RichbeeQuickstart

Attorney review pending. This document is a draft and is not in effect.

Terms of Service — Richbee Business Services

Between {{LEGAL_ENTITY}} ("Richbee") and the customer accepting these Terms ("Customer"). Effective {{EFFECTIVE_DATE}}. Governing law: Texas [ATTORNEY]. Services: agent-only API/MCP services at [service].richbee.ai (CRM, then KMS, BPM, DMS, ATS).

1. Agents are the clients

1.1 The Services are used by software agents acting for Customer. Access uses scoped API keys sent as Bearer tokens (Richbee stores only hashes) or OAuth 2.1 for MCP clients (planned). Customer is responsible for every action taken with its API keys or OAuth grants, whether by a person, an agent or an automated system, as if Customer took it. 1.2 Customer must keep keys secret, use the narrowest scopes, rotate keys, and revoke a key promptly (and tell us at {{SECURITY_EMAIL}}) if it is compromised. Richbee cannot recover a lost key, only issue a new one. We may suspend a key we reasonably believe is compromised. 1.3 Customer must supervise its agents and is responsible for their outputs and for any instructions they follow, including injected ones.

2. Acceptable use (automated access)

Customer must not: exceed or evade published rate limits (for example by rotating keys); probe other tenants, or security-test without written permission; store malware; send spam; process data unlawfully or without a lawful basis; use the Services for consequential decisions about individuals in violation of law; or resell access without permission. Unless agreed in writing, Customer must not store payment card data, health data, government ID numbers or other sensitive data, except as §2.1 allows in the ATS Service. 2.1 ATS/HR sensitivity [ATTORNEY REQUIRED]. Candidate data can involve EEO-protected characteristics (Title VII, ADEA, ADA) and background or consumer-report information (FCRA, 15 U.S.C. §1681 et seq.). Richbee is not a consumer reporting agency, and the Services do not furnish consumer reports. Customer must not use the Services to make or automate hiring decisions in violation of anti-discrimination law. Customer is solely responsible for FCRA disclosures, authorizations and adverse-action notices, and for complying with AI-in-hiring laws (for example NYC Local Law 144 and the Illinois AI Video Interview Act). Customer must not store protected-characteristic data unless required (for example voluntary EEO self-identification kept apart from hiring decisions). [ATTORNEY: confirm before ATS launch.]

3. Customer Data

3.1 Customer owns Customer Data and grants Richbee only the rights needed to provide the Services. Richbee does not train AI models on Customer Data, and no AI provider processes it. 3.2 Export: at any time, a JSON + CSV bundle with checksums, delivered by a short-lived signed link (planned). 3.3 Deletion (planned): single records at any time; the whole account after confirmation, followed by a default 7-day grace period that Customer may skip. When the grace period ends, the database, storage, search and caches are purged within 24 hours, and Richbee issues a deletion receipt. Neon restore history expires within {{BACKUP_RETENTION}} after that. This is currently 6 hours on the Neon Free plan; it rises if the plan changes, and Richbee will give notice first. Retained after deletion: Stripe billing records (held by Stripe under its terms and tax law), plus a minimal audit trail (tenant ID, action, timestamps, no record contents) and the deletion receipt, for {{RETAINED_RECORDS_PERIOD}} [draft default 3 years, pending Israel, CPA and attorney]. 3.4 Residency: stored in US data centers (Neon aws-us-east-1; Cloudflare), processed primarily in the US.

4. Fees

Billed through Stripe per the plan on the pricing page. {{PRICING_REFUND_DUNNING}} [DECISION FOR ISRAEL]. Texas sales tax may apply to SaaS (80% of the charge is taxable) [CPA].

5. Availability and changes

No SLA unless agreed in writing. API versions are deprecated with at least {{API_DEPRECATION_NOTICE}} days' notice.

6. Suspension and termination

Either party may terminate for convenience on notice, or for an uncured material breach after 30 days. Customer keeps export access for {{POST_TERMINATION_EXPORT_WINDOW}} after termination, after which §3.3 applies.

7. Warranties and liability [ATTORNEY]

The Services are provided "as is". Liability is capped at fees paid in the 12 months before the claim, with no indirect damages. Exclusions: breach of §2, indemnity, and a data-protection carve-out to be decided.

8. Indemnity [ATTORNEY]

Customer indemnifies Richbee against claims arising from Customer Data, its agents' actions, or breach of §2, including ATS/FCRA/EEO claims.

9. Data Processing Terms (DPA)

Modeled on GDPR Art. 28(3), and intended as a CCPA service-provider contract (Cal. Civ. Code §1798.100(d), §1798.140(ag); 11 CCR §7051) and a TDPSA processor contract (Tex. Bus. & Com. Code §541.104). [ATTORNEY: confirm each statute's required terms are met.] 9.1 Roles and instructions. Customer is controller/business; Richbee is processor/service provider. Richbee processes Customer Personal Data only on Customer's documented instructions (these Terms, and API/MCP calls made with Customer's credentials), unless law requires otherwise, and tells Customer if an instruction appears to infringe law. 9.2 Description. Subject matter: storing and processing business records through the Services. Duration: the term plus the §3.3 periods. Data subjects: Customer's personnel and end users whose data Customer stores, such as CRM contacts (names, emails, phones, company, interaction history) and ATS candidates (CVs, work history, contact details, interview notes, possibly sensitive data; see §2.1). Processing: storage, retrieval, search, export, deletion. Storage (planned): Neon Postgres (aws-us-east-1); Cloudflare KV; R2 for exports and attachments; no D1. 9.3 CCPA. Richbee will not sell or share Customer Personal Data; will not retain, use or disclose it outside the direct business relationship or for any purpose other than the business purposes in these Terms; and will not combine it with other data except as 11 CCR §7050 permits. Richbee will comply with the CCPA, give the same level of protection, tell Customer if it can no longer meet its obligations, and let Customer take reasonable steps to stop unauthorized use. Richbee certifies it understands these restrictions. 9.4 Confidentiality. Everyone processing the data is bound by confidentiality (currently Israel Richner only). 9.5 Security (planned). Encryption in transit and at rest; tenant isolation by tenant ID with Postgres row-level security; hashed, scoped API keys; OAuth 2.1 for MCP; audit log of every write (no record contents); Workers Logs kept about 3 days, excluding secrets and record bodies; least-privilege admin access with MFA. No SOC 2/ISO certification held. 9.6 Subprocessors. Customer gives general authorization to the subprocessors in subprocessors.md (currently Cloudflare and Neon, plus Stripe for billing data). Email and error-tracking providers are not yet chosen and will be added with notice. Richbee gives at least [14] days' email notice before a new subprocessor processes Customer Data. Customer may object on reasonable data-protection grounds within that period; if the objection is unresolved, Customer may terminate the affected Services, receive a pro-rata refund of prepaid fees, and have its data deleted. Emergency replacements may start sooner, with notice as soon as practicable and the same objection right. Richbee binds subprocessors to equivalent written terms and remains liable for them (GDPR Art. 28(2), (4); TDPSA §541.104). [ATTORNEY: confirm subsection cites.] 9.7 Assistance. Richbee helps Customer with data-subject requests (through the export and delete APIs, and by forwarding requests it receives), security, breach notification, DPIAs and prior consultations (GDPR Arts. 32–36; TDPSA §541.104(a)). 9.8 Breach notice. Richbee notifies Customer without undue delay, and in any event within 72 hours, and immediately where Texas law requires (Tex. Bus. & Com. Code §521.053(c)), after becoming aware of a personal data breach affecting Customer Personal Data. Notice goes by email to the account owner and security contact. It describes the nature of the breach, the categories and approximate numbers affected, the likely consequences, the measures taken, and a contact, and is supplemented as facts emerge. Source: https://statutes.capitol.texas.gov/Docs/BC/htm/BC.521.htm 9.9 Deletion and return. At the end of the services, Richbee deletes or returns Customer Personal Data at Customer's choice (§3.2–3.3), unless law requires retention, and confirms by deletion receipt. If Richbee restores a backup, it re-applies all deletions recorded after the restore point before the data is used again. 9.10 Audits. Richbee makes available the information needed to demonstrate compliance and answers a reasonable security questionnaire within [30] days. If that is insufficient, a regulator requires it, or after a breach, Customer may audit once a year on 30 days' notice, at Customer's cost, by a mutually agreed auditor under confidentiality (GDPR Art. 28(3)(h); TDPSA §541.104). 9.11 Transfers. Data is stored in the US. For GDPR/UK data, the EU SCCs (Decision (EU) 2021/914, Module 2) and the UK IDTA Addendum apply [ATTORNEY: needed only if there are EU/UK customers]. 9.12 Precedence. This §9 prevails on data protection.

10. General

Notices by email; assignment; force majeure; entire agreement. [ATTORNEY]