Privacy
Last updated 11/04/2026
Who we are
Tillwell is an invoicing and bookkeeping app for service businesses, run by RBR Hospitality LLC, New York. For now, businesses join by invitation. Questions or requests: rephael@pardesnyc.co.
What the app keeps
- Your account: username, name, email and password (stored only as a secure hash by our sign-in provider).
- What your business enters: company details, clients and their contact details, invoices, payments, expenses and receipt photos, and pantries (items, prices paid, photos).
- The devices and browsers your account has signed in from (a scrambled id and a name like “Safari on iPhone”), so we can email you when a new one signs in.
- If your business connects a bank (only when the app's admin switches Banking on for you): account names and last 4 digits, balances, and transactions (date, amount, description, the bank's category). Never your bank password: you sign in to your bank in Plaid's window, not in this app.
How it’s used
Only to run the app for your business: invoices and PDFs, emails you send to clients, expenses and pantries, matching bank deposits to payments, sorting charges into expenses, the assistant, and backups. Nothing is sold or used for advertising, and there are no tracking cookies. The app's cookies keep you signed in, remember which company you're working in, and recognise your device for sign-in alerts; your light or dark choice and a few screen settings stay in your browser.
Services that help run it
- Supabase: database, file storage and sign-in (United States).
- Vercel: hosting the app (United States).
- Plaid: connecting bank accounts. Plaid's own End User Privacy Policy covers what it does.
- Resend: delivering invoice emails.
- Anthropic (Claude): reading receipt photos you scan, answering the assistant, and suggesting a category for unclear bank charges from the store name, amounts and the bank's category (no account numbers, balances, names or bank sign-ins are sent for that). Under Anthropic's commercial terms this data isn't used to train its models.
- Google Drive: nightly backups, to your business's own drive, when set up.
The assistant
When the assistant is switched on for you, your question and the business records needed to answer it (for example invoice totals or pantry items) go to Anthropic to write the answer. The app keeps only how much each question cost, not the question or the answer; the conversation lives in your browser. Changes it proposes are kept for an hour so you can confirm or undo them, things you ask it to remember stay with your business (Company → What the assistant knows), and receipts you drop in the chat are deleted after two days unless you save them. When it looks something up on the web, names and amounts are removed from the search first.
Learning from other businesses
A business can share, without names, what kind of expense a store is (for example “food cost”), so the app sorts charges better for everyone. Stores and businesses are scrambled with a secret key that only the server has; no amounts or dates are shared. Each business can turn this off on Banking → Rules, which removes what it shared.
How it’s protected
Every connection is encrypted (TLS). Each business's data is walled off in the database, so one business can't see another's. Bank access keys are encrypted and never reach your browser. Two-step sign-in with an authenticator app is available to every account and required for Banking and for the app's admin. A sign-in from a new device or browser is emailed to the account.
Keeping and deleting
Your data stays while your business uses the app. Disconnecting a bank removes its accounts and transactions from the app and ends Plaid's access. To delete your account or your business's data (until that's a button in the app), email rephael@pardesnyc.co and we'll do it within 30 days, apart from records the law requires a business to keep.