What we hold, and why

4Sight reads public information about a brand, a person or a plan and models how it will land. That means it processes personal data: yours, and sometimes someone else's. Here is the whole of it.

1. Who is responsible

The controller is Rizz Group, established in Latvia. Reach us at engine@vetted.rizzgroup.org. No data protection officer has been appointed; the scale of processing does not currently require one, and this page will change the day it does.

2. The two kinds of person in this system

Most privacy policies address one reader. This one has to address two, because the product would be dishonest otherwise.

• You, the account holder. You signed up, you typed the intake, you are reading this.
• The subject of a 4Sight. A founder, an executive, a company, a counterparty. They did not sign up. The engine reads public information about them. They still have full rights here, and section 8 tells them how to use them.

3. What is processed

About the account holder:

• Email address and display name, from signing up.
• Whatever you type or upload into an intake: notes, documents, links, images, audio.
• The 4Sights you run and the reports they produce.
• Sparring-partner conversations you have with a report.
• Credit balance and ledger entries, and payment references if you buy credits.
• Operational records: which stage ran, on which model, how long it took, what it cost.

About the subject of a 4Sight, where that subject is a person:

• Identifying details you supply: name, role, organisation, links.
• Publicly available information the engine finds: news coverage, public posts, filings, interviews, transcripts of public video.
• The analysis produced from that material, including risk assessments and simulated reactions.

4Sight does not ask for special-category data (health, beliefs, politics, sexuality, biometrics) and you should not put it into an intake. Where such material is unavoidably present in public reporting, the engine does not build a profile on it, and you can ask us to remove it.

4. Why, and on what lawful basis

5. The balancing note for vetting a third party

Assessing reputational exposure requires reading what is already public about a named person. That has a real cost to them, so the balancing test is written down rather than assumed.

• Our interest: due diligence before an investment, a hire, a partnership or a launch is a recognised and lawful commercial activity.
• Necessity: the assessment cannot be made without reading the public record about the specific person, and no less intrusive route produces it.
• Their expectations: the engine reads only material already published to the public. It does not scrape private accounts, buy data brokerage, infer protected characteristics, or attempt re-identification.
• Safeguards: reports are private to the account that ran them by default; sharing is explicit, revocable and token-bound; the engine is instructed to cite real sources or state honestly that it found none; reports and their material are deleted after the retention window.
• Their override: the right to object applies. Object under section 8 and we stop unless we can show compelling grounds, and we tell you which it was.

A 4Sight is a model of how information could be received. It is not a factual finding about anyone, and it must not be used as the sole basis for a decision producing legal or similarly significant effects on a person. No automated decision-making in the sense of Art. 22 takes place.

6. How long it is kept

An automated sweep enforces these windows. Deletion is not left to memory.

7. Who else sees it, and where

4Sight sells nothing to anyone and shares nothing for advertising. Data reaches a vendor only where that vendor performs part of the work. Each one is named, with its country and its agreement status, on the subprocessor register. There are 12 of them.

International transfers, stated plainly: the database is hosted in AWS Canada (Central), Montréal, Canada, which is outside the EU. That transfer rests on the European Commission adequacy decision for Canada (2002/2/EC), PIPEDA scope. Reasoning and search vendors in the United States rely on the EU-US Data Privacy Framework or on standard contractual clauses; the register shows which agreements are signed and which are still outstanding. We would rather show you an unsigned row than imply one exists.

8. Your rights

Under the GDPR you may request access, rectification, erasure, restriction, portability, and you may object to processing based on legitimate interests. Where processing rests on consent, you may withdraw it at any time without affecting what came before.

• If you hold an account: export any report from the report page, and erase your account and its contents from your account settings. Erasure is immediate and irreversible.
• If you were the subject of a 4Sight: you do not need an account. Use the data request channel. Every request is logged with a deadline and answered within one month.

If we get it wrong, you can complain to the Latvian Data State Inspectorate (Datu valsts inspekcija) or to the supervisory authority where you live.

9. Cookies

No analytics, no advertising pixels, no third-party trackers. The only storage written to your browser is the session token that keeps you signed in. It is strictly necessary for a service you asked for, so there is no banner to click.

10. Security

Encryption in transit and at rest, row-level access control enforced in the database, and a stated breach procedure. The detail, including the gaps, is on the security and hosting page.

11. Changes

When this policy changes materially, account holders are told by email before the change takes effect. The review date sits at the foot of every page here.

Last reviewed 2026-08-23 · Rizz Group, Latvia · engine@vetted.rizzgroup.org