Data Processing Addendum
Effective August 27, 2026
This Data Processing Addendum (“DPA”) supplements the HayberBooks Terms of Service between HayberTech & Trade LLC (“HayberTech”) and the business customer (“Customer”). It applies when HayberTech processes personal data on Customer’s behalf to provide HayberBooks.
Roles and instructions
Customer is the controller or business responsible for the personal data it submits, and HayberTech acts as processor or service provider to the extent required by applicable law. HayberTech will process that data only to provide, secure, support, and improve the contracted service; comply with documented lawful instructions; or meet legal obligations.
Processing details
- Subject and duration: delivery of HayberBooks during the account relationship and approved retention period.
- Data: client/user identifiers, contact details, bank and transaction data, categorization, support content, and security metadata.
- People: Customer users, payors/payees, employees, contractors, vendors, and other people represented in Customer data.
- Purpose: account administration, cash-basis financial visibility, categorization, reporting, AI-assisted features, security, support, and billing.
Security and confidentiality
HayberTech will maintain reasonable administrative, technical, and physical safeguards appropriate to the risk, including access controls, encrypted transport, secret management, tenant authorization, change review, logging, vulnerability management, and incident response. People authorized to process Customer data must be subject to confidentiality obligations.
Subprocessors
Customer authorizes subprocessors needed to operate the service, currently including Vercel, Supabase, Plaid, Stripe, Resend, and OpenAI for their respective hosting, database/authentication, bank connectivity, billing, email, and selected AI functions. HayberTech remains responsible for selecting and contracting subprocessors appropriate to their roles and will provide notice of material changes through the service or account contact when reasonably practicable.
Requests, incidents, and assessments
Taking into account the nature of processing, HayberTech will reasonably assist Customer with verified data-subject requests, security obligations, and regulator inquiries. HayberTech will notify Customer without undue delay after confirming a personal-data breach affecting Customer data and will provide available information needed for Customer’s legal assessment. Notification is not an admission of fault.
Return, deletion, and legal holds
On verified request or account closure, HayberTech will return or delete Customer data according to the Privacy Notice and retention policy, except where retention is required by law, contract, dispute, security, or a documented legal hold. Provider backups and logs expire on their applicable schedules.
International transfers
If applicable law requires a transfer mechanism for processing outside the originating jurisdiction, the parties will cooperate in good faith to implement an appropriate mechanism, such as applicable standard contractual clauses, together with any required supplementary measures.
Order of precedence and contact
If this DPA conflicts with the Terms on personal-data processing, this DPA controls for that conflict. All other Terms remain in effect. Questions or signed-copy requests: books@haybertech.com.