Privacy Policy

This policy explains how Mythril Systems Inc. ("Mythril", "we", or "us") handles personal information when you use Riley. Mythril provides Riley and is based at 103 Broadway Boulevard, Grand Falls, New Brunswick E3Z 2J6, Canada.

Personal information we collect

• Account information: your name, email address, account identifier, profile settings, authentication information, and sign-in records.
• Content you provide: messages, prompts, responses, files, images, photos, voice audio, transcripts, tool activity, workspace content, and profile memories or summaries derived from that content.
• Connected-service information: account identifiers, authorization status, and information needed to complete an action you request.
• Communications: information you include when you contact support, make a privacy request, or otherwise communicate with us.
• Usage information: feature activity, model usage, service limits, preferences, and operational timestamps.
• Device, network, and diagnostic information: device and app version, IP address, approximate location derived from IP, failures, performance data, security events, and service logs.
• Purchases and subscriptions: an opaque Riley subscription identifier, product identifier, transaction and subscription status, entitlement, renewal or expiry information, and related reconciliation events. Apple processes your payment details; Mythril and RevenueCat do not receive your full payment-card number from an App Store purchase.

We receive this information from you, automatically as Riley operates, and from services you choose to connect.

How we use personal information

We use personal information to provide and personalize Riley; authenticate and secure your account; produce chat, voice, memory, file, tool, and scheduled-work features; carry out connected-service actions you request; manage service limits and paid-plan entitlements; reconcile subscription status; diagnose failures; provide billing and technical support; prevent fraud, abuse, and security threats; comply with law; and improve the reliability and safety of the service.

Riley has no advertising, does not use advertising identifiers, does not sell personal information, and does not track you across other companies' apps or websites for advertising.

AI processing and consent

Riley sends the messages, files, photos, voice audio, and related context you choose to provide to service providers that supply AI and model processing, real-time voice, cloud infrastructure, and memory functions. This processing is used to produce the response or feature you request. Riley gives you a clear notice and asks for permission before this processing begins. Connected services are authorized separately.

You may withdraw optional AI permission in Account settings. Withdrawal stops future processing based on that permission, but the affected AI features will stop working. It does not undo processing completed before withdrawal or information that must be retained for legal or security reasons. Mythril does not use your content to train a Mythril general-purpose AI model. If we introduce an optional use of content for model improvement, we will describe it separately and provide an appropriate choice.

Disclosure of personal information

• Vendors and service providers: we disclose information to providers that help operate Riley, including providers of AI and voice processing, cloud hosting and storage, authentication, communications, customer support and email, analytics and diagnostics, subscription management, and security. RevenueCat receives the limited purchase and subscription information described above to verify purchases and keep Riley entitlements in sync. Apple provides app distribution, purchase, and billing services under Apple's terms and privacy practices.
• Services you connect: when you choose to connect or direct Riley to use another service, that service receives the information needed for the action you request and handles it under its own terms and privacy practices.
• Legal and safety reasons: we may disclose information when reasonably necessary to comply with law, respond to lawful process, prevent fraud or abuse, protect the security of Riley, or protect the rights and safety of users, Mythril, or others.
• Business transfers: information may be disclosed as part of a merger, financing, reorganization, sale of assets, or similar transaction, subject to appropriate confidentiality and legal safeguards.

Service providers may process information only for the functions described in this policy, subject to applicable safeguards. We remain accountable for personal information transferred to providers for processing.

Retention

We retain personal information only as long as reasonably needed to provide Riley, maintain security and business records, resolve disputes, and meet legal obligations. The period depends on the type of information, why it is needed, the sensitivity of the information, and any legal or security requirements.

After a verified permanent-deletion request, access is revoked and we aim to delete or de-identify active account data, conversations, files, memories, provider credentials, and the Riley-linked RevenueCat customer record within 30 days. Encrypted backups are removed on their normal rolling schedule, generally within 35 days, unless limited information must be retained longer for legal, fraud-prevention, security, dispute-resolution, or financial-recordkeeping purposes. Apple may retain App Store transaction and billing records under its own legal obligations and controls.

Data controls

You can manage profile settings, connected services, chat history, optional AI permission, and eligible App Store purchases from Riley. You can restore purchases or open Apple's subscription-management controls from Account settings. You can permanently delete your account in Account settings or follow the account deletion instructions. Deleting Riley does not cancel an Apple subscription; manage or cancel it separately through Apple. If a connected service keeps information in your own account, you may also need to remove that information or revoke Riley through that service.

Your rights

You may ask to access or correct your personal information, learn how it has been used or disclosed, withdraw consent subject to legal limits, request deletion, or challenge our compliance. We may need to verify your identity before fulfilling a request. You may also complain to our Privacy Officer using the contact details below.

Cross-border processing

Riley and its service providers may process personal information outside New Brunswick or Canada, including in the United States and other countries where providers operate. Information processed in another country is subject to that country's laws and may be accessible to courts, law-enforcement, or national-security authorities under lawful process. We use safeguards appropriate to the sensitivity of the information and remain accountable for information transferred for processing.

Security

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including access controls, encryption in transit and at rest where supported, credential protection, monitoring, backups, and incident-response procedures. No system can guarantee absolute security.

Cookies and similar technologies

Riley uses cookies and browser storage necessary for sign-in, security, language selection, and service operation. Riley does not use advertising cookies or cross-site advertising trackers.

Age requirement

Riley is intended for people who are at least 18 years old. We do not knowingly offer Riley to children.

Changes to this policy

We may update this policy when Riley or its data practices change. We will publish the revised policy and effective date and provide additional notice or request renewed consent when required.

Accountable organization and contact

Mythril Systems Inc. is responsible for Riley's privacy practices. Our Privacy Officer handles privacy questions, access or correction requests, complaints, consent withdrawal, and deletion requests:

We will investigate privacy complaints and explain our decision. If you are not satisfied, you may contact the Office of the Privacy Commissioner of Canada.