Data Processing Addendum

1. Scope

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Paidwhere (“Processor”) and the business customer (“Controller”). Paidwhere is a local-first app: the Controller’s documents and ledger are stored on the Controller’s own computers and are not processed by Paidwhere.

This DPA covers the one case in which Paidwhere processes personal data contained in the Controller’s documents: when the App sends the text of a page that it could not read itself to Paidwhere’s AI reading service. It applies automatically to business customers who accept the Terms; a countersigned copy is available on request at legal@paidwhere.com.

2. Details of processing

• Subject matter and purpose: extracting values such as vendor, dates, amounts, tax and currency from the text of an invoice or receipt page, and returning them to the App.
• Duration: for the duration of each reading request. Page text is processed in memory and not stored by Paidwhere.
• Types of personal data: names, addresses, email addresses and phone numbers of vendors and customers appearing on invoices, and other data printed on the page.
• Data subjects: the Controller’s vendors, customers, employees and contacts named in documents.
• Special categories: not permitted. Documents that look like medical records or bills are left unread by the App.

3. Processor obligations

• Process personal data only on the Controller’s documented instructions, which are the Terms, this DPA and the Controller’s use of the App.
• Ensure people authorized to process the data are bound by confidentiality.
• Apply the security measures in section 6.
• Use subprocessors only as set out in section 5.
• Help the Controller respond to data subject requests and with security, breach notification and impact assessments, taking into account that Paidwhere does not store the Controller’s documents.
• Make available the information needed to show compliance with this DPA, normally by providing documentation and answers to questionnaires.

4. Personal data breaches

Paidwhere will notify the Controller without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting the Controller’s data, with the information the Controller needs to meet its own obligations.

5. Subprocessors

The Controller authorizes the subprocessors that take part in AI reading as listed in the Privacy Policy (Anthropic for the AI model, Cloudflare for network delivery). Paidwhere will give at least 30 days’ notice of new subprocessors by email; the Controller may object on reasonable grounds and, if no solution is found, terminate the affected service with a prorated refund. Paidwhere remains responsible for its subprocessors.

6. Security measures

• Only the text of a single page is sent, never the file, and only when the App’s built-in reader cannot read it.
• Encryption in transit (TLS 1.2 or later) for every request.
• No storage of page text by Paidwhere; reading results are returned to the App and not kept.
• The AI provider’s terms prohibit training on customer data.
• Least-privilege access for staff and audit logging of administrative actions on our services.

7. International transfers

Page text is processed in the United States. Where the law of the Controller’s country requires transfer terms, the parties agree to the transfer mechanisms that law provides, and Paidwhere will provide the information described in its Privacy Policy.

8. Order of precedence

If this DPA conflicts with the Terms on data protection, this DPA prevails.