Data Processing Agreement

1. Definitions and roles

"Customer Personal Data" means personal information in Customer Data that Aqqrue processes on behalf of Customer to provide the Services. "Applicable Privacy Law" means US federal and state privacy, data-security, and breach-notification laws applicable to a party's processing under the agreement, including the California Consumer Privacy Act as amended ("CCPA") where applicable. "Process" includes collection, storage, access, use, disclosure, transmission, deletion, and similar operations. "Security Incident" means confirmed unauthorized acquisition, access, use, or disclosure of Customer Personal Data in Aqqrue's possession or control that compromises its confidentiality or security; unsuccessful attempts that do not compromise data are excluded.

Customer acts as controller or business when it determines the purposes and means of processing its client or business information, or as processor or service provider on behalf of its own clients. In the latter case, Aqqrue acts as Customer's subprocessor. Aqqrue acts as processor or service provider with respect to Customer Personal Data in either case and acts independently with respect to its own account, billing, and website data as described in the Privacy Policy. Customer warrants that it is authorized to give Aqqrue instructions and engage subprocessors for the data concerned.

2. Scope and instructions

Aqqrue will process Customer Personal Data only (a) as necessary to provide the specific accounting workflow services and support detailed in Schedule 1; (b) on Customer's documented instructions, including configuration, prompts, authorized integrations, and use of features; (c) as expressly permitted by this DPA and Applicable Privacy Law; or (d) as required by law, in which case Aqqrue will inform Customer beforehand where legally permitted. Aqqrue will promptly tell Customer if, in Aqqrue's reasonable judgment, an instruction violates Applicable Privacy Law and may decline an unlawful instruction.

Aqqrue will not sell or share Customer Personal Data for cross-context behavioral advertising or use it to train Aqqrue or third-party foundation models. The permitted processing purposes are transaction and bank-feed classification; document extraction; bill, invoice, journal-entry, and reconciliation workflows; QBO and other authorized integrations; workpapers and audit trails; product support and issue diagnosis; fraud and security monitoring; and maintenance, backups, and restoration. Aqqrue will not use Customer Personal Data to service unrelated customers or for unrelated commercial purposes.

3. US state privacy

To the extent the CCPA or comparable Applicable Privacy Law applies, the parties agree that Customer provides Customer Personal Data to Aqqrue solely for the limited and specified business purposes in Section 2 and Schedule 1. Aqqrue is a service provider or contractor, as applicable, and will: (i) not sell or share Customer Personal Data; (ii) not retain, use, or disclose it for purposes other than those specified in this DPA or expressly permitted by the relevant law; (iii) not retain, use, or disclose it outside the direct business relationship with Customer except as legally permitted; and (iv) not combine it with personal information from other customers, other sources, or Aqqrue's own interactions except as expressly permitted by law.

Aqqrue will provide the same level of privacy protection for that data as is required of it under Applicable Privacy Law; notify Customer if it determines it can no longer meet relevant obligations; and cooperate reasonably with Customer to stop and remediate unauthorized use of Customer Personal Data. Customer may take reasonable and appropriate steps to help confirm compliance and, following notice of noncompliance, to stop and remediate it, subject to security, confidentiality, and the audit provisions below. Aqqrue will pass applicable restrictions to subprocessors by written agreements.

4. Personnel and access

Aqqrue will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations and receive appropriate security training. Access to production databases and documents is role-limited and allowed only as needed to operate or troubleshoot the Services, investigate customer issues, or fulfill authorized instructions. This applies to US-based and internationally based personnel. Aqqrue will maintain access governance, logging, and other safeguards described in Schedule 2. Customer recognizes that data stored in the United States may be accessed remotely by authorized international personnel subject to those safeguards.

5. Security measures

Aqqrue will maintain appropriate technical and organizational security measures considering the nature of Customer Personal Data, available technology, and relevant risks. The baseline measures are described in Schedule 2, including encryption in transit and at rest, access restrictions and role controls, tenant separation, secure development, vulnerability assessment, logging, monitoring, and recovery arrangements. Aqqrue may change individual measures provided the overall security posture is not materially reduced. No security program eliminates all risk.

6. Subprocessors

Customer provides general authorization for Aqqrue to engage the subprocessors listed in Schedule 3 to carry out the identified functions. Aqqrue will impose written data protection and confidentiality obligations on each relevant subprocessor that are appropriate to the services provided and the data accessed, and will remain responsible to Customer for the subprocessor's performance of those contractual obligations.

Aqqrue will provide at least 30 days' advance notice before adding or replacing a subprocessor that will process Customer Personal Data, through email, an in-product notice, or updates to the subprocessor page coupled with an available notification subscription. Customer may object in writing within 15 days of notice on reasonable and documented data-protection grounds. The parties will work in good faith on a commercially reasonable resolution. If unresolved before the proposed change takes effect and no reasonable alternative is available, Customer may terminate the affected Services before that effective date and receive a pro rata refund of unused prepaid fees attributable to the affected Services.

Aqqrue may make urgent subprocessor substitutions where reasonably required to address a critical security risk or maintain continuity, subject to notice as soon as practicable and otherwise applicable protections. Aqqrue will not use a separate affiliated legal entity as a subprocessor for production Customer Personal Data without disclosing it under this Section if Applicable Privacy Law requires that treatment.

7. AI providers

Aqqrue may transmit task-relevant prompts, documents, and contextual information to OpenAI, Anthropic, and other duly notified AI subprocessors solely to perform Customer-authorized inference, extraction, or analysis. Aqqrue maintains contractual zero-data-retention arrangements with OpenAI and Anthropic for covered services and models. Other AI providers, including Google Gemini and Mistral AI, process Customer Data under applicable commercial data protection terms, including restrictions on the use of Customer Data for model training. Zero retention at AI providers does not eliminate Aqqrue's own storage, audit, or backup obligations. Aqqrue will use reasonably designed safeguards against prompt-injection and inadvertent disclosure.

8. Security incidents

Aqqrue will notify Customer without undue delay and in any event within 48 hours after becoming aware of a Security Incident affecting Customer Personal Data. The notification may be preliminary and will include, to the extent known, a description of the incident, affected information or systems, likely consequences, containment and remediation steps, and a contact for follow-up. Aqqrue may supplement information as its investigation progresses and will provide reasonable cooperation relevant to Customer's statutory notification duties.

Aqqrue will promptly investigate, contain, mitigate, and remediate Security Incidents, preserve appropriate evidence, and conduct reasonable root-cause analysis. Aqqrue's notification does not constitute an admission of fault or legal liability. Customer is responsible for determining whether and how to notify its own clients, regulators, or other affected parties, except as applicable law otherwise requires of Aqqrue.

9. Individual rights

Customer is responsible for responding to data-subject and consumer requests for Customer Personal Data. If Aqqrue receives such a request directly, it will, where legally permitted, redirect the requester to Customer or notify Customer rather than independently decide the request. Taking account of the nature of processing and functionality available, Aqqrue will provide reasonable assistance to enable Customer to search, access, export, correct, restrict, or delete Customer Personal Data where technically feasible.

Customer should use available self-service capabilities first. Where those capabilities are insufficient, Aqqrue will reasonably support requests submitted to contact@aqqrue.ai, subject to identity and authority verification, technical feasibility, and legal requirements. Aqqrue will respond within a reasonable period that allows Customer to meet applicable legal deadlines. Standard reasonable assistance is included; extraordinary work outside normal support may be subject to reasonable pre-agreed fees where permitted by law.

10. Regulatory cooperation

Upon reasonable written request, Aqqrue will provide relevant information within its possession needed to demonstrate compliance with this DPA, assist with a legally required privacy or security assessment directly related to the Services, and cooperate with lawful regulatory inquiries affecting Customer Personal Data, subject to confidentiality, security, and proportionality. Each party remains responsible for its own legal duties and for decisions about the purposes of its processing.

11. Audit and evidence

Aqqrue will make available relevant independent security audit reports (including its current SOC 2 Type II report), applicable trust documentation, and a reasonable written description of its safeguards, subject to confidentiality and access restrictions. If such documentation is insufficient to establish compliance with an express legal requirement, Customer may request a further assessment no more than once per 12 months, unless a material Security Incident or law requires otherwise. Any additional review will be conducted on reasonable advance notice during business hours, within a mutually agreed scope, without access to other customers' information, source code, or highly sensitive systems, and by an independent auditor bound to confidentiality. Customer bears reasonable extraordinary audit costs unless a material Aqqrue breach is established.

12. Export and backups

Customer should export Customer Data before its subscription terminates. Available self-service exports may not cover every data type; Customer may request reasonable supported export assistance while the subscription is active. Upon termination, Aqqrue will delete Customer Personal Data from active production systems within 15 days unless retention is required by applicable law or necessary to preserve legal claims.

For disaster recovery and business continuity, point-in-time recovery copies may be retained for up to 35 days, and geo-redundant weekly full backups for up to 12 months. Backup copies remain subject to confidentiality, encryption, and access controls, are not used for routine business processing, and are automatically removed in accordance with the normal backup retention schedule. If a backup is restored, Aqqrue will reapply applicable deletion instructions so previously deleted Customer Personal Data is not made available for ordinary processing. These backup periods are maximum retention periods for the relevant backup type, not a guarantee that all data persists for that period.

At Customer's reasonable written request, Aqqrue will confirm completion of active-system deletion, subject to legal restrictions. Certain business records processed by Aqqrue independently (for example, invoices for Aqqrue's own subscription fees and records needed to comply with law) are governed by Aqqrue's Privacy Policy rather than these Customer Data deletion obligations.

13. International access

Primary hosting of Customer Personal Data is in the United States. Customer authorizes access by appropriately authorized Aqqrue personnel in other jurisdictions for limited support, engineering, and security functions under appropriate confidentiality and technical controls. If particular Customer Personal Data becomes subject to a non-US international-transfer law requiring standard contractual clauses or another transfer mechanism, the parties will enter into the applicable transfer addendum before that transfer; this DPA alone does not purport to replace mandatory transfer clauses. Aqqrue does not promise that all access, personnel, or subprocessors are US-only.

14. Liability and term

This DPA remains effective while Aqqrue processes Customer Personal Data for Customer. The limitation and allocation of liability provisions in the Terms apply to claims under this DPA, including the Enhanced Cap applicable to Aqqrue's breach of the DPA or its security obligations. Where this DPA conflicts with the Terms solely in relation to the handling of Customer Personal Data, this DPA controls. Nothing in this DPA limits a person's rights or either party's liability to the extent prohibited by applicable law.

15. Schedule 1: Processing

16. Schedule 2: Security

• Governance. Designated senior security leadership, formal incident response and escalation procedures, annual security training, and enhanced training for personnel with production access.
• Access and authentication. Role-based controls, limited privileged access, time-bound access where supported, authentication safeguards including SSO capabilities, and monitoring of administrative access.
• Encryption. Encryption of stored data and transmissions, with controlled encryption-key management and rotation; enterprise BYOK capabilities may be available where contracted.
• Infrastructure. US-based primary cloud hosting, logical separation between tenants, network and infrastructure protections, SIEM or equivalent logging, continuous monitoring, and automated scanning.
• Development and assurance. Secure software development practices, periodic vulnerability assessments and penetration testing, and vendor and subprocessor reviews.
• AI safeguards. Task-appropriate prompt and input validation, controls intended to reduce adversarial prompt-injection risk, zero-data-retention arrangements with applicable AI providers, and contractual restrictions on the use of Customer Data for model training.
• Auditability. Logging of relevant authentication, workflow, administrative, and sensitive data-access events; exportable trails subject to product capabilities and plan restrictions.
• Resilience and recovery. Point-in-time recovery up to 35 days; geo-redundant weekly backup copies retained up to 12 months; documented backup validation and restricted recovery access.
• Incident management. Identification, triage, containment, investigation, remediation, evidence preservation, and customer notification under Section 8.
• Personnel access. On-demand troubleshooting access only where needed, including international staff under applicable confidentiality requirements.
• Insurance. Cyber insurance with coverage of US $1 million.

17. Schedule 3: Subprocessors

These services are authorized where used to provide Aqqrue customer-facing functionality. A provider listed here may receive only limited telemetry or operational metadata rather than full accounting records. The precise scope depends on enabled features and the provider's role.

Website-only advertising or analytics vendors are disclosed in the Privacy Policy. Aqqrue will add any separately incorporated affiliated service company to this schedule if it processes Customer Personal Data on Aqqrue's behalf as a distinct legal entity. The same register is published at /subprocessors.

18. Schedule 4: Contact

Privacy and operational inquiries: contact@aqqrue.ai. Security incident and security-information requests: security@aqqrue.com.

Aqqrue Inc.
8 The Green, #13842, Dover, DE 19901, United States

Customer notices will be sent to the firm's registered administrator or other notified commercial contact, unless a signed Order states otherwise.