Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the Terms of Service between Peich Technologies Inc. ("Caribooks", "we") and the customer ("you"). It applies whenever Caribooks processes personal information on your behalf through the Service. Words defined in the Terms of Service have the same meaning here. If this DPA and the Terms of Service disagree about personal information, this DPA prevails.

1. Roles

1.1. You decide why and how personal information is processed in the Service: you are the controller of your own information. When you connect the books or accounts of your clients, you act for them, and Caribooks acts as your subprocessor.

1.2. Caribooks processes personal information only on your behalf, as your processor (a "service provider" under the privacy laws that use that term).

1.3. "Personal Information" means any information in Customer Data about an identified or identifiable person, such as the name, email address or bank details of a vendor, a client, an employee or one of your Users.

1.4. "Applicable Privacy Law" means the privacy laws that apply to the processing, including Quebec's Act respecting the protection of personal information in the private sector (Law 25), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and, where they apply, the privacy laws of US states.

2. Processing only on your instructions

2.1. Caribooks processes Personal Information only to provide the Service, on your documented instructions. Your instructions are the Terms of Service, this DPA, the features you turn on and the settings you choose, and what you or your AI assistant ask of the Service. Annex 1 describes the processing.

2.2. Caribooks does not sell or share Personal Information, does not use it for its own purposes or for advertising, does not combine it with information from other sources except to provide the Service to you, and does not use it to train AI models.

2.3. If we believe an instruction breaks Applicable Privacy Law, we tell you and may decline to follow it.

2.4. If the law requires us to process or disclose Personal Information other than on your instructions, we tell you first, unless the law forbids it.

3. People with access

Only people who need it to provide the Service have access to Personal Information. Each is bound to keep it confidential. Today those are two people: the CEO and one developer. Every account they use to reach production systems or Customer Data is protected by multi-factor authentication.

4. Security

Caribooks applies the technical and organizational measures described in Annex 2, and keeps them at least at that level for the duration of this DPA. We may update them, provided the overall level of protection does not go down.

5. Subprocessors

5.1. You authorize Caribooks to use the subprocessors listed in Annex 3. Each is bound by written terms to protect the information it receives and to use it only to provide its service.

5.2. We email the account owner at least 15 days before a new subprocessor starts receiving Personal Information, and update the list in Annex 3 the same day.

5.3. When a subprocessor fails or presents a security risk, we may move to a replacement immediately, and then tell you within 5 days.

5.4. You may object to a new subprocessor, on reasonable grounds related to the protection of Personal Information, within 15 days of our notice. We will then try to find a solution, such as turning off for your account the feature that uses that subprocessor. If we cannot, you may end the affected part of the Service, or the whole agreement, and we refund the unused part of any period you paid for.

5.5. Caribooks remains responsible to you for its subprocessors' processing of your Personal Information.

6. AI models

6.1. Your AI assistant is not our subprocessor. The assistant you connect (Claude, ChatGPT or Microsoft Copilot) is a service you chose under your own agreement with its provider. When you ask it a question, the data needed to answer is sent to it on your instruction. Its provider's terms and your settings there govern what it keeps.

6.2. The models Caribooks uses. Some features use AI models Caribooks chooses: Autopilot, reading and sorting documents, finding receipts in a connected mailbox, and naming merchants on bank transactions. These requests go through OpenRouter to the hosts listed in Annex 3. We use only endpoints that OpenRouter lists as zero data retention and not training on the data, and every request we send requires both. If none of those endpoints is available, the request fails; it is never sent to another endpoint.

6.3. Caribooks never uses Customer Data to train AI models.

7. Security breaches

7.1. Caribooks notifies the account owner by email without undue delay, and no later than 72 hours after becoming aware of a breach of security affecting your Personal Information (a "confidentiality incident" under Law 25).

7.2. The notice describes, as far as we know at that time: what happened, the information and the number of people concerned, the likely consequences, what we have done and will do about it, and who to contact. We send what we learn afterwards as we learn it.

7.3. We take reasonable steps to contain the breach and reduce the risk of harm, keep a record of it, and help you meet your own obligations to notify regulators and the people concerned. We do not notify your clients or the people in your data on your behalf without your agreement, unless the law requires us to.

8. Helping you

8.1. If a person asks Caribooks to access, correct or delete their Personal Information in your account, we send the request to you and do not answer it ourselves, unless the law requires us to.

8.2. We help you, as far as is reasonable, to answer those requests, to carry out privacy impact assessments, and to answer questions from a regulator about the Service.

9. Where data is processed

9.1. Caribooks stores Customer Data in Canada: the database and files are hosted by Supabase in the AWS Canada (Central) region, and the application runs on Vercel in Canada.

9.2. Some subprocessors process Personal Information outside Canada, mainly in the United States, for the purposes listed in Annex 3.

10. Deletion

10.1. A disconnected company. When you disconnect a QuickBooks company, or revoke Caribooks' access from your Intuit account, access stops at once. Everything Caribooks keeps for that company is kept 29 days, so that reconnecting it restores your setup, and deleted on day 29.

10.2. When access ends. When your access to the Service ends (cancellation, a trial that ends without a plan, or termination), Customer Data is kept for 90 days. We email the account owner 30 days and 7 days before. On day 90, Caribooks disconnects every company, bank, Stripe account and mailbox, revokes its access with each provider, and deletes the Customer Data it holds, the companies' data included.

10.3. On request. You may ask us at support@caribooks.com to delete your account and its Customer Data at any time. We complete the deletion within 30 days and confirm it in writing.

10.4. Copies in backups and logs. Database backups are kept 7 days and then destroyed. Copies held by subprocessors in their logs and sent-email records expire on their own schedules, within 96 days.

10.5. Your copy. Your books stay in QuickBooks, which Caribooks does not change when deleting. Before the deletion, you may download your documents from the document box. Caribooks keeps only the billing records Canadian tax law requires, held by Stripe, which contain no QuickBooks or bank data.

11. Audits

11.1. Once a year, and after a breach that affected your Personal Information, Caribooks answers a reasonable security questionnaire in writing and sends you its current Information Security Policy and Data Retention and Disposal Policy.

11.2. Our hosting providers' independent security reports (such as SOC 2) are available from those providers.

11.3. When a regulator requires it, or after a breach that affected your Personal Information, you may have an audit carried out by yourself or by an independent auditor bound to confidentiality, with 30 days' notice, during business hours, at your cost, and in a way that does not expose other customers' data.

11.4. Once Caribooks holds an independent security report of its own, such as SOC 2, sharing it replaces the questionnaire in section 11.1.

12. Liability and duration

12.1. Each party's liability under this DPA is subject to the limits in the Terms of Service. There is no separate or additional cap.

12.2. This DPA applies for as long as Caribooks processes Personal Information on your behalf, including during the periods in section 10.

12.3. A copy of this DPA signed by Caribooks, with your organization's name, is available on request at support@caribooks.com. The DPA binds both parties from your acceptance of the Terms of Service, signed copy or not.

Annex 1. Description of the processing

Purpose. To provide the Service: answering your and your AI assistant's questions from your connected books, running the Autopilot tasks you turn on, keeping and reading the documents you send, connecting banks, Stripe accounts, mailboxes and vendor portals, sending the emails you ask for, billing, and supporting you.

Nature. Collection from connected services, storage, organization, reading by AI models, matching, transmission to your AI assistant, recording in QuickBooks on your instruction, and deletion.

People concerned. Your Users; your clients and their employees, vendors, customers and other contacts whose information is in the connected books, documents, bank transactions or mailboxes; people who submit expense claims or documents through a link you share.

Information. Names, email and postal addresses, phone numbers, tax numbers, financial transactions (amounts, dates, descriptions, accounts), invoices and receipts, bank account details (name, type, last four digits, balances, transactions), Stripe sales (customer names and emails), email messages from the vendors Caribooks searches for in a connected mailbox, and sign-in information. Caribooks does not ask for sensitive information such as health data or government identity numbers; it may appear in documents you send.

Duration. For as long as the Service is provided, then as set out in section 10.

Annex 2. Security measures

• Encryption. TLS 1.2 or higher on every connection. AES-256 encryption at rest for the database, files and backups. QuickBooks, Plaid, Stripe and mailbox access tokens encrypted again in the application with AES-256-GCM, with the key held outside the source code.
• Isolation. Row-level security on every table holding Customer Data, keyed to the account. The database is closed to the browser: only server code reaches it, and every query is scoped to the signed-in account. Files sit in a private bucket under per-account paths.
• Access to connected services. QuickBooks, Plaid, Stripe, Gmail and Outlook are reached through each provider's own authorization; Caribooks never sees the passwords. Access can be revoked from Caribooks or from the provider at any time.
• Least privilege in the product. Every QuickBooks company starts read-only. Write access is turned on company by company by the account owner. Deleting, voiding and sending require an explicit confirmation.
• Sign-in. Passwordless sign-in by email link or code, or Google or Microsoft. A bot check on the sign-in page. A second step by authenticator app for every User who turns it on, required for bank access. AI assistants connect through OAuth 2.1 with PKCE.
• Staff access. Production access limited to named people, with multi-factor authentication on every system that reaches Customer Data. Secrets kept in a password manager.
• Development. Code in a private repository; an automated test suite blocks any release that fails it; dependency security alerts reviewed and patched.
• Monitoring. Error reports stripped of QuickBooks content, tokens, request bodies and AI prompts before they leave the application. Usage of the QuickBooks API metered daily.
• Continuity. Daily database backups kept 7 days; the application can be redeployed from its repository at any time.
• Policies. A written Information Security Policy and Data Retention and Disposal Policy, reviewed at least once a year, and an incident register as Law 25 requires.

Annex 3. Subprocessors