Privacy Policy

1. Information We Collect

Information You Provide

• Account information: Name, email address, business name, and password when you register
• Business data: Inventory records, customer information, work orders, vendor details, staff information (such as names, roles, and time clock records), and other data you enter into the platform
• Payment information: Billing details collected at the time of subscription purchase (processed by our payment provider; we do not store full card numbers)
• In-store payments: When your store accepts card payments from its customers through the Service, card details are processed directly by Stripe. Rica does not receive or store card numbers.
• Communications: Messages or requests you send to our support team

Information Collected Automatically

• Usage data: Pages visited, features used, actions taken within the Service, and session duration
• Device and technical data: IP address, browser type, operating system, and referring URLs
• Cookies and similar technologies: We use cookies to maintain sessions and improve the Service experience

Information from Third Parties

We may receive information from third-party services you connect to Rica, such as Stripe for payment processing.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Service
• Process your subscription and manage your account
• Respond to support requests and communicate with you about the Service
• Send transactional emails (receipts, password resets, account notices)
• Monitor for security issues, fraud, and abuse
• Comply with legal obligations
• Create de-identified and aggregated data, which we may use for any lawful purpose, including to improve the Service and to develop new products and features such as pricing and AI tools

We do not sell your personal information or your customers' personal information to third parties.

3. How We Share Your Information

We may share information in the following limited circumstances:

• Service providers: We work with third-party vendors that process data on our behalf under confidentiality obligations, including Supabase for data storage, Stripe for payment processing, Resend for email delivery, and Anthropic for AI features. A current list appears in Section 8.
• Legal requirements: We may disclose information if required by law, court order, or to protect the rights, property, or safety of Rica, our users, or the public
• Business transfers: If Rica is acquired or merges with another company, your information may be transferred as part of that transaction
• De-identified or aggregated data: We may share data that has been de-identified or aggregated, as described in Section 2, which does not identify you or your customers

We do not share your data with advertisers or marketing platforms.

4. Your Customers' Data

When you use Rica to manage your store's customer records, you are the data controller for that information. Rica acts as a data processor on your behalf. You are responsible for ensuring you have appropriate rights to collect and store your customers' information and for complying with applicable privacy laws in your jurisdiction.

Rica may de-identify information from your customer records, removing names, contact details, and other information that identifies an individual, and use the resulting data for its own purposes. Rica maintains such data in de-identified form, will not attempt to re-identify it, and contractually requires any recipient to do the same.

If a customer of a store using Rica contacts us with a request about their personal information, we will refer the request to that store, and we will assist the store in responding as required by applicable law.

5. Data Retention

We retain your account and business data for as long as your account is active. If you cancel your account, we will retain your data for at least 30 days to allow for reactivation or data export, after which it will be deleted or anonymized. You may request deletion of your data at any time by contacting legal@ricaos.com. De-identified and aggregated data is not subject to deletion requests.

6. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit (HTTPS) and at rest, access controls, and periodic security reviews. Our infrastructure is hosted on Supabase, which maintains its own security certifications and controls.

No method of transmission or storage is 100% secure. We encourage you to use strong passwords and protect your account credentials.

If we become aware of a security incident that affects your data, we will notify you as required by applicable law.

7. Cookies

Rica uses cookies and similar tracking technologies to:

• Keep you logged in during your session
• Remember your preferences
• Understand how the Service is being used

You can configure your browser to refuse cookies, but doing so may affect your ability to use certain features of the Service.

8. Third-Party Services

We integrate with third-party providers such as:

• Supabase — database and authentication infrastructure
• Stripe — payment processing and payouts. Card details are sent directly to Stripe; Rica does not store full card numbers.
• Resend — delivery of emails sent through the Service, such as receipts and notifications.
• Anthropic — AI processing for features such as reading vendor invoices. Data is used to provide the feature and is not used to train Anthropic's models. Anthropic may retain it for up to 30 days for safety and security purposes.

Additional third-party integrations may be added over time and will be reflected in updates to this policy.

These providers have their own privacy policies and data practices. We encourage you to review them. Rica is not responsible for the privacy practices of third-party services.

9. Children's Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, contact us at legal@ricaos.com and we will take steps to delete it.

10. Your Rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict certain processing of your data
• Request a copy of your data in a portable format

To exercise any of these rights, contact us at legal@ricaos.com.

11. Additional Information for California Residents

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with specific rights regarding your personal information.

Categories of personal information we collect:

• Identifiers (name, email address, IP address)
• Commercial information (subscription and billing records)
• Internet or network activity (usage data, session information)
• Business data you enter into the platform (inventory, customer records, work orders)

We do not sell your personal information. We do not share your personal information with third parties for cross-context behavioral advertising.

Your rights as a California resident:

• Right to Know — You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for collecting it, and the categories of third parties with whom we share it.
• Right to Delete — You may request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to Correct — You may request that we correct inaccurate personal information we maintain about you.
• Right to Opt Out of Sale or Sharing — We do not sell or share your personal information, so no opt-out is necessary. If this practice changes, we will update this policy and provide an opt-out mechanism.
• Right to Limit Use of Sensitive Personal Information — We do not use sensitive personal information beyond what is necessary to provide the Service.
• Right to Non-Discrimination — We will not discriminate against you for exercising any of your CCPA rights. This means we will not deny you services, charge you different prices, or provide a different level of service because you exercised your privacy rights.

De-identified information. Where we de-identify personal information, we maintain it in de-identified form, will not attempt to re-identify it, and contractually require any recipient to do the same.

How to submit a request:

To exercise any of the above rights, contact us at legal@ricaos.com with the subject line "California Privacy Request." We will respond within 45 days of receiving your request. We may need to verify your identity before processing your request.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice within the Service. Continued use of the Service after the updated policy takes effect constitutes your acceptance of the changes.

13. Contact

If you have questions or concerns about this Privacy Policy, contact us at:

Rica OS LLC