Privacy Policy

This Privacy Policy explains how Nilant Solutions, doing business as Riloma ("Riloma," "we," "us," or "our"), collects, uses, shares, and protects personal information when you use the Riloma mobile application, the Riloma website, and related services that link to this Privacy Policy (together, the "Services").

Riloma is a shared-expense utility. It helps people create groups, record and split expenses, track balances, record settlements and reimbursements, scan receipts, and understand shared spending. Riloma does not directly hold, transmit, transfer, or move money between users. Any wallet or settlement feature in Riloma is a record-keeping feature unless we clearly state otherwise for a separate service.

Please read this Policy together with our Terms and Conditions. If you do not agree with this Policy, do not use the Services.

1. Information we collect

The information we collect depends on the features you use, the permissions you give us, and how you interact with Riloma.

1.1 Account and profile information

When you create or use a Riloma account, we may collect information such as your name, email address, phone number, profile details, login identifiers, authentication information, and account preferences. If you sign in using Apple or Google, we may receive the account identifier and profile information that the provider makes available to us based on your settings and the permissions you approve.

Riloma supports sign-in using email or phone number with a password, Sign in with Apple, and Google Sign-In. We do not receive your Apple or Google password.

1.2 Group, expense, and settlement information

Riloma processes information you and other group members add to the Services. This may include group names, member names, expense descriptions, dates, amounts, currencies, categories, split details, payer and participant information, notes, balances, reimbursements, settlement records, recurring expense information, and other information you choose to add.

Information added to a shared group may be visible to other members of that group according to the features and visibility settings available in Riloma. Please avoid entering information that you do not want the relevant group members to see.

1.3 Receipts, images, files, and other content

If you scan or upload a receipt, image, or file, we may process the file itself and information extracted from it, such as merchant names, line items, dates, amounts, taxes, currency, and other receipt text. You may also upload profile images, group images, or other content where the feature is available.

1.4 Contacts

If you choose to use a contact-based feature and give Riloma access to your contacts, we may access contact information needed to help you find, add, or invite people. We use contact information for that feature and related fraud, security, and support purposes. We do not use your address book or contact list to personalize third-party advertisements.

1.5 Location information

If you choose to add or use a location when recording an expense or using another location-related feature, and give Riloma the required permission, we may receive precise or approximate device location depending on your device settings. Location information you choose to attach to an expense may be stored with that expense and may be visible to the relevant group members according to the sharing features available in Riloma. You can control location permission through your device settings.

We do not use a specific expense location or precise location attached to an expense to personalize third-party advertisements.

1.6 Device permissions

Depending on the feature and your device, Riloma may request access to the following:

Camera, to capture receipts or images.
Photos or gallery, to select receipts, images, or other supported media.
Files or device storage, to select and upload receipts or other supported files.
Contacts, to help you find or invite people where that feature is available.
Location, when you choose to use a location-related feature.
Notifications, to send account, group, expense, settlement, security, and service updates.
Microphone, when and if you choose to use a version of Riloma that offers voice-command or voice-input features.

You can manage device permissions through your device settings. Riloma requests these permissions only when they are relevant to a feature or when the platform requires the request at another appropriate time.

1.7 Device, usage, and diagnostic information

When you use the Services, we may collect technical and usage information such as IP address, device type, operating system and version, app version, language, time zone, device or app identifiers, network information, feature usage, session information, timestamps, crash information, error logs, security events, and performance data. We use this information to operate, secure, troubleshoot, measure, and improve Riloma.

1.8 Purchase and subscription information

Purchases made in the Riloma mobile app are generally processed by the Apple App Store or Google Play, subject to their rules and any legally permitted billing options that may apply in a region. Riloma does not receive or store your full payment card number or card security code for purchases processed by those app stores. We may receive purchase-related information such as the product or plan purchased, transaction or order identifier, purchase date, region, subscription status, renewal status, trial status, and entitlement information.

1.9 Information from support and communications

If you contact us, report a problem, submit a privacy request, or communicate with us in another way, we may collect the information you provide and information reasonably needed to respond, verify your identity, investigate the issue, prevent abuse, and keep a record of the request.

1.10 Website cookies and similar technologies

Our website may use cookies, local storage, pixels, tags, or similar technologies for essential website functions, security, preferences, measurement, and, where applicable, advertising. Where consent is required, we will provide an appropriate choice before using non-essential technologies.

2. How we use information

We may use personal information to:

Create, authenticate, maintain, and secure your account.
Provide group, expense, split, balance, settlement, receipt, wallet-recording, and other Riloma features.
Sync information across devices and group members where the product supports it.
Process receipts and provide AI-assisted suggestions and insights.
Send service, security, account, group, payment, and support communications.
Process subscriptions, trials, purchases, and premium entitlements.
Provide customer support and investigate technical issues.
Detect, prevent, and respond to fraud, abuse, unauthorized access, and security incidents.
Measure performance, understand feature usage, improve Riloma, and develop new features.
Comply with law, enforce our Terms, and establish, exercise, or defend legal claims.
Show advertising and measure advertising where permitted, subject to the choices and safeguards described in this Policy.
Create aggregated or de-identified information as described below.

3. Legal bases for processing in the EEA, United Kingdom, and similar jurisdictions

Where applicable law requires us to identify a legal basis for processing, we rely on one or more of the following, depending on the purpose and the information involved:

Performance of a contract, when processing is necessary to provide the Services you request or to take steps at your request before entering into a contract.
Legitimate interests, when processing is reasonably necessary for interests such as operating and improving Riloma, maintaining security, preventing fraud, providing support, and understanding service performance, and those interests are not overridden by your rights and interests.
Consent, when applicable law requires consent or when we choose to rely on consent, including certain advertising, tracking, device-permission, and marketing activities.
Legal obligations, when processing is necessary to comply with applicable law or a valid legal process.
Protection of vital interests or another lawful basis recognized by applicable law, where relevant.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not make earlier processing unlawful and may not affect processing that is supported by another lawful basis.

4. Artificial intelligence and automated features

Riloma uses artificial intelligence and machine-learning services to support certain features. At the date of this Policy, our production uses include:

Google Gemini for receipt scanning and extraction.
OpenAI for suggested group type, suggested expense type, and expense or spending insights.

When you use one of these features, the information needed for the feature may be sent to the relevant AI service provider for processing. For receipt scanning, this may include the receipt image and receipt content. For suggestions or insights, it may include the description, category-related information, or other information needed to produce the requested result.

AI output can be incomplete or inaccurate. Riloma is designed to assist with data entry and insights, not to replace your review. You should review amounts, dates, categories, descriptions, splits, and other important information before relying on or saving AI-generated results.

We do not use AI to make decisions about you that produce legal or similarly significant effects. We also do not provide private expense records or receipt contents to AI providers for their independent advertising purposes.

5. Advertising, personalization, and tracking

Some versions of Riloma may display third-party advertising or sponsored content. Some versions may not display ads. Advertising may be personalized or non-personalized depending on the user, region, platform, permissions, and choices available.

5.1 Personalized advertising

Where permitted by law and platform rules, advertising partners may use advertising identifiers, advertising interaction data, general app engagement information, approximate region, and other permitted advertising signals to select, measure, or limit the frequency of personalized ads. In regions where consent is required, we will obtain the required consent before using information for personalized advertising.

On Apple platforms, if an advertising practice meets Apple's definition of tracking, Riloma will request permission through Apple's App Tracking Transparency framework before that tracking occurs. If you decline tracking permission, Riloma will not perform tracking that requires that permission. We may instead show non-personalized, contextual, or limited ads where permitted.

5.2 Information we do not use for ad personalization

Riloma does not use your private expense descriptions, receipt contents, individual expense amounts, balances, settlement history, who owes whom, private group-member information, private notes, or specific expense locations to personalize third-party advertisements. We do not sell these records to advertisers or data brokers.

Riloma does not intentionally use personal information of a user we know to be under 18 for personalized or behavioral advertising. Where reliable platform age-range information, account information, or other lawful age-related signals indicate that a user is subject to additional protections, we apply the protections required by applicable law and platform rules. This may include serving only non-personalized or contextual ads, limiting identifiers, or not serving ads.

Riloma generally does not require every user to provide a date of birth solely for advertising. Where an operating system or app store provides a privacy-preserving age-range or age-assurance mechanism, we may use that mechanism only for compliance, safety, and age-appropriate treatment as allowed by the platform and applicable law.

5.4 Advertising choices

You may have choices through Riloma, your device, the applicable app store, an advertising consent interface, or applicable privacy-law mechanisms. Where required, we will provide a way to withdraw advertising consent or opt out of targeted advertising or sharing. Declining personalized advertising does not prevent you from using the core Riloma service, although the ads you see may be less personalized.

6. Aggregated and de-identified information

We may create aggregated or de-identified information from information processed through the Services. We use this information for analytics, benchmarking, research, product development, service improvement, security analysis, business planning, and understanding general patterns in how shared-expense tools are used.

Where permitted by applicable law and app-platform requirements, we may also provide aggregated or de-identified reports, statistics, benchmarks, or trend information to research partners, business partners, or other organizations. We design this information so that it does not reasonably identify an individual user, account, group, household, or specific transaction. We do not attempt to re-identify information that we treat as de-identified, and where appropriate we require recipients not to attempt re-identification.

Aggregated or de-identified information is not a substitute for personal information safeguards. If information can reasonably be linked back to a person, account, group, or device, we continue to treat it as personal information under this Policy.

We do not sell personal or sensitive user data to third parties for money or other valuable consideration. We may share personal information only as reasonably needed for the purposes described in this Policy, including with the following categories of recipients:

Other Riloma users, when sharing is part of a group, settlement, invitation, or other user-directed feature.
Cloud hosting, storage, database, security, communications, and technical service providers that help operate Riloma.
Authentication providers, including Apple and Google, when you use their sign-in services.
AI service providers, including Google Gemini and OpenAI, for the AI features described in this Policy.
Apple App Store, Google Play, and payment or entitlement service providers for purchases, subscriptions, trials, and related account status.
Advertising networks, advertising technology providers, consent-management providers, and measurement partners when advertising is enabled and the sharing is permitted by law and your applicable choices.
Professional advisers, auditors, insurers, regulators, courts, law-enforcement authorities, or other parties when reasonably necessary to comply with law, protect rights or safety, or establish, exercise, or defend legal claims.
A buyer, investor, lender, successor, or other relevant party in connection with a merger, acquisition, financing, reorganization, sale of assets, or similar business transaction, subject to appropriate confidentiality and legal requirements.

Service providers may process personal information only for purposes connected with the services they provide to Riloma, subject to applicable agreements and law.

Riloma does not sell your personal information for money or other valuable consideration. Some privacy laws use the terms "sale" or "sharing" more broadly and may treat certain disclosures for cross-context behavioral or personalized advertising as a sale or sharing even when no money is paid for the data itself. Where those laws apply, we will provide the required notice and opt-out method and will honor legally recognized opt-out preference signals where required and technically applicable.

You may submit a privacy request at https://riloma.com/privacy-request or contact us using the details at the end of this Policy.

9. Children's privacy

Riloma is a general-audience shared-expense service. It is not directed to children under 13 years of age. You must be at least 13 to create an account or use the Services.

We do not knowingly collect personal information from children under 13. If we learn that a child under 13 has provided personal information to Riloma, we will take reasonable steps to delete the information and, where appropriate, close the account. A parent or guardian who believes that a child under 13 has provided information to Riloma may contact us at privacy@riloma.com.

Some countries or regions require a higher age for a person to consent independently to certain processing or require the involvement of a parent or guardian. Where those requirements apply, the user may use the relevant feature only if the required consent or authorization has been obtained. We apply additional age-related advertising protections as described in Section 5.3.

10. International data transfers

Riloma is operated from India and uses service providers that may process information in other countries. As a result, your information may be transferred to, stored in, or processed in a country different from the one where you live.

Where applicable law requires safeguards for an international transfer, we take steps intended to provide the required protection. Depending on the transfer, these steps may include contractual protections, recognized transfer mechanisms, security measures, or another lawful transfer basis. The privacy laws in the destination country may differ from those in your country.

11. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, to provide the Services, to preserve legitimate shared records, to resolve disputes, to enforce agreements, or to meet legal, tax, accounting, security, and compliance obligations.

Retention periods vary by the type of information and feature. For example:

Account and profile information is generally kept while your account is active and for a reasonable period after deletion where needed for security, fraud prevention, dispute resolution, or legal obligations.
Group and expense records are generally kept while needed to provide the group and account service. If a record is shared with other group members, some historical information may need to remain so that their shared ledger remains understandable.
Receipts and attachments may be retained according to the plan, feature, archive, or storage rules shown in Riloma and may be deleted earlier at your request where the product and law allow.
Purchase, subscription, trial, and entitlement records may be retained as needed for billing history, fraud prevention, accounting, tax, and legal requirements.
Consent and privacy-choice records may be kept as needed to demonstrate and honor your choices.
Security, diagnostic, and operational logs are kept for a period reasonably necessary for security, troubleshooting, and service reliability.
Backup copies may remain for a limited period until they are securely overwritten or deleted through our normal backup cycle.

When information is no longer needed, we delete it, anonymize it, or isolate it from ordinary use until deletion is reasonably possible.

12. Security

We use reasonable technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, and disclosure. These measures may include access controls, authentication safeguards, encryption or secure transport, monitoring, backup controls, and vendor security requirements appropriate to the nature of the data and the service.

No internet service or storage system can be guaranteed to be completely secure. If we become aware of a security incident affecting personal information, we will investigate and provide notifications where required by applicable law.

13. Your privacy rights and choices

Depending on where you live, you may have rights over your personal information. These rights may include the right to:

Access personal information we hold about you.
Correct inaccurate or incomplete personal information.
Delete personal information, subject to legal and service-related exceptions.
Receive a portable copy of certain information where applicable.
Restrict or object to certain processing where applicable.
Withdraw consent where processing is based on consent.
Opt out of targeted advertising, sale, or sharing where applicable law provides that right.
Limit certain uses of sensitive personal information where applicable law provides that right.
Appeal a decision on a privacy request where applicable law provides an appeal right.
Submit a grievance or complaint to us or to an applicable privacy or data-protection authority.

You can submit a request at https://riloma.com/privacy-request or email privacy@riloma.com. We may need to verify your identity before completing a request. We will not discriminate against you for exercising a privacy right.

Some information cannot be deleted immediately or completely if we must keep it for legal, security, fraud-prevention, accounting, dispute-resolution, or legitimate shared-record purposes. Information that another group member independently possesses, exports, or screenshots is outside our direct control.

14. Account deletion

You can initiate account deletion through the account settings in Riloma, where available, or through the privacy-request page at https://riloma.com/privacy-request. Account deletion is intended to delete or de-identify personal information associated with your account, subject to the retention exceptions described in this Policy.

Because Riloma is a shared-expense service, deleting your account does not always mean that every shared transaction entry disappears from every other member's history. Where a shared record must remain to preserve another member's ledger, we will take reasonable steps to remove, minimize, or de-identify your account-specific information where appropriate while keeping the shared record understandable.

15. Communications and notifications

We may send administrative or transactional messages about your account, security, group activity, expenses, settlements, purchases, policy changes, or other service matters. These messages are part of providing the Services and may not always be optional. You can control push notifications through Riloma or your device settings where the option is available.

We may send promotional or marketing communications where permitted by law. You can opt out of marketing messages using the method provided in the message or by contacting us. Opting out of marketing does not stop necessary service communications.

16. Third-party websites and services

Riloma may contain links to third-party websites, apps, advertisers, offers, or services. If you choose to interact with a third party, that third party may collect information under its own privacy policy. Riloma does not control the independent privacy practices of third parties.

If Riloma includes a sponsored or affiliate link, we may receive compensation when you view, click, or complete a transaction through that link. We will provide disclosures where required. A sponsored placement does not mean that Riloma guarantees or endorses the third-party product or service.

17. Do Not Track and privacy preference signals

Some browsers provide a Do Not Track setting. Because there is no single universal standard for traditional Do Not Track signals, our response to that setting may vary. This is separate from legally recognized privacy preference signals. Where applicable law requires us to honor a recognized signal, such as a valid opt-out preference signal for sale or sharing, we will honor it where technically applicable.

18. Changes to this Privacy Policy

We may update this Privacy Policy when our Services, legal requirements, vendors, or data practices change. We will update the effective date at the top. If a change materially affects how we use personal information, we will provide additional notice or obtain consent where required by law.

19. Contact us

Got Questions? For privacy questions, requests, or complaints, contact:

Nilant Solutions
Vadodara, Gujarat, India
Support email: askcs@riloma.com
Email for EEA and UK representative: rep.sec@riloma.com
Website: https://riloma.com/