Privacy Policy

Who we are

RW Business Services, LLC ("RWBS", "we") provides bookkeeping, accounting, and business-process automation services, and builds and operates software for the clients who engage us. This policy explains what information we collect, how we use and protect it, and your choices.

Who this covers

This policy covers information about our clients and the people associated with them, information belonging to a client that we handle while performing work, and information about prospective clients and business contacts we communicate with. Where we build or operate a system for a client, this policy governs how we handle the information in it; the client remains the owner of their data and may have their own privacy policy governing their relationship with their customers.

Information we collect

• Account & contact information you provide — name, email, phone, and business details.
• Client business and financial records you share with us or authorize us to access so we can perform the engagement: transactions, invoices, bills, statements, payroll and tax records, and similar books of record.
• Financial account information via Plaid. Where a financial account is connected with authorization, we use Plaid Inc. to retrieve information such as account and routing identifiers, balances, and transaction history, so the books can be kept accurately.
• Documents you upload or send us, such as receipts, statements, and contracts.
• Credentials and access you grant us to your systems in order to perform the work — held only for the engagement and never used for anything else.
• Business contact information about prospective clients, gathered from public professional sources or from our conversations with you, used to reach out about our services.
• Usage information needed to operate and secure our systems.

We practice data minimization — we request only the data needed to provide the service you have authorized.

Plaid

Where a financial account is connected through our software, we use Plaid to establish that connection. By connecting an account you also agree to Plaid's End User Privacy Policy (plaid.com/legal), which describes how Plaid collects, uses, and handles that information. Plaid's data-transparency messaging in the connection flow discloses the data types and use case before the connection is made. Plaid acts as an independent controller of the connection data it handles.

How we use your information

Only to provide, support, and improve the services you have engaged us for — recording and categorizing transactions, reconciliation, reporting, building and operating the systems you have asked us to build, and related communication and support. We use business contact information to introduce our services and to follow up on conversations. We do not sell your personal, business, or financial information, and we do not share it for third-party advertising.

We use AI tools to help process and categorize information as part of delivering the service. Our AI provider is contractually bound to process that data only on our behalf and not to train its models on it. Automated suggestions affecting financial records are reviewed by a person before they are recorded.

Your data stays yours

Information belonging to a client is held by us to perform the engagement. We do not use it for our own purposes, do not commingle one client's data with another's, and return or delete it when the engagement ends — see Retention & deletion.

Consent

We collect, process, and store information based on your consent and to provide the service you request. You may withdraw consent by disconnecting a financial account and/or ending the engagement — see Your choices and rights. If you no longer wish to be contacted about our services, tell us and we will stop and remove your contact information.

How we protect your information

We use administrative, technical, and physical safeguards, including TLS 1.2+ in transit and encryption at rest (database encryption plus application-layer AES-256-GCM encryption of financial-account access tokens), least-privilege access, multi-factor authentication on accounts with access to sensitive data, separation of each client's data into its own repositories and environments, automated secret and dependency scanning, and an immutable audit log of changes to financial records. See our Information Security Policy and Access Control Policy for details. No system is perfectly secure, but we hold your information to the standards described in those policies and will tell you promptly if something goes wrong.

Service providers (subprocessors)

We share information only as needed with reputable providers that support the service: Plaid (financial-account connectivity), Vercel (hosting), Neon (database), Google (authentication and file storage), Resend (email), and Anthropic (AI processing) — each under their own security and privacy commitments. Our processing subprocessors — Google, Vercel, Neon, Resend, and Anthropic — may use your information only to perform services for us, under contract, and not for their own purposes, including to train their own models. Plaid handles financial-account connection data as an independent controller under its own End User Privacy Policy (described above). Where an engagement runs on a vendor you have selected, that vendor is governed by your agreement with them.

Retention & deletion

We retain information only as long as needed to provide the service or to meet legal obligations (for example tax and accounting), then delete it. Disconnecting a financial account removes the connection at Plaid (via /item/remove) and deletes the stored access token. At the end of an engagement we return or delete your data and revoke our access to your systems. See our Data Retention & Deletion Policy for the full schedule.

Your choices and rights

You may request access to, correction of, or deletion of your information; disconnect a financial account at any time; revoke access to Plaid, including via Plaid's portal at my.plaid.com; ask for an export of your data; and ask us to stop contacting you. We honor deletion requests subject to records we are legally required to retain, and we will tell you what we must keep and for how long. Contact security@rw-businessservices.com. Depending on your location, you may have additional rights under applicable privacy laws.

Changes

We will post any changes to this policy and update the effective date.