Data Processing Addendum

This draft addendum is between the tax professional or firm that accepts it (the Firm) and Prowyse. It covers personal information of the Firm's clients that the Firm or its clients upload to or enter in Prowyse.

Placeholder — counsel/product input required: Prowyse legal entity name, jurisdiction of formation, and mailing address — to be supplied by the product owner. Not established by the repository.

Placeholder — counsel/product input required: Whether acceptance by an individual user binds the firm, and whether a signed order form is also required — counsel decision.

The roles below are a drafting assumption, not a legal conclusion. They differ by activity:

• Client documents and profile data entered by or for the Firm's clients: assumed Firm = controller/business, Prowyse = processor/service provider, acting on the Firm's documented instructions.
• Prowyse account administration, security logging, abuse prevention, legal-acceptance records and access requests: assumed Prowyse = controller/business for its own purposes.
• Client-facing activation and acceptance of Terms and Privacy Policy: roles depend on the Firm's own notices to its clients — counsel decision.
• Any use of customer data to improve Prowyse's product or models: not assumed; would need a separate decision and, if permitted, role analysis.

Placeholder — counsel/product input required: Confirm or replace each assumption above, including whether the Firm is a tax return preparer under IRC §7216 and whether Prowyse itself is an auxiliary service provider or a recipient requiring client consent.

Processing for the Firm covers storing uploaded documents, extracting text locally, building a tax profile, generating alerts and document requests, classifying documents (including via the Jev service described below), sending service emails and enabling messages between the Firm and its clients.

Known from the code: AI-assisted features other than document classification are off by default and require explicit deployment approval plus an activated, accepted client. They are not covered by this addendum until reviewed.

Placeholder — counsel/product input required: Data subject categories, types of personal data (including SSN/ITIN), duration of processing and any special categories — counsel to finalize.

Categories indicated by the code: Vercel (hosting), Neon/PostgreSQL (database), Cloudflare R2 (document storage), an SMTP email provider, TypeSafe (Jev classification) and OpenAI (extended features, disabled by default).

Placeholder — counsel/product input required: Final sub-processor list, regions, notice-and-objection mechanism, and executed provider terms including retention, training and data-use restrictions and any zero-retention commitments — NOT established by the repository.

Known from the code: authenticated access to documents, tenant ownership checks between a Firm and its clients, encrypted tax-ID fields and rate limiting.

Placeholder — counsel/product input required: Formal security schedule, certifications, incident-notification timeline, audit rights — counsel and product decision. None are promised here.

Placeholder — counsel/product input required: Assisting the Firm with data-subject requests, return/export of data and deletion at termination, backup retention and legal holds — NOT implemented or decided; the code has no export or account-deletion capability.

Placeholder — counsel/product input required: Applicable state privacy statutes, cross-border transfers, liability allocation and relationship to the Terms — counsel to draft.

Placeholder — counsel/product input required: Privacy/legal contact (name or role and monitored email address) — to be supplied by the product owner.