check.ralk.io  ·  app.ralk.io

Privacy Policy

Last updated: October 2026  ·  Contact: info@ralk.io

1. Controller

The controller responsible for the processing of personal data on all RALK services is:

RALK
Einzelunternehmen in Gründung
Inh.: Dina Boyele Kraus
Hafenstraße 25–27
68159 Mannheim
Germany
Email: info@ralk.io

This Privacy Policy covers the following services operated by RALK:

• check.ralk.io — RALK Compliance Quick-Check (free financial crime compliance self-assessment)
• app.ralk.io — RALK Training Platform (financial crime prevention e-learning for companies and institutions)

2. What our services do

check.ralk.io — A free, browser-based self-assessment tool. It calculates a financial crime risk profile (money laundering, fraud, corruption, sanctions and related risks) entirely within your browser. No assessment answers are transmitted to any server. A score and prioritised action plan are generated locally and displayed to you.

app.ralk.io — A SaaS training platform for companies and their employees. It generates customised financial crime prevention training (money laundering, fraud, corruption, sanctions, data protection and related risks) by role, country, sector and risk profile, and tracks completion, quiz results, and certificates for audit purposes.

3. What data we process

3a. Quick-Check (check.ralk.io)
When you choose to unlock your full report via the optional lead-capture form, we process:

• Full name, business email address, job title / role
• Company / institution name, country, sector
• Assessment result: overall score, risk classification, number of critical gaps
• Submission timestamp

Your individual question responses are not transmitted to our servers and are not retained beyond your browser session.

3b. Training Platform (app.ralk.io)
When you create an account or are enrolled by your organisation, we process:

• Full name and business email address
• Job title / role, department, seniority level
• Organisation name, country, sector
• Login method (Google OAuth, Microsoft OAuth, or email magic link)
• Training records: modules completed, quiz scores, pass/fail status, timestamps
• Certificates issued, including issuance date and training content summary
• AI-generated training content (personalised to your profile — not stored as personal data beyond your training record)

We also process standard server log data (IP address, browser type, date and time of access) across all RALK services.

4. Legal basis

• Consent (Art. 6(1)(a) GDPR) — for the Quick-Check lead form (voluntary, with explicit checkbox).
• Contract performance (Art. 6(1)(b) GDPR) — for Training Platform accounts: processing is necessary to provide the service you or your organisation subscribed to.
• Legitimate interests (Art. 6(1)(f) GDPR) — server log data for security and abuse prevention across all services.

You can use the Quick-Check without providing personal data by skipping the form.

5. How we use your data

• To deliver and personalise the training programme (app.ralk.io)
• To track completion and generate auditable training certificates
• To enable compliance managers to monitor team training status
• To send you Quick-Check results and relevant RALK content (check.ralk.io)
• To contact you about a product walkthrough or demo if you requested one
• To improve and develop our services

We will never sell your data to third parties or use it for unrelated marketing.

6. Hosting and subprocessors

We use the following vendors to operate our services. All handle personal data under appropriate safeguards (standard contractual clauses / adequacy decisions where applicable):

• Vercel Inc. (USA) — frontend hosting for check.ralk.io and app.ralk.io
• Railway (USA) — backend API hosting for app.ralk.io
• MongoDB Atlas / MongoDB Inc. (USA) — database for Training Platform user accounts, training records, and certificates
• Anthropic PBC (USA) — AI model API used to generate personalised training content and to answer questions in the RAI assistant. To generate training, we send only the learner's role, department and seniority, and the organisation's country, sector, size, risk profile and compliance set-up (yes/no answers, e.g. whether a compliance officer is in place). We do not send names: the learner's name is never sent, and the organisation's name is replaced by a placeholder before sending and only inserted on our own servers afterwards. Questions typed into the RAI assistant are sent as written, together with the organisation's country and sector, so please do not enter names or other personal data there.
• OpenAI / DALL·E (USA) — AI image generation for training scenario illustrations (where enabled; no names are sent)
• Cloudflare R2 (Cloudflare Inc., USA) — storage of generated training images
• Resend (USA) — transactional email delivery (magic links, training notifications)
• FormSubmit.co — relay for Quick-Check lead form submissions to our inbox
• Google Ireland Ltd. (Ireland; Google LLC, USA) — Google Ads conversion measurement on ralk.io, only as described in section 7

We aim to conclude data processing agreements (Art. 28 GDPR) with all vendors handling personal data.

7. Cookies and browser storage

We use technically necessary browser storage (session state, authentication tokens, language and theme preference) to operate our services.

Google Ads on ralk.io: on our website ralk.io we use Google Ads conversion measurement to see whether our ads lead to licence orders. Cookies for this purpose are only set if you click "Accept" in the cookie notice (Art. 6(1)(a) GDPR, § 25(1) TDDDG). If you decline or make no choice, no Google Ads cookies are stored; Google then only receives anonymous signals without cookies (Google Consent Mode). When a licence order is completed, the order reference and the order value are sent to Google; no name, e-mail address or other contact details are transmitted. You can change or withdraw your consent at any time via the "Cookie settings" link at the bottom of every page on ralk.io. Data may be transferred to Google LLC in the USA under the EU-U.S. Data Privacy Framework. The Training Platform (app.ralk.io) and the Quick-Check (check.ralk.io) do not use marketing cookies.

8. Retention

Training Platform account data is retained for the duration of your organisation's subscription and deleted within 30 days of account closure on request. Quick-Check lead data is retained only as long as necessary for the purposes above. Server log data is retained according to our hosting providers' standard policies.

9. Your rights

Under the GDPR you have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21). You also have the right to withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, contact us at info@ralk.io. You may also lodge a complaint with a supervisory authority in your country.

10. Governing law and supervisory authority

RALK is established under German law. This Privacy Policy is governed by the laws of the Federal Republic of Germany. The applicable data protection regulation is the EU General Data Protection Regulation (GDPR / DSGVO), as implemented in German law.

The competent supervisory authority is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
www.baden-wuerttemberg.datenschutz.de

Place of jurisdiction for any disputes: Mannheim, Germany.

11. Updates

We may update this Privacy Policy to reflect changes in our processing. The current version covering all RALK services is always published at check.ralk.io/privacy and accessible via app.ralk.io/privacy.