This policy explains how RITALIX EVENTS LTD ("we", "us") handles personal data in connection with RMAflow. We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where it applies, the EU GDPR.
1. Two roles we play
- Controller — for account data about people who sign up and use RMAflow (you and your teammates).
- Processor — for the data your company enters about its own customers and suppliers (names, emails, phone numbers, addresses, order and return details). Your company is the controller of that data and decides why it is collected. If you are one of their customers, please contact that company first.
2. What we collect
- Account details: name, email address, password (stored only as a secure hash), and sign-in provider identifier if you use Google or Lovable sign-in.
- Workspace details: workspace name, membership and role, invite records, and the date you accepted our Terms.
- Customer Data your company enters (see section 1).
- Technical data: IP address, browser type and security logs needed to run and protect the Service.
3. Why we use it and our legal basis
- To provide your account and workspace — performance of a contract.
- To keep the Service secure, prevent abuse and fix problems — legitimate interests.
- To send essential service emails such as sign-up confirmation and password reset — performance of a contract.
- To meet legal obligations — legal obligation.
We do not sell personal data, do not use it for advertising, and do not use Customer Data to train AI models.
When you choose AI-powered screenshot or receipt reading, the selected image is sent to our AI service provider to extract visible details. This is optional; you can enter the details manually. Review extracted information before saving, and upload only information you are authorised to process. Stored receipts are private to your workspace and opened through short-lived access links.
4. Who we share it with
Only with service providers who help us run RMAflow under contract and confidentiality (sub-processors): cloud hosting, database and private document storage providers, authentication and email delivery providers, and AI providers when you choose image reading. Some may process data outside the UK; where they do, we rely on UK adequacy regulations or the UK International Data Transfer Addendum / Standard Contractual Clauses. We may also disclose data where required by law.
5. Security
Data is encrypted in transit, access is protected by authentication, and each company's workspace is isolated at the database level so members of one workspace cannot read another's data. Only authorised staff can access systems, and only when needed for support or security.
6. How long we keep it
- Account data: while your account is active, then deleted within 30 days of a deletion request.
- Customer Data: until the workspace owner deletes it or the workspace, then removed within 30 days (backups roll off within a further 30 days).
- Security logs: up to 12 months.
7. Your rights
You can ask to access, correct, delete, restrict or object to our use of your personal data, and to receive it in a portable format. Workspace admins can export their workspace data from Settings. To make a request, email events@ritalix.com; we will reply within one month. You can also complain to the UK Information Commissioner's Office (ico.org.uk).
8. Cookies
We use only strictly necessary storage. See our Cookie Policy.
9. Children
RMAflow is a business tool and is not intended for anyone under 18.
10. Changes
We will post any changes here and, if they are significant, notify users in the app.
11. Contact
RITALIX EVENTS LTD, 129 Station Road, London, England, NW4 4NJ · events@ritalix.com