Legal
Subprocessors
Effective October 19, 2026
These are the companies that process customer data on Rhea’s behalf, on Rhea’s instructions, to run the Rhea app. Every one is in the United States; Rhea sends no customer data outside the country. The app’s privacy notice says what Rhea itself stores; the data processing addendum says how this list may change.
Processors of the app’s customer data
| Vendor | Purpose | Data | Location |
|---|---|---|---|
| Render Services, Inc. | Hosts the Rhea app, its database, its daily job, backups and server logs. | Everything Rhea stores (the privacy notice lists it), encrypted at rest by Render; access tokens and imported files encrypted again by Rhea. Server logs with IP addresses. | United States |
| Anthropic, PBC | Provides Claude, the model Rhea uses to read a file it can’t read on its own, only when a person drops that file. | A spreadsheet’s name, header and first rows (Social Security and card number shapes masked); a whole PDF or photo of a report or a bill (photo metadata removed); a sample of an unfamiliar bookkeeper’s report (names and memos blanked); a bookkeeper’s account names (never amounts); cleaned statement merchant descriptions (long numbers masked, people’s names replaced). Never the ledger, account numbers, balances or other files. Not used for training; deleted by Anthropic within 30 days per its terms. | United States |
| Resend, Inc. | Sends Rhea’s email (sign-in links and codes, the owner’s morning email, the daily data-health alert to Rhea’s founder) and receives email sent to a reports address or a bills address an owner sets up. | Sent: the addresses, subject and text of each email (the owner’s email holds store sales, labor % and employees’ names with hours; never pay). Received: the whole email a POS or a vendor sends to a Rhea address, kept by Resend for 30 days; Rhea takes only the attachments and the sender checks. | United States |
| Stripe, Inc. | Takes payment for the subscription (hosted checkout, invoices, receipts, the billing portal) and, for organizations that turn it on, provides the accounts and money movement for paying bills from Rhea (Stripe Treasury, with Stripe Payments Company and its partner banks). | The organization’s name and id, the owner’s email and billing details, the card or bank account (entered on Stripe’s pages; Rhea never sees it), invoices, the bank debit authorization. For bill pay: each company’s verification details, its account, each vendor’s bank account (entered on Stripe’s page), the vendor’s name, the amount and invoice number of each payment. | United States |
Declared, not yet in use: Melio (card-funded bill payments, on Melio’s own pages). No data goes to Melio until the feature exists; this list and the privacy notice will name it first.
Your own connections are not Rhea’s processors
Intuit (QuickBooks Online), Square, Clover, Shopify, Toast and 7shifts already hold your data under your own agreements with them. When you connect one, Rhea reads from it (and, for QuickBooks, writes what you direct) with the permissions you grant; those services receive Rhea’s requests to your account and nothing else.
The website
| Vendor | Purpose | Data | Location |
|---|---|---|---|
| Formspree, Inc. | Receives the waitlist form on rheafi.com and forwards it to Rhea’s inbox. | What the form holds: email address, first name, store count, POS, the Rhea Card interest box; and the IP address and browser details sent with any web request. | United States |
| GitHub, Inc. (GitHub Pages) | Serves the rheafi.com website. | Server logs of visits (IP address, browser, page, time). No form data. | United States |
Changes to this list
Before a new subprocessor handles customer data, Rhea updates this page and emails the owners of each customer organization at least 30 days ahead, naming the vendor and what it will receive. An owner who objects on reasonable grounds can tell us at privacy@rheafi.com; if we can’t resolve it, they may end the subscription and we refund the unused part. A replacement of a vendor’s parent, name or contracting entity that changes nothing about what it receives is updated here without the notice.