Privacy notice

What Rhea stores

• POS sales. Each store's daily sales as your POS reports them: sales by category, discounts, refunds, tax, tips, gift cards and how customers paid, and the POS's own labels for them.
• Time cards. Shifts from your time clock or POS: the employee's name as the source gives it, job title, clock-in and clock-out times, and the hourly wage the source reports or the pay rate you enter in Rhea. Never Social Security numbers, bank, tax or benefit details: Rhea doesn't ask for them and refuses files that hold them.
• Bank deposits. Deposit lists you upload, matched to each store's sales.
• Your bookkeeper's reports. The QuickBooks Online reports you upload (profit and loss, trial balance, general ledger and the like), kept as lines by account and month for comparison with Rhea's books. Names, memos and payees in them are not kept.
• Files you upload. The data read from each file, the file's name and a fingerprint of its columns, so the same layout is read the same way next time. What Rhea read from a file waits while you check the preview (an hour at most), then is saved as data or discarded. The file you imported is itself kept, encrypted, for 13 months after its import, so you can open the file an entry was built from; a file you checked but did not import is deleted with its preview.
• Connections. Which QuickBooks company, Square or Clover account you connected, the company name and id, and the access tokens those services issue to Rhea.
• What Rhea built. The ledger entries, labor figures, reports and the audit log of what changed in a closed month and who changed it.
• Sign-in and server logs. Sign-in attempts, and the technical details any web server records (IP address, browser, the page asked for, the time).

Your organization's data stays its own

Everything above is stored under your organization in Rhea, and every screen, download and connection in the app reads only that organization's data. Another owner's organization can't see yours.

How Rhea protects it

The access tokens for QuickBooks and the other services you connect are encrypted at rest (AES-256-GCM) and decrypted only for the request that needs them; they are never written to logs. Data travels over HTTPS. The app's code is checked on every change for known-vulnerable packages and for secrets. Rhea reads from your POS, time-clock and bank sources and never writes to them.

When Claude reads a file

Rhea reads most files on its own, from the templates it knows and the layouts you have confirmed before. When it can't, and only then, Claude (a model run by Anthropic) reads the file to work out its layout or, for a PDF or photo, to transcribe the printed figures. Claude proposes; Rhea's own code reads every number from a table, and every figure transcribed from a PDF or photo is shown to you as “read by Claude” before anything is saved. Nothing reaches your books until you confirm the preview.

Only the parts of a file needed for that go to Anthropic: for a table, its name and a sample of the first rows, with anything shaped like a Social Security or card number masked first; for a PDF or photo, the document itself, with a photo's location and camera metadata removed; for an unfamiliar bookkeeper's report, a sample with names, memos and payees blanked; and, only when you ask for mapping suggestions, your bookkeeper's account names, never an amount. Never the rest of the file, your ledger, your QuickBooks data, other files or another organization's data. A file that holds Social Security numbers is refused before anything leaves Rhea. The exact rules, limits and what Anthropic says about retention are in Rhea's file-reading guide, which we will share on request.

Writing to QuickBooks

Rhea writes nothing to a live QuickBooks Online company without your written approval. Until then it works against test (sandbox) companies only. Disconnecting Rhea from inside QuickBooks or inside Rhea stops it reading from, and writing to, that company at once.

Who processes it for us

These providers handle your data on Rhea's behalf, only on our instructions:

• Render hosts the app and its database in the United States and keeps the server logs described above.
• Anthropic runs Claude, which receives only the file samples described above, and only when Rhea can't read a file on its own.
• Resend sends the email Rhea sends you, such as alerts and sign-in notices, when the app sends any.
• Intuit, Square and Clover receive the requests Rhea makes to the accounts you connected, under their own terms.

We may also disclose information if the law requires it, or to protect the rights and safety of Rhea, our users or others. We don't sell your data and we don't share it for advertising.

How long we keep it

For as long as your organization uses the app, because your books build on earlier months. What Rhea read from an uploaded file is discarded once the preview is confirmed or cancelled, or after an hour. Server logs are kept for the limited period our host sets.

Deleting your data

Email privacy@rheafi.com from the address you use with Rhea and we delete your organization's data, except for the records the law or our accountants require us to keep for a limited time. Disconnecting a service removes its tokens from Rhea at once. To see or correct what we hold, write to the same address.

People who aren't our customers

Your employees' names, hours and wages reach Rhea through you, their employer. We process them only to keep your books and labor figures, and we don't contact them. The app is for business owners and the people they authorize; it is not directed to children.

Changes to this notice

If we change this notice, we update this page, its version and the effective date above, and tell you in the app when the change is significant.

Contact

Privacy questions: privacy@rheafi.com. Anything else: sales@rheafi.com.