This Data Processing Addendum (“DPA”) is incorporated into and forms part of the agreement between T-X AI, Inc. (“T-X”) and the customer identified in the applicable order form or agreement (“Customer”) governing Customer’s use of T-X’s financial analysis platform (the “Service”) (the “Agreement”). If this DPA conflicts with the Agreement on the processing, security, or protection of Customer Data, this DPA controls.
“Customer Data” means all data and files Customer or its users upload to, transfer to, connect to, or generate within the Service, including bank files (for example, BAI2 and CSV), transaction records, account balances, categorization rules, forecast inputs and outputs, chat messages, and instructions for transfers between Customer’s own bank accounts.
“Personal Information” means Customer Data that relates to an identified or identifiable natural person and is protected as personal information or personal data under Privacy Laws, such as employee names in payroll transactions or names of individual vendors and payees.
“Privacy Laws” means US federal and state privacy and data protection laws that apply to the processing of Personal Information under the Agreement, including the California Consumer Privacy Act, as amended (“CCPA”).
“Process” / “Processing” means any operation performed on Customer Data, including collection, storage, use, disclosure, and deletion.
“Subprocessor” means a third party engaged by T-X that processes Customer Data to help provide the Service.
“Security Incident” means a confirmed breach of T-X’s security, or that of its Subprocessors, leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Data. It does not include unsuccessful attempts that do not compromise Customer Data, such as blocked login attempts, pings, or port scans.
“De-identified Data” means data derived from Customer Data that does not identify, and cannot reasonably be used to infer information about or be linked to, Customer, any individual, any bank account, or any transaction.
Customer controls Customer Data. With respect to Personal Information, Customer is the “business” (or controller) and T-X is the “service provider” (or processor) under Privacy Laws. Sections 5 through 10 of this DPA (security, personnel, subprocessors, incidents, legal requests, and deletion) apply to all Customer Data, whether or not it contains Personal Information.
Schedule 1 describes the Processing.
T-X will Process Customer Data only (a) to provide, maintain, secure, and support the Service under the Agreement, (b) as otherwise instructed by Customer in writing, (c) to create De-identified Data as described in Section 4, or (d) as required by law.
With respect to Personal Information, T-X will not:
T-X will comply with applicable obligations under Privacy Laws and provide the same level of privacy protection they require. T-X will notify Customer if it determines it can no longer meet those obligations. Customer may take reasonable and appropriate steps to stop and remediate any unauthorized Processing of Personal Information.
Forecasting and categorization models that learn from Customer Data are used only for Customer’s account.
T-X may create De-identified Data by aggregating Customer Data with data from other customers, and may use it to produce industry benchmarks and to analyze and improve the Service, including after the Agreement ends. T-X will:
De-identified Data is not Customer Data or Personal Information.
Customer’s use of the Service constitutes its instructions to T-X to Process Customer Data to provide the Service. This includes uploading or transferring files, configuring categorization rules, using the chat interface, enabling integrations, and approving transfers. T-X will notify Customer if it believes an instruction violates applicable law.
Customer is responsible for:
T-X will maintain reasonable administrative, technical, and physical safeguards designed to protect Customer Data, as described in T-X’s Security Overview. These safeguards include:
T-X will not materially reduce the overall security of the Service during the term of the Agreement. T-X will not send raw bank files, full transaction ledgers, or bank account numbers to its AI Subprocessor.
T-X will ensure that personnel with access to Customer Data are bound by written confidentiality obligations and access it only as needed to provide, secure, and support the Service.
Customer authorizes T-X to use the following Subprocessors as of the date above:
| Subprocessor | Purpose | Customer Data accessed | Location |
|---|---|---|---|
| Microsoft Corporation (Azure) | Cloud hosting: compute (AKS), database (PostgreSQL), file storage (Blob Storage) | All Customer Data, encrypted | United States |
| OpenAI, L.L.C. | Natural-language processing for the AI chat interface | Chat messages and limited context needed to answer them, such as balances, category totals, forecast values, and scenario results. Not raw bank files, full ledgers, or bank account numbers. Before sending data to OpenAI, we replace company, vendor, employee and account identifiers with pseudonymous codes. OpenAI receives amounts and categories, not who they relate to. Data is encrypted in transit and is not used to train OpenAI’s models. | United States |
T-X will:
Customer may object on reasonable data protection grounds by emailing dk@t-x.ai within that 30-day period. The parties will discuss the objection in good faith. If they cannot resolve it, Customer may terminate the affected part of the Service and receive a prorated refund of prepaid fees for the remaining term.
T-X will notify Customer without undue delay, and where feasible within 72 hours, after confirming a Security Incident. Notice will be sent to Customer’s account contact and will describe, to the extent known:
T-X will update Customer as more information becomes available, take reasonable steps to mitigate the incident, and reasonably assist Customer in meeting its own notification obligations. Notification is not an admission of fault or liability.
Location: Customer Data is stored in the United States. Authorized T-X personnel may access Customer Data remotely, including from outside the United States, only as needed to provide, secure, and support the Service and subject to T-X’s access controls.
Legal requests: If T-X receives a subpoena, court order, or government request for Customer Data, T-X will, unless legally prohibited, promptly notify Customer and allow Customer to seek a protective order. T-X will disclose only the Customer Data it is legally required to disclose.
If T-X receives a request from an individual about Personal Information in Customer Data, T-X will promptly notify Customer and will not respond, other than to direct the requester to Customer, unless Customer instructs it to or the law requires. T-X will reasonably assist Customer in responding, including through account-level tools to export or delete Customer Data.
This section does not apply to De-identified Data.
On Customer’s reasonable written request, no more than once per year (or after a Security Incident), T-X will provide information reasonably necessary to demonstrate compliance with this DPA, such as responses to a security questionnaire and a summary of its security practices. Once available, T-X may satisfy such requests by providing a third-party audit report, rather than facilitating an on-site audit, except where required by law.
This DPA remains in effect as long as T-X processes Customer Data. It does not expand or limit either party’s liability under the Agreement, except as required by law. If T-X begins processing personal data of individuals located in the European Union or United Kingdom, a separate supplemental addendum covering GDPR and UK GDPR obligations, including Standard Contractual Clauses where applicable, will govern that processing and will not modify this DPA retroactively.
Questions about this DPA, Subprocessor objections, and individual rights requests: dk@t-x.ai.
T-X AI, Inc., Seattle, Washington, USA
| Nature and purpose | Parsing bank files, categorizing transactions, generating cash-flow forecasts and scenarios, answering questions through the AI chat interface, operating Customer-enabled integrations, generating Customer-approved transfer instructions between Customer’s own accounts, and supporting and securing the Service. |
|---|---|
| Categories of data | Bank account identifiers and balances; transaction records, including counterparty names, amounts, dates, and descriptions; categorization rules; forecasts and scenarios; chat messages; transfer instructions; integration access tokens; user names, work emails, and roles. |
| Categories of individuals | Customer’s authorized users; Customer’s employees, contractors, vendors, customers, and other payees or payers who appear in transaction data. |
| Sensitive data | None intended. Customer agrees not to upload Social Security numbers, full payment card numbers, health information, or passwords. |
| Duration | The term of the Agreement plus up to 90 days, then deletion as described in Section 12. |
| Location | Stored in Microsoft Azure US regions. Remote personnel access as described in Section 10. |
T-X