Legal
Privacy policy
Plain-English summary: rux reads the business data our customers connect — point-of-sale sales, delivery-platform settlements, bank transactions, payroll, and supplier invoices — to keep their books and show them how their restaurants are performing. We read only what a customer authorizes, we use it only to provide the service to that customer, we never sell it, and we delete it when they ask.
1. Who this covers
This policy describes how rux handles information from restaurant operators who use rux ("customers"), their staff who are given access, and visitors to ruxsystems.ai. rux is a business-to-business service; we do not market to or collect information from consumers.
2. What we collect
- Account information: name, work email, role and the locations a user may access.
- Connected business data, only from systems a customer explicitly authorizes: point-of-sale sales and labor data; delivery-platform orders, settlements, fees and promotions; bank and card transactions; payroll runs (wages, taxes and hours); supplier invoices and prices; inventory counts and recipes.
- Technical data: sign-in events, IP address, browser type and an audit trail of changes made in the application.
Connected business data may include names of employees (from payroll and scheduling) and, depending on the platform, limited order details. rux does not request or store Social Security numbers, bank login credentials, full card numbers, or consumer contact details.
3. How we get it
Through integrations that the customer authorizes, using the provider's own authorization flow (for example, a customer signs in at the provider and chooses which stores to share). Access tokens and API credentials are stored encrypted; rux never sees or stores a customer's password for those systems. Customers can also upload documents such as invoices and statements directly.
4. How we use it
- To provide the service: keeping the customer's books, reconciling settlements and payments, producing financial and operational reports, and explaining the figures behind them.
- To operate and secure the service: authentication, audit logging, fraud and abuse prevention, troubleshooting.
- To communicate with the customer about their account.
We do not sell or rent data. We do not use one customer's data to benefit another customer, and we do not use customer business data to train machine-learning models. Where an AI model is used to write plain-language explanations, it receives computed figures and record references, never raw account or personal data.
5. Who we share it with
Only service providers that help us run rux, under contracts that restrict them to that purpose: cloud database and storage hosting (Supabase), application hosting (Vercel), and the integration providers a customer connects (for example, Plaid for bank connections and Finch for payroll connections). We also disclose information when required by law or to protect the rights and safety of rux, our customers or others. We will tell affected customers about a legal request unless we are legally prevented from doing so.
6. Data from delivery platforms and other providers
When a customer connects a third-party platform (such as Uber Eats, DoorDash or Grubhub), rux uses that platform's data solely to provide accounting and reporting to that customer, in accordance with the platform's developer terms. We do not redistribute platform data, use it for advertising, or build profiles of the platform's consumers. A customer can revoke rux's access at any time from the platform's own settings or by asking us.
7. Security
Data is encrypted in transit and at rest; integration credentials are additionally encrypted with keys held outside the database. Access within rux is controlled by role and location, every change to financial records is logged, and customer data is isolated per organization at the database level. We will notify affected customers without undue delay, and in any case within 72 hours, of a confirmed security incident involving their data.
8. Retention and deletion
We keep connected business data for as long as the customer's account is active, because accounting records are meant to be kept. When a customer closes their account, or on request, we delete their data within 30 days, except where we must keep a copy to comply with law or to resolve a dispute. Customers can export their records at any time.
9. Your choices
Customers control which systems are connected and which users have access, and can disconnect any integration at any time. People whose information appears in a customer's data (such as employees) should direct requests to that customer, who controls the data; we will assist the customer in responding. For questions or requests directed to rux, email dev@ruxsystems.ai.
10. Website visitors
ruxsystems.ai does not use advertising trackers. Our hosting provider records standard server logs (IP address, page requested, browser) to operate and secure the site. Fonts are loaded from Google Fonts, which receives your IP address when the page loads.
11. Changes
If this policy changes in a way that matters, we will update the date above and notify customers by email before the change takes effect.
12. Contact
RUX Systems · dev@ruxsystems.ai