Privacy Policy

Ritmas ("Ritmas", "we", "us") provides a field service management platform for service businesses (the "Service"). This policy describes how we collect, use, share, and protect information when you use the Service or visit our websites. Ritmas acts primarily as a processor of the business data our customers ("tenants") enter; tenants control that data and their own customer relationships.

• Account information: name, email address, and authentication identifiers, collected through our sign-in provider when you create an account.
• Business data: information you and your team enter to run your business, such as customer names and contact details, job sites, schedules, estimates, work orders, invoices, and payment records.
• Integration data: when you connect a third-party service (such as QuickBooks Online), the records exchanged with that service and the connection metadata needed to keep the link working.
• Usage and log data: standard technical information such as IP address, browser type, pages viewed, and actions taken, used for security and to operate and improve the Service.
• Communications: messages you send us, and messages sent through the Service (such as estimate and invoice emails to your customers).

• to provide, operate, secure, and improve the Service;
• to sync data with third-party services you choose to connect;
• to send transactional communications (such as account notices and the customer-facing documents you trigger);
• to provide support and respond to your requests;
• to comply with legal obligations.

We do not sell personal information, and we do not use it for third-party advertising.

If you connect QuickBooks Online, Ritmas exchanges accounting-relevant records with Intuit on your behalf: customers, items, tax codes, accounts, invoices, and payments. We use this data solely to provide the sync you configured, never for advertising, profiling, or resale. OAuth access tokens are stored and refreshed through a dedicated secure token-management service and are never exposed in our application database or logs. You can disconnect QuickBooks at any time from Settings, which stops all further data exchange. Intuit's handling of data inside QuickBooks is governed by Intuit's own privacy policy.

We share information with service providers that help us run the Service, under agreements that limit their use of it. Current categories and providers:

• Hosting and infrastructure: Vercel (application hosting), Supabase (database)
• Authentication: Clerk
• Email delivery: Resend
• SMS delivery: Twilio
• Integration token management: Nango
• Accounting sync (when you connect it): Intuit QuickBooks Online
• Maps and geocoding: Mapbox
• AI assistance features: Anthropic

We may also disclose information if required by law, or in connection with a merger, acquisition, or sale of assets, with notice where required.

Ritmas sends text messages on behalf of the businesses that use the Service, to those businesses' own customers. These messages are service related: appointment confirmations and reminders, notice that a technician is on the way, schedule changes, and links to a customer's own estimate, work order, or invoice. We do not send marketing or promotional text messages through the Service.

Consent. A customer's mobile number is provided to the business directly, either verbally when booking service or by entering it into that business's booking form. The business records the customer's express consent to receive service-related text messages before any message is sent, together with the source and date of that consent. Consent can be withdrawn at any time.

We do not share mobile numbers. Mobile phone numbers and text messaging consent are never sold, rented, or shared with third parties for their own marketing purposes. Numbers are disclosed only to the messaging providers listed above, solely to deliver the messages the business has asked us to send.

Message frequency. Message frequency varies and depends on your activity with the business you booked service with. Most customers receive a small number of messages for each scheduled visit, typically between one and five.

Message and data rates may apply. Standard message and data rates from your mobile carrier may apply to messages you send and receive.

Opting out and getting help. Reply STOP to any message to stop receiving text messages from that number. Reply HELP for help, or contact the business that scheduled your service. Mobile carriers are not liable for delayed or undelivered messages.

We retain information for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. When an account closes, business data is made available for export for a reasonable period and then deleted in the ordinary course of our systems.

We use industry-standard safeguards: encryption in transit, encrypted storage, tenant isolation enforced at the database layer, role-based access controls, and audit logging. No system is perfectly secure; we encourage strong passwords and prompt reporting of any suspected unauthorized access.

You can access and update account information in the Service, export your business data, disconnect integrations, and close your account by contacting us. Depending on where you live, you may have additional rights (such as access, correction, deletion, or portability); we honor verified requests as required by applicable law. If your information was entered into Ritmas by a business you do business with, contact that business first; we support our tenants in responding.

Technicians using the Ritmas mobile app can request deletion of their account from inside the app: open the Settings tab, then choose Delete account. The request is recorded on our servers and remains visible to you in the app, including after reinstalling or switching phones.

The request is sent to the company that provisioned your account rather than deleting immediately. A Ritmas field account is created, owned and paid for by your employer, and the visits, time entries, photos and signed documents recorded through it are that company's business records. We cannot destroy their records at the request of one of their employees, and your employer may be required to keep some of them.

What is removed on approval: your sign-in identity and your personal profile details, so you can no longer access the Service. What is kept: the work records themselves, which remain with your employer as their business records, and anything either party must retain to comply with legal obligations, resolve disputes or enforce agreements. Retention of those records is governed by the Data retention section above and by your employer's own policies.

If your employer no longer uses Ritmas, or you cannot reach them, write to privacy@getritmas.com and we will help.

The Service is for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 13.

We may update this policy from time to time. Material changes will be communicated through the Service or by email, and the effective date above will be updated.

Privacy questions or requests: privacy@getritmas.com.