. How long we keep data

8. Cookies and browser storage

We use a single first-party session cookie, rsp_o (it disappears when you close the browser), which stores where the visit came from. We use no advertising or third-party cookies.

The app also stores in your own browser (local storage) your account login, your camera, microphone, background, theme and language preferences, and the name you used to join a room. These items are sent to no one but Risplo, and you can delete them by clearing the site's data in your browser.

9. Children and teenagers

Risplo is not intended for children under 13. Teenagers aged 13 to 18 should use it with the knowledge and supervision of their parents, guardians or school. If we learn that we have processed a child's data without a guardian's consent, we will delete it.

10. Security

We use encryption in transit (TLS and DTLS-SRTP), hashed passwords, access restricted to the team that runs the service, and our own servers to process recordings. No system is infallible; if a security incident may pose a significant risk to you, we will notify you and Brazil's National Data Protection Authority (ANPD).

11. Your rights

Under the LGPD (art. 18) and, where applicable, the GDPR, you may at any time: confirm whether we process your data and access it; correct incomplete or wrong data; request anonymization, blocking or deletion of unnecessary data; request portability; request deletion of your account and of data processed based on your consent; learn who we share data with; and object to processing based on legitimate interest.

To do so, write to suporte@ns3info.com.br from your account's email (or stating the room or recording concerned). We reply within 15 days. Some data may be kept after a request when the law requires it — for example, access records for the 6 months set by the Marco Civil. You can also file a complaint with the ANPD (gov.br/anpd) or with your local data protection authority.

12. Changes

This policy may change as the service changes. The date at the top shows the version in force; relevant changes will be highlighted on this page.