Privacy & Data Protection for RED
Last updated: 2026.06.03.
Company: Rhea - Rhea Holdings SRL
Product: RED — Rhea Encrypted Data
Contact: security@rhea.red
RED is built to help organizations protect, control, and audit access to sensitive data. This page explains how RED handles personal data, what information we process, how our security model works, and what rights users and customers have.
This page applies to RED and related RED enterprise services, including organization workspaces, encrypted documents, Bring Your Own Storage connections, Bring Your Own Database features, identity and access controls, audit logs, usage measurement, billing-related records, and security approvals through Rhea Key where enabled.
This page is not a marketing claim that every customer deployment is automatically compliant with every privacy law. Privacy compliance depends on how each organization configures RED, what data it uploads or connects, where it operates, which users it invites, and which legal obligations apply to that organization.
1. Our privacy position
RED is designed around a simple principle:
Your organization should keep control over its data, and RED should only process what is necessary to provide security, access control, encryption, auditing, usage measurement, and administration.
RED is not designed to sell user data, build advertising profiles, or scan customer content for advertising purposes.
Where possible, RED is designed so that customer files and protected records are encrypted before or during storage and access is controlled through organization permissions, cryptographic workflows, approval mechanisms, and audit records.
2. Who controls the data?
The role of Rhea depends on the type of data involved.
Customer content
For files, documents, database records, metadata, and other content uploaded, connected, encrypted, protected, or managed by an organization inside RED, the customer organization is generally the data controller.
Rhea generally acts as a data processor for that customer content, because RED processes the data on behalf of the organization and according to the organization’s configuration, permissions, users, storage choices, and instructions.
Examples of customer content may include:
- encrypted documents;
- uploaded files;
- file request submissions;
- database records connected through BYOD;
- object storage content connected through BYOS;
- document metadata;
- access control metadata;
- organization workspace data;
- audit records related to customer users and protected resources.
The customer is responsible for making sure it has a valid legal basis to upload, connect, protect, share, or otherwise process personal data through RED.
Account, billing, security, and service administration data
For account creation, billing, fraud prevention, platform security, service communications, abuse prevention, and internal administration, Rhea may act as an independent data controller.
This may include information such as:
- account holder name;
- business email address;
- organization name;
- billing details;
- subscription status;
- plan information;
- support communications;
- technical logs;
- security events;
- device or session information;
- payment and invoice references.
3. What data RED processes
RED may process the following categories of information depending on how the product is used.
Account and organization information
We may process:
- name;
- business email address;
- organization name;
- role inside the organization;
- invited members;
- workspace settings;
- permission settings;
- admin actions;
- authentication and session information.
We use this information to create accounts, manage organizations, authenticate users, apply permissions, provide support, and operate RED.
Protected customer content
Depending on customer use, RED may process:
- encrypted files;
- encrypted document data;
- file names and metadata;
- database connection metadata;
- database query metadata;
- storage connection metadata;
- encrypted keys or wrapped key material;
- access approvals;
- file request uploads;
- records protected through RED’s encryption and access layers.
RED is designed to protect this content through encryption and access control. However, the exact technical handling depends on the feature, customer configuration, storage provider, database provider, and integration path.
Security and audit data
RED may process security and audit information such as:
- sign-in events;
- session events;
- access attempts;
- permission changes;
- document access events;
- encryption or key-related events;
- approval requests;
- Rhea Key signing or approval events;
- organization administration actions;
- system integrity checks;
- usage measurement records.
We use this information to provide security, accountability, auditability, incident investigation, compliance support, and enterprise administration.
Usage and billing data
RED may process usage and billing-related records such as:
- selected plan;
- active plan;
- usage volume;
- daily usage snapshots;
- billing period information;
- metered usage records;
- invoice status;
- payment status;
- customer billing identifiers;
- tax-related billing information where applicable.
We use this data to calculate usage, provide invoices, manage subscriptions, support enterprise contracts, and prevent billing abuse.
Support and communication data
If you contact us, we may process:
- your name;
- email address;
- organization;
- message contents;
- attachments you send to support;
- technical information needed to investigate the issue.
Please do not send unnecessary sensitive personal data through support channels unless it is required to resolve the issue.
4. What RED does not do
RED does not use customer protected content for advertising.
RED does not sell customer personal data.
RED does not intentionally train public AI models on customer protected content.
RED does not give other customers access to your organization’s protected data.
RED does not treat access to encrypted customer content as normal business data. Protected content is handled according to RED’s security model, organization permissions, and customer configuration.
5. Encryption and security model
RED is designed to protect data through encryption, access controls, organization permissions, and auditability.
Depending on the feature and customer configuration, RED may use:
- encryption before or during storage;
- wrapped data encryption keys;
- organization-level key handling;
- user or owner key workflows;
- Rhea Key approvals and cryptographic signing;
- access-control checks;
- role-based permissions;
- security audit logs;
- storage and database connection controls;
- restricted execution paths for sensitive operations.
For Bring Your Own Storage, RED may allow organizations to connect external storage providers. In that case, the customer’s chosen storage provider may also process or store encrypted content and related metadata under the customer’s separate agreement with that provider.
For Bring Your Own Database, RED may allow organizations to connect databases and apply RED security controls, permissions, policies, query restrictions, field protection, audit trails, and related enterprise controls. The customer remains responsible for the database provider, database configuration, data classification, permissions, and the legality of the data stored in or connected through that database.
No security system can be honestly described as impossible to breach. RED is designed to reduce exposure and increase control, but customers must still configure access, permissions, storage, identity, and internal processes responsibly.
6. Legal bases for processing
Where Rhea acts as a controller, we may process personal data under one or more of the following legal bases:
Contract
We process personal data where necessary to provide RED, manage accounts, operate subscriptions, deliver enterprise services, process billing, and provide support.
Legitimate interests
We may process personal data for security, fraud prevention, abuse prevention, service improvement, auditability, debugging, infrastructure reliability, and protecting RED, Rhea, customers, and users.
Legal obligation
We may process personal data where required for tax, accounting, legal compliance, regulatory obligations, dispute handling, or responding to lawful requests.
Consent
Where required, we may rely on consent, for example for certain optional communications, cookies, or similar technologies. Where processing is based on consent, consent can be withdrawn according to the process provided.
Where Rhea acts as a processor, the customer organization is responsible for determining the appropriate legal basis for processing customer content and end-user personal data.
7. How RED uses data
We use personal data to:
- provide RED and related services;
- create and manage accounts;
- authenticate users;
- manage organization workspaces;
- enforce permissions and access controls;
- encrypt, decrypt, protect, route, or manage customer content according to product functionality and customer instructions;
- process file requests and secure submissions;
- support Bring Your Own Storage and Bring Your Own Database connections;
- record audit logs and security events;
- provide Rhea Key approvals and signing workflows where enabled;
- measure usage;
- calculate billing;
- issue invoices;
- provide support;
- detect abuse, unauthorized access, or security incidents;
- maintain service reliability;
- improve RED’s functionality, security, and performance;
- comply with legal obligations.
8. Sharing and subprocessors
We may share personal data with service providers and subprocessors that help us operate RED.
These may include providers for:
- cloud infrastructure;
- database hosting;
- object storage;
- authentication;
- payment processing;
- billing and tax calculation;
- email delivery;
- analytics for service reliability;
- error monitoring;
- customer support;
- security monitoring.
We require service providers to process personal data only for permitted purposes and to apply appropriate security measures.
For customer-controlled integrations, such as external storage providers, database providers, identity providers, or other customer-connected services, the customer is responsible for reviewing and accepting those providers’ terms and privacy practices.
A current list of subprocessors should be made available at:
[Insert subprocessor page link]
Until that page is published, customers may request subprocessor information by contacting:
[Insert privacy contact email]
9. International transfers
RED may be operated using infrastructure and service providers located in different countries.
Where personal data is transferred internationally, Rhea will use appropriate safeguards where required, such as adequacy decisions, standard contractual clauses, data processing agreements, or other lawful transfer mechanisms.
Customer organizations are responsible for choosing appropriate regions, storage providers, database providers, and configurations where RED gives them such choices.
10. Data retention
We keep personal data only for as long as necessary for the purposes described in this page, unless a longer retention period is required by law, contract, security needs, billing obligations, dispute resolution, or legitimate business requirements.
Retention periods may vary by data category.
Account and organization data
Kept while the account or organization remains active, and for a reasonable period afterward where needed for security, legal, billing, or operational purposes.
Customer content
Customer content is generally retained according to the customer’s configuration, deletion actions, storage provider settings, contract, and applicable product functionality.
Where customers use their own storage or database, deletion may also depend on the customer’s external provider and configuration.
Audit logs and security records
Audit logs and security records may be retained for longer periods because they are necessary for security, compliance, incident investigation, and enterprise accountability.
Billing and tax records
Billing, payment, invoice, and tax-related records may be retained as required by accounting, tax, legal, and regulatory obligations.
Support communications
Support records may be retained as long as necessary to resolve issues, maintain business records, improve service reliability, and handle disputes.
11. Deletion
Customers may delete content, users, workspaces, or integrations according to RED’s available product controls.
Deletion behavior may depend on:
- whether the content is stored inside RED-managed infrastructure;
- whether the customer uses Bring Your Own Storage;
- whether the customer uses Bring Your Own Database;
- whether backups or logs exist;
- whether billing, security, legal, or audit retention obligations apply;
- whether deletion is technically available for the relevant feature.
Some records may not be immediately deleted from backups, logs, invoices, or audit systems. Where immediate deletion is not possible, access is restricted and records are retained only for the necessary period.
12. Data subject rights
Depending on applicable law and the context of processing, individuals may have rights including:
- the right to access personal data;
- the right to correct inaccurate personal data;
- the right to request deletion;
- the right to restrict processing;
- the right to object to processing;
- the right to data portability;
- the right to withdraw consent where processing is based on consent;
- the right to complain to a data protection authority.
If your personal data is processed by a customer organization using RED, you should usually contact that organization first. In that case, the organization is normally the controller of the data and Rhea acts as its processor.
If you contact Rhea about data controlled by a customer organization, we may need to forward your request to that customer or ask you to contact them directly.
To exercise rights for data where Rhea is the controller, contact:
[Insert privacy contact email]
We may need to verify your identity before responding.
13. Enterprise customer responsibilities
Enterprise customers using RED are responsible for:
- deciding what data to upload, connect, encrypt, protect, or process through RED;
- ensuring they have a lawful basis for processing personal data;
- configuring users, roles, permissions, and access policies correctly;
- managing their own storage providers, database providers, identity providers, and connected services;
- reviewing subprocessors and integration providers;
- responding to data subject requests where they are the controller;
- maintaining internal security policies;
- training authorized users;
- preventing misuse of access credentials;
- reviewing audit logs and security alerts;
- complying with industry-specific laws that apply to their data.
RED provides security and control tools, but the customer remains responsible for how those tools are used inside its organization.
14. Rhea Key and approval workflows
Where Rhea Key is used with RED, RED may process approval, signing, authentication, session, and device-related security events.
Rhea Key is intended to support secure approval and identity-based access workflows. It may be used to approve access, authorize sensitive actions, or support cryptographic signing flows.
The exact information processed depends on the customer configuration and the enabled workflow.
Rhea Key approval records may be retained as part of security, audit, and compliance logs.
15. Bring Your Own Storage
RED may allow customers to connect external storage providers.
When a customer connects external storage:
- the customer chooses the storage provider;
- the customer controls the external account or bucket where applicable;
- encrypted content and related metadata may be stored with that provider;
- the provider’s own terms, privacy policy, security, region, and retention practices may apply;
- RED may process connection metadata, storage keys, object references, usage information, and audit records needed to operate the connection.
Customers should configure storage permissions carefully and ensure that their storage provider is appropriate for the data they process.
16. Bring Your Own Database
RED may allow customers to connect databases and apply security, policy, audit, and access-control layers.
When a customer connects a database:
- the customer remains responsible for the source database;
- the customer controls what data exists in that database;
- RED may process connection metadata, policies, query metadata, field policies, audit logs, and encrypted credentials or protected connection material;
- database providers may process data under their own terms and customer configuration;
- RED security features depend on correct configuration and supported database capabilities.
Customers should not connect databases containing personal data unless they have the right to do so and have configured permissions, policies, and access restrictions appropriately.
17. Cookies and similar technologies
The RED website and application may use cookies or similar technologies for:
- authentication;
- session management;
- security;
- remembering preferences;
- measuring service reliability;
- understanding product usage;
- improving the website and application.
Where required, optional cookies or similar technologies will be subject to consent controls.
Essential cookies required for security, login, fraud prevention, or service delivery may be used without optional consent where legally permitted.
18. Children
RED is intended for business and enterprise use. It is not intended for children.
Customers should not intentionally invite children or upload children’s personal data into RED unless they have a lawful basis and all required safeguards.
19. Security incidents
If we become aware of a security incident affecting personal data, we will investigate and take appropriate action.
Where required, we will notify affected customers, regulators, or individuals according to applicable law and contractual obligations.
Customers are responsible for notifying their own users, employees, customers, regulators, or other affected parties where they are the controller and where the law requires them to do so.
20. Changes to this page
We may update this Privacy & Data Protection page from time to time.
When we make material changes, we will update the “Last updated” date and, where appropriate, provide additional notice.
Continued use of RED after an update means the updated page applies from the effective date, unless a separate written agreement states otherwise.
21. Contact
For privacy questions, data protection requests, or subprocessor information, contact:
For enterprise security, compliance, or data processing agreement requests, contact:
For billing questions, contact: