Data Processing Agreement

1. Purpose and roles

This agreement applies when an accounting firm ("you", the data controller) uses MY AI Accountant ("we", the data processor) to manage clients' books. We process personal data in client workspaces only on your documented instructions, including these terms.

2. What we process and why

• Data: client names and business details, transactions, uploaded documents (bank statements, invoices, receipts) and derived reports.
• Purpose: providing the bookkeeping service — storage, AI document scanning, categorisation and reporting.
• Duration: for as long as your account is active, then deletion as set out below.

3. Confidentiality and security

We apply appropriate technical and organisational measures: hashed passwords, secure httpOnly sessions, encrypted cloud storage for documents, and workspace-level isolation so one firm's data is never visible to another customer. Access to production data is limited to authorised personnel under confidentiality obligations.

4. Sub-processors

You authorise these sub-processors: Stripe (payments), OpenAI (AI document scanning, under a data-processing agreement, no model training on your data), and our cloud hosting and storage providers. We will inform you before adding or replacing a sub-processor, giving you the chance to object.

5. International transfers

Data is processed within the EEA wherever possible. Where a sub-processor processes data outside the EEA, an approved transfer mechanism applies, such as EU Standard Contractual Clauses.

6. Helping you with data subject rights

Export and erasure are built into the product (Settings → Export my data / Delete my account), and we will reasonably assist you with access, correction, restriction and objection requests relating to data we process for you.

7. Breach notification

If we become aware of a personal data breach affecting your clients' data, we will notify you without undue delay, describing what happened, the likely impact and the measures taken.

8. Audits and information

We will provide the information reasonably needed to show compliance with this agreement. Where the law requires more, audits may be arranged on reasonable notice, at your cost, subject to security and confidentiality limits.

9. Deletion at the end

When your account ends you can export client data first; on account deletion, client workspaces, transactions and documents are permanently erased, subject only to records we must keep by law (for example payment records required for tax).

10. Liability and precedence

Liability under this agreement is subject to the caps in the Terms of Service. If this agreement and the Terms conflict on data protection, this agreement prevails.

11. Signing

Using a firm workspace accepts this summary agreement. If you need a countersigned copy for your records, email info@myaiaccountant.ie.