Data Processing Agreement

1. Scope and Roles

This Data Processing Agreement (the DPA) forms part of the Terms of Service between you and Mundyal Technology LLC, a Massachusetts limited liability company with its principal place of business in Holden, Massachusetts, United States ("EasyFlow360," "we," "us," or "our"). It applies whenever you use the Service to process personal data about other people, which for most customers means their own clients, employees, business owners, and vendors.

For that data you are the controller: you decide whose data goes into the Service and why. We are the processor: we process it to deliver the Service to you and for no purpose of our own. Where applicable law uses different words for the same two positions, such as operator or service provider in United States state privacy statutes, or operador under Brazil's Lei Geral de Proteção de Dados, this DPA applies in that position.

Data about your own staff accounts, your billing relationship with us, and your use of the Service is processed by us as a controller. The Privacy Policy covers that, not this DPA.

2. Your Instructions

We process personal data only on your documented instructions. Your instructions are the Terms of Service, this DPA, the configuration choices you make in the Service, and the actions your authorized users take in it. We will not use the data to train models, to build a profile of any individual, to market to your clients, or to sell to anyone. We do not sell personal data.

If an instruction you give us appears to require us to break a law that applies to us, we will tell you instead of carrying it out. If we are legally compelled to disclose data we hold for you, we will tell you before we do, unless the law forbids us from telling you.

You are responsible for having a lawful basis to put each person's data into the Service, for telling those people how their data is used, and for the accuracy of what you upload. We cannot assess that for you, because we do not know your clients.

3. Subject Matter, Duration, Nature and Purpose

The subject matter is the personal data you put into the Service. The purpose is to provide the Service: bookkeeping and reconciliation, document storage and electronic signature, invoicing and client payments, estimates and projects, scheduling, messaging, and the reports built on those records.

The nature of the processing is storage, hosting, retrieval, display, transmission, backup, and the automated processing described in section 7. It lasts as long as your account is active, plus the retention periods in section 11.

4. Categories of Data and Data Subjects

The data subjects are the people whose records you keep in the Service: your clients and their contacts, your staff whose accounts you create, and the business owners, vendors, and payees named in the books you keep.

Categories of personal data

• Identity and contact data: names, email addresses, phone numbers, postal addresses, and company affiliations
• Tax identifiers: Social Security Numbers and Employer Identification Numbers, held both for your clients themselves and for the business owners, vendors and 1099 recipients recorded in their books
• Financial account data: account names and types, the last four digits of account numbers, balances, and transaction history, from the bank and card connections your users authorize
• Documents and their contents: bank and card statements, receipts, tax forms, contracts, and anything else your users upload, including whatever personal data those files happen to contain
• Accounting records: invoices, payments, journal entries, estimates, projects, and 1099 drafts
• Electronic signature evidence: the signer's name, email address, IP address, device and browser, approximate location, and the full event history of each signature request
• Account and usage data: sign-in events, IP addresses, device and browser information, and the audit trails that record who did what in your workspace
• Messages and notes: messages, comments, appointment notes, and support conversations your users write

Tax identifiers and financial account data are the two categories that make a security incident notifiable under most United States state statutes. They are inventoried separately for that reason, and the Service does not ask for health data, biometric data, or payment card numbers. Card payments are taken by Stripe and the card number never reaches us.

5. Confidentiality and Access

Access to your data is limited to the people who need it to run the Service or to answer your support requests, and each of them is under a duty of confidentiality that survives the end of their engagement with us.

Administrative access to a customer workspace, including the impersonation used to reproduce a support issue, is written to a tamper-evident audit log in which each entry is hashed against the one before it. That log exists so an access can be shown to have happened, or shown not to have.

6. Security Measures

All traffic is encrypted in transit with TLS. Our database and our off-site backups are encrypted at rest. The tax identifiers we hold for business owners, vendors and 1099 recipients are additionally encrypted at field level, under a key kept separately from the database. Access is controlled by role, with per-company isolation enforced on every request. Passwords are hashed and never stored in readable form, and two-factor authentication is available to every user. Documents and files are stored on access-controlled infrastructure. Backups run nightly to a separate location, and the managed database supports point-in-time recovery.

Every money path and every signature carries an audit trail, and we hold no third-party security certification. We do not claim SOC 2, ISO 27001, or any equivalent, and a sentence anywhere in our material that implies one is wrong. What we offer instead is this document, the list in section 7, and a written answer to your security questionnaire.

7. Subprocessors

You give us general authorization to engage the subprocessors below. Each receives only what it needs for the function named, and each is bound by its own published data-processing terms.

• Stripe: payment processing, payout accounts, and the bank and credit-card connections your users authorize (Stripe Privacy Policy)
• Anthropic: reading the transactions out of statements your users upload, and suggesting a bookkeeping category for a transaction. A statement is sent in full, so whatever it contains is sent with it. Anthropic does not use data submitted through its API to train its models (Anthropic Privacy Policy)
• Our hosting, database, and backup providers: running the Service and storing your data
• Our email provider: delivering notifications, invoices, and signature requests

We will give you at least 30 days' notice before a new subprocessor starts processing your data, by email to your account's administrative contacts. If you object on reasonable data-protection grounds within those 30 days, tell us at contact@easyflow360.com and we will work to offer you a way to use the Service without that subprocessor. Where no such way exists, you may terminate the affected part of the Service and receive a refund of fees paid for the unused remainder of your term.

A current list naming every subprocessor, including the infrastructure providers not named individually above, is available on request at contact@easyflow360.com.

8. Helping You Answer Your Clients

When one of your clients asks you for access to their data, a correction, a copy, or a deletion, the request belongs to you and we will help you answer it. Most of it you can do yourself inside the Service, because the records are yours to edit and export. Where you cannot, write to contact@easyflow360.com and we will respond with what you need within 10 business days, at no charge for a reasonable volume of requests.

If one of your clients comes to us directly, we will not answer the substance of it. We will tell them to contact you and tell you that they did, because we are not the controller of that data and answering would be acting without your instruction.

9. Security Incidents

If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data we process for you, we will notify you without undue delay and in any event within 72 hours of becoming aware of it. The notice goes by email to your account's administrative contacts, and we will not wait until we have the full picture to send it.

The first notice will say what we know, which of the categories in section 4 are affected, how many records and companies appear to be involved, what we have done to contain it, and who at EasyFlow360 is running the response. We will follow it with further detail as the investigation produces it, and we will help you make any notification you owe to a regulator or to the people affected.

Notifying regulators and data subjects under GDPR Art 33 and 34, under LGPD Art 48, or under a United States state statute is your decision as controller, not ours. We will give you the facts you need to make it.

10. Audits and Assessments

On request, and no more than once a year unless an incident gives you cause, we will give you the information you need to show that we meet this DPA: a written answer to your security questionnaire, a description of our controls, and our answers about the subprocessors in section 7. We will also give you reasonable help with a data protection impact assessment that covers your use of the Service.

A questionnaire and this document are what we offer in place of a certification we do not hold. An on-site inspection of shared infrastructure we do not own is not something we can grant, and anyone who tells you otherwise about a platform of this size is describing a contract term rather than a visit.

11. Retention, Return and Deletion

You can delete records inside the Service at any time. A deleted record goes to Trash for 30 days so a mistake can be undone, and is then permanently removed by a daily job. Deleting a record does not delete the audit trail that says it was deleted, and it does not delete the evidence trail for a document that was electronically signed. Both of those exist to be producible later, which is the point of them.

When your account ends, you may ask us to return your data, and we will provide it in a machine-readable export. We will delete or anonymize the rest within 90 days of the end of your account, except where a law requires us to keep something for longer or where we need it to resolve a dispute between us. Backups age out on their own 30-snapshot cycle, so a record can persist in a backup for a short period after it is gone from the Service. We will confirm the deletion in writing when you ask us to.

To start that process, or to make a deletion request on behalf of one of your clients, use contact@easyflow360.com or the form at the account deletion page. Every request is logged with a due date on the 90-day clock, and the record of what was done and when is kept after the data is gone.

12. International Transfers

We are a United States company and the Service is operated from the United States. Some of the subprocessors in section 7 process data outside your own country. If you put data about people in the European Economic Area, the United Kingdom, or Switzerland into the Service, and a transfer mechanism is required for that data to reach us, we will enter into the European Commission's Standard Contractual Clauses with you, in the controller-to-processor module, on request and at no charge. Tell us at contact@easyflow360.com and say which people the clauses need to cover. Until those clauses are signed, do not assume a transfer mechanism is in place for your account.

13. Brazil

Where you are in Brazil or the people whose data you upload are, we act as operador under the Lei Geral de Proteção de Dados, processing only on your instructions as controlador, and sections 5, 6, 9, 10 and 11 of this DPA are how we meet Art 39. This document is published in English and in Brazilian Portuguese, and section 16 says which version governs.

14. How This Agreement Takes Effect

This DPA takes effect when someone who can bind your company accepts it in the Service. We record that acceptance the way we record a signature: the exact sentence shown, a cryptographic hash of this document as it read at that moment, the revision above, who accepted it, the role they held, their IP address, and the time. If we change this document, the new revision is presented for acceptance again rather than taking effect silently.

No wet signature or countersigned PDF is needed. If your procurement process requires one, write to us and we will sign your copy, which will say the same thing this page does.

15. Precedence and Liability

On the processing of personal data, this DPA prevails over anything inconsistent in the Terms of Service. On everything else the Terms govern, including the limitation of liability in section 11 of those Terms, which applies to this DPA as it does to the rest of the agreement between us. Nothing here limits a right a data subject has directly under applicable law.

16. Language

This DPA is published in English. A Brazilian Portuguese translation is available at easyflow360.com/pt/dpa, and the app serves the same translation when your language is set to Portuguese. The translation is there to be read, not to replace this text: where the two differ in meaning, the English version governs, and it is the English version your acceptance record points at.

17. Contact Us

For anything in this DPA, including a questionnaire, an incident, Standard Contractual Clauses, or a deletion request:

contact@easyflow360.com

Mundyal Technology LLC, Holden, Massachusetts, United States