Data Processing Agreement

For personal data contained in the financial data you connect, you are the data controller and Owwyl Intelligence Systems is the data processor. Owwyl processes that data only to provide the service and only on your documented instructions, which include these terms and your use of the product.

Subject matter: bookkeeping and financial reporting. Duration: the term of your account plus the deletion window below. Nature and purpose: recording, categorizing, analyzing, and reporting on transactions. Data subjects: your personnel, customers, and vendors. Data types: business transaction records, vendor and customer names and identifiers, invoice contents, and, where you supply them, tax identification numbers.

Owwyl uses vetted sub-processors to deliver the service: Supabase (database hosting on AWS us-east-1), Stripe (billing) and Stripe Financial Connections (bank data), Nylas (email access), and Anthropic (AI categorization and anomaly detection). Each is bound to confidentiality and security obligations. We maintain a current sub-processor list and will give advance notice of material changes so you may object.

Owwyl ensures that personnel authorized to process your data are bound by confidentiality obligations and access data only on a need-to-know basis.

Owwyl maintains technical and organizational measures appropriate to the risk, including encryption of data in transit and of stored credentials at rest (AES-256), scoping of every record and query to a single organization, an append-only audit log, and least-privilege integration permissions.

Taking into account the nature of processing, Owwyl will assist you by appropriate technical and organizational measures, insofar as possible, in responding to requests to exercise data-subject rights (access, correction, deletion, portability). Export tools are available in your account settings.

Owwyl will notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information reasonably available to us to help you meet your own notification obligations.

Data is stored in the United States (AWS us-east-1). Where personal data is transferred from a jurisdiction that restricts such transfers, the parties will rely on an approved transfer mechanism such as the Standard Contractual Clauses.

On termination, Owwyl deletes your data within 30 days, except where retention is required by law. You may export a full copy of your data before deletion.

Owwyl will make available information reasonably necessary to demonstrate compliance with this DPA and will contribute to audits as required by applicable data-protection law. To request a signed copy of this DPA, contact privacy@kronos.ai.