← Back to home

Privacy Policy

Last updated: June 1, 2026

1. Who we are

Riches is operated by Tatiana V ("we", "us", "our"). We act as the data controller for personal data processed through this service. You can reach us at the contact details published on this website.

2. Data we collect

  • Account data: email address, display name, password hash, authentication identifiers (including Google sign-in identifiers when used).
  • Profile and product data: your definite chief aim, target date, daily habit and ritual completion records.
  • Support and communications: messages you send us and email engagement signals (delivery, bounce, unsubscribe).
  • Technical data: IP address, device and browser information, log data, and basic usage telemetry needed to operate the service securely.
  • Gift and payment metadata: transaction identifier, amount, currency, status, and optional message. Card details are collected and stored exclusively by our payment provider, Paddle — we never see or store them.

3. Why we process it and on what basis

  • Provide the service (contract): account creation, sign-in, habit tracking, sending gift receipts.
  • Security and fraud prevention (legitimate interests): protecting accounts and the platform.
  • Service improvement (legitimate interests): aggregated, non-identifying usage analytics.
  • Legal compliance (legal obligation): tax, accounting and responding to lawful requests.
  • Customer support (legitimate interests / contract): responding to your inquiries.

4. Who we share data with

  • Paddle.com Market Ltd ("Paddle") — our Merchant of Record for all orders. Paddle processes payments, manages billing, calculates and remits taxes, issues invoices, and handles refunds and related customer inquiries. See Paddle's privacy notice.
  • Infrastructure and tooling subprocessors — hosting, database, email delivery, error monitoring and analytics, used solely to operate the service.
  • Professional advisers — legal, accounting and similar advisers, where reasonably necessary.
  • Authorities — where required by law or to protect our rights, users, or the public.

5. Retention

We keep personal data only for as long as needed for the purposes above. Account data is retained while your account is active and deleted (or anonymised) after account deletion, subject to legal retention requirements (for example, tax records related to gifts).

6. Your rights

Subject to applicable law, you may request access, rectification, deletion, restriction, portability, or object to certain processing, and withdraw consent at any time. UK/EEA users may lodge a complaint with their supervisory authority. To exercise a right, contact us using the details above. We respond within one month where required by law.

7. International transfers

Where personal data is transferred outside your country, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses with our providers.

8. Security

We apply reasonable technical and organisational measures, including encryption in transit, access controls, and least-privilege server credentials. No system is fully secure; we cannot guarantee absolute security.

9. Cookies

We use strictly necessary cookies and local storage to keep you signed in and to remember preferences. We do not use advertising cookies.

10. Changes

We may update this notice. Material changes will be communicated through the service.