Data processing addendum

1. What this covers

Customer data is everything you connect, upload or type into the app to keep your books, and what Rhea builds from it: POS sales, time cards, bank and card statements, deposits, bills and vendors, your bookkeeper’s reports, the files you import, and the ledger, labor figures and reports Rhea makes. The privacy notice lists it in detail. Personal information in it is what identifies a person: your employees’ names, hours and wages; the names of vendors and payees who are people; the names and email addresses of the people you give seats to. Rhea’s own records about the people who use Rhea (accounts, sign-in and audit records, billing) are collected by Rhea as a business and are covered by the privacy notice, not this addendum.

2. The roles

For customer data, you are the business (California) or controller (other states): you decide what is collected and why. Rhea is your service provider or processor: it processes customer data only to provide the app to you, on your instructions, which are these terms, the settings you choose and the actions your people take in the app. Rhea is a service provider as the California Consumer Privacy Act defines one (Civil Code 1798.140(ag)), and this addendum is the written contract that section 1798.100(d) and the regulations under it (11 CCR 7051) require.

3. What Rhea may do with customer data, and what it may not

The business purposes. Rhea processes customer data for these purposes only: to keep your books (turning each store’s day into balanced entries, labor figures and reports; keeping accounts payable; sending what you direct to your QuickBooks company and your payment partner); to show it to the people you authorize; to keep the app secure and detect misuse; to answer your support questions; to maintain and improve the app’s reliability and the quality of its reading; and to comply with the law.

Rhea will not:

• sell or share customer data, or any personal information in it, to or with anyone, for anything;
• keep, use or disclose it for any purpose other than the business purposes above, or outside the direct business relationship between you and Rhea;
• combine it with personal information Rhea holds from another customer or source, except as the law allows a service provider to (for example to detect security incidents);
• use it for advertising, for profiling people, or to train a machine-learning model;
• send it outside the United States.

Rhea may use figures from which no organization, person or vendor can be identified (how many files are read, how long an import takes) to run and improve the service.

4. Rhea’s promises

• Compliance. Rhea will comply with the obligations the California Consumer Privacy Act and the other applicable state privacy laws put on a service provider or processor, and will give personal information the same level of privacy protection those laws require of you.
• Confidentiality. Everyone at Rhea who can reach customer data is bound to keep it confidential, reaches it only to serve you, and leaves a record in your audit log each time they do.
• Instructions. Rhea follows your instructions as the app expresses them. If Rhea decides it can no longer meet its obligations under those laws or this addendum, it will tell you promptly, and you may then direct it to stop processing and to delete your data.
• Your right to check and to stop. You may take reasonable and appropriate steps to make sure Rhea uses personal information as this addendum says (section 8), and to stop and remedy any unauthorized use by telling Rhea, which will act at once.
• People’s requests. When a person asks you about their personal information (to know, delete or correct it), Rhea helps you answer within the time the law gives: the app lets you export what it holds, and Rhea deletes or corrects a record on your written instruction. A person who writes to Rhea about data in your organization is sent to you, and Rhea tells you.
• Helping you comply. Rhea gives you the information you reasonably need to show your own compliance, including this addendum, the privacy notice, the security overview and, on request under a confidentiality agreement, its written information security program.

5. Subprocessors

You authorize Rhea to use the subprocessors listed at rheafi.com/legal/subprocessors (today: Render for hosting, Anthropic for reading files Rhea can’t read on its own, Resend for email, and Stripe for payment and for paying bills from Rhea). Each is in the United States, and each is bound by a written contract that puts on it obligations at least as protective as this addendum’s for what it receives. Rhea remains responsible to you for what they do. Rhea will email the owners of your organization at least 30 days before a new subprocessor handles customer data, naming it and what it will receive; if you object on reasonable grounds and Rhea can’t resolve it, you may end the subscription and Rhea refunds the unused part. The services you connect yourself (your POS, time clock, QuickBooks company, payment partner) are not Rhea’s subprocessors: they hold your data under your own agreements with them.

6. Security

Rhea protects customer data with safeguards appropriate to the data and the risk, including those in Annex A, and keeps a written information security program it reviews at least every six months and after any change to what Rhea holds, who can reach it or which vendor sees it. Rhea will not lower the protection of Annex A during your subscription without telling you.

7. If something goes wrong

If Rhea confirms a breach of security that led to the unauthorized access to, disclosure, loss or alteration of customer data, Rhea will tell the owners of your organization by email without undue delay and within 72 hours of confirming it: what happened, what data and which people as far as Rhea knows, what Rhea has done and is doing, what you should do, and who to contact. Rhea will update you as it learns more, help you with any notice you must give, and will not tell your employees or customers itself unless the law requires it or you ask. A notice to you is not an admission of fault.

8. Checking Rhea

Once a year, or after a security incident that affected your data, you may send Rhea a written security questionnaire, which Rhea answers within 30 days, and ask for the documents in section 4. Rhea is a small company and doesn’t host on-site audits; if a law you are subject to requires more, tell Rhea and the two of you will agree a reasonable way to do it, at your cost unless it finds a material breach of this addendum.

9. Return and deletion

You can export your books at any time from the app, including while it is read-only and for at least 30 days after your subscription ends. When an owner asks on Setup → Your data or in writing, Rhea deletes your organization’s data within 30 days: every record of it in the app, the accounts of people who belong to no other organization, and Rhea’s access at each service you connected (Rhea revokes what it can and tells you the rest). Rhea keeps only what the law requires it to (invoices stay at the payment processor) and a record that the deletion happened: when, how much was removed, and who asked (name, email address, IP address). Copies in the host’s backups age out on the host’s schedule and are never restored to bring deleted data back; a restore for any other reason is followed at once by the same deletion. Rhea deletes customer data in any case 12 months after your account ends if you haven’t asked. Imported files are emptied 400 days after their import whatever you ask.

10. The law, and the rest of the terms

This addendum is governed by the same law and resolved in the same place as the terms of service. Where it conflicts with the terms about customer data, this addendum wins. Rhea’s liability under it is subject to the terms’ limitation of liability. Rhea processes customer data in the United States only and this addendum contains no provision for transfers outside the United States; Rhea does not offer the European Union’s standard contractual clauses, and a customer established outside the United States should ask Rhea before subscribing. Rhea may update this addendum to keep up with the law or its subprocessors, with the notice the terms give for a change to the terms; a change that lowers the protection of customer data needs your agreement.

Annex A: the safeguards

• Hosting in the United States on Render, with the database closed to the internet; a separate service and database for the public demo, which holds sample data only; production refuses sample data and everything else refuses live vendor settings, in code.
• HTTPS (TLS) for every connection; the database encrypted at rest by the host; connected services’ access tokens and credentials and every imported file encrypted by Rhea with AES-256-GCM under a per-service key that can be rotated without downtime.
• Each person’s own account, a confirmed email address, a 12-character password hashed at rest, and a second step at every sign-in on the hosted service (passkey, authenticator app or emailed code); sessions end after a day without use; rate limits on sign-in and codes; a lockout after five wrong codes.
• Roles (owner, bookkeeper, accountant, manager) enforced on the server for every page, action and download; seats given and taken back by an owner; invitations that work once, for seven days.
• Every record tagged with its organization and every query filtered by it; the organization taken from the signed-in person’s membership, never a form or URL; a test suite that renders every page for two look-alike organizations and fails on a leak.
• Balanced entries checked by the database; closed months and entries sent to QuickBooks never edited, only corrected by a reversing entry; an add-only audit log of every close, correction, sign-in, failed sign-in, settings change, role change and staff look, downloadable by the customer.
• No collection of Social Security numbers, full bank, routing or card numbers, POS customers’ details or per-person payroll; files holding them refused before storage or any sending; guest columns dropped from Toast files on read; statement account numbers reduced to the last four digits and a fingerprint; payment details entered on Stripe’s pages only.
• A model used to read files only for a file a person dropped, only when Rhea can’t read it on its own, with sensitive shapes masked and names blanked where Rhea can; never the ledger, account numbers, balances or other files; the provider bound not to train on it.
• Rhea staff read-only in a customer’s organization unless they take an audited “act as owner” step of at most 8 hours; an admin page of counts and statuses only.
• Logs that carry counts, dates and identifiers, never file contents, file names, tokens, keys or full email addresses; secrets only in the host’s dashboard; every code change checked by tests, a dependency audit and a secret scan before it ships; no customer data in the code repository or on a laptop.
• A daily check of every store’s data with an alert to Rhea’s founder the same day; every import attempt recorded with its reason; a written incident plan; a written deletion procedure run as one command that covers every table.
• Imported files kept 400 days then emptied; previews and unimported files deleted within the hour; an owner’s deletion request honored within 30 days.