Data Processing Agreement
Version 9 · effective October 27, 2026 · last updated October 27, 2026
On a phone this opens the print sheet; choose Save to Files or Save as PDF.
This Data Processing Agreement (the DPA) governs the personal data that organisations using Hayatiq Financials process through the Service — data of their clients, their clients' people or their own staff. It supplements the Terms of Service and is explained in plain language by the Privacy Policy.
How this document applies. This DPA forms part of the Terms of Service and applies automatically to every Organisation that enters Personal Data into the Service, and to any person who uses the guest download (Terms of Service, section 5), for the data in that download; that person is the Customer for this purpose. A Customer that needs a signed copy completes Annex 4 and sends it to hello@hayatiq.ai; Hayatiq countersigns and returns it. A signed copy does not change the DPA's effect. Print this page to PDF using the button above to complete Annex 4.
1. Parties
This DPA is between:
- Hayatiq: HAYATIQ AI SOLUTIONS F.Z.E (trade name as registered on the trade licence and commercial registry: HAYATIQ AI SOLUTIONS - F.Z.E), a free zone establishment registered in Ajman, United Arab Emirates, at B.C. 1306744, Ajman Free Zone C1 Building, Ajman Free Zone, Ajman, United Arab Emirates, the Processor; and
- Customer: the Organisation that holds the Hayatiq Financials account (named in Annex 4 where a signed copy is made) or, for the guest download (Terms of Service, section 5), the person who downloads it, for the data in that download, the Controller (or, where the Customer is itself a processor for its clients, a processor instructing Hayatiq as sub-processor; the term Controller is used for both below).
2. Definitions
Words defined in the Terms of Service have the same meaning here. In addition:
- Data Protection Law means every law that applies to the processing of Personal Data under this DPA, including the United Arab Emirates' Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL), the Saudi Personal Data Protection Law and its Implementing Regulations (PDPL), the EU General Data Protection Regulation and the UK GDPR (GDPR), and any other law the parties identify in Annex 4.
- Personal Data means any information relating to an identified or identifiable natural person that Hayatiq processes for the Customer through the Service; the categories are in Annex 1.
- Processing, Controller, Processor, Data Subject, Personal Data Breach and Supervisory Authority have the meanings given in Data Protection Law.
- Sub-processor means a third party engaged by Hayatiq to process Personal Data for the Customer; the current list is Annex 3.
- Engagement Data means the Customer Data in an engagement: the engagement's details: entity name, reporting period and currency; canonical balance rows, the mapping, questionnaire answers, the cash-flow worksheet and note tables; the note narratives the Customer kept or edited, whether the Customer or the assistant drafted them; the record of the assumptions the draft applied and of its release for export (the releasing user's account e-mail address, the time and the counts); the recorded statement versions; and any names of people in them; and, where the Service offers document reading, a document the Customer chooses to have the assistant read, while Hayatiq processes it for that reading.
3. Scope, roles and precedence
- This DPA applies to Personal Data that Hayatiq processes on the Customer's behalf in providing the Service, as described in Annex 1. It does not apply to data of which Hayatiq is the controller (account, billing, checklist-download and support data), which the Privacy Policy covers.
- The Customer is the Controller and Hayatiq is the Processor of Engagement Data. The Customer warrants that it has a lawful basis, and has given any notice and obtained any consent Data Protection Law requires, for entering Personal Data into the Service and for the transfers in section 12.
- If this DPA conflicts with the Terms of Service, this DPA prevails for the processing of Personal Data. If it conflicts with standard contractual clauses incorporated under section 12, those clauses prevail.
4. Details of the processing
The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of Data Subjects are set out in Annex 1. The Service is built so that most processing happens on the Customer's own device: Hayatiq receives Engagement Data only at the four points where the Customer sends it — save, assistant, note narrative, export — as Annex 1 describes, and copies what it stores into the encrypted backup described in Annex 2.
5. The Customer's instructions
- Hayatiq processes Personal Data only on the Customer's documented instructions, which are: the Terms of Service, this DPA, the Customer's use of the Service's features (saving, exporting, the no-storage flag, deleting an engagement, and the assistant where the Customer allows it on an engagement), and any further written instruction the parties agree.
- Hayatiq will tell the Customer if, in its opinion, an instruction infringes Data Protection Law, and may suspend that instruction until it is resolved.
- Hayatiq does not use Personal Data for any purpose of its own, does not sell it, and does not use it to train any model.
6. Hayatiq's obligations
Hayatiq will:
- process Personal Data only as section 5 allows, and only for as long as the Customer's account and the retention rules in the Privacy Policy require;
- ensure that people authorised to process Personal Data are bound by confidentiality (section 7);
- implement the security measures in Annex 2 (section 8);
- engage Sub-processors only under section 9;
- assist the Customer with Data Subject requests (section 10) and, taking into account the nature of the processing and the information available to Hayatiq, with the Customer's obligations on security, breach notification, data protection impact assessments and prior consultation with a Supervisory Authority (sections 8, 11 and 13);
- notify the Customer of Personal Data Breaches (section 11);
- delete or return Personal Data at the end of the Service (section 14); and
- make available the information needed to demonstrate compliance with this DPA and allow audits (section 13).
7. Personnel and confidentiality
Hayatiq is operated by a small team. Hayatiq is responsible to the Customer for every person it gives access to Personal Data. Hayatiq's owner, who alone holds production access, signed a written undertaking of confidentiality and restricted access to Hayatiq on 21 September 2026 that survives the end of that access; a copy is available to the Customer on request at privacy@hayatiq.ai. No other person is given access unless they have first signed an undertaking in the same terms, and Hayatiq keeps each signed undertaking for as long as the access and the undertaking last. Access is limited to what the role needs, and production data is accessed only for support a Customer has asked for, for the security of the Service, or for a legal reason, and never for curiosity or testing. Development and testing use synthetic fixture data only; no Personal Data is copied into a development environment. Production access is held by Hayatiq's owner alone, and by no other person or contractor.
8. Security
- Hayatiq maintains the technical and organisational measures in Annex 2, which separates the measures implemented at the date of Annex 2 from those planned. Hayatiq does not represent a planned measure as in place.
- Hayatiq may update Annex 2 as the product develops, provided the overall level of protection does not fall. The current version is always at financials.hayatiq.ai/en/dpa with its date.
- The Customer is responsible for the security of its own devices, browsers and accounts, for the drafts held in its browsers before saving, for who it invites to its organisation and the roles it gives them, and for the choices it makes in the Service (including whether to use the no-storage flag).
9. Sub-processors
- The Customer gives Hayatiq general authorisation to engage the Sub-processors in Annex 3 and any replacement or addition under this section.
- Hayatiq will give the Customer at least thirty (30) days' written notice (by e-mail to the account owner, and by updating Annex 3 at the URL above) before a new or replacement Sub-processor processes Personal Data. The Customer may object in writing, on reasonable data-protection grounds, within that period. If the parties cannot resolve the objection in good faith, the Customer may terminate the affected subscription and Hayatiq will instruct Paddle to refund the prepaid fees for the unused period pro rata, as the Customer's sole remedy.
- Hayatiq will engage each Sub-processor on written terms that protect Personal Data to at least the standard this DPA requires, as appropriate to the service provided, and remains liable to the Customer for the Sub-processor's performance.
10. Data Subject requests
If Hayatiq receives a request from a Data Subject relating to Engagement Data (at privacy@hayatiq.ai or otherwise), it will not answer it on the Customer's behalf, will tell the Customer within five (5) business days, and will help the Customer answer it. Because the Customer can itself view, edit and delete every engagement in the Service, most requests can be met without Hayatiq's involvement; where that is not enough, Hayatiq provides reasonable assistance at no charge, and may charge a reasonable fee based on the time spent at Hayatiq's then-current hourly rate, notified before the work starts, for assistance that is excessive or repetitive.
Where one of the Customer's users asks Hayatiq to erase their own account (Privacy Policy, section 15), Hayatiq ends that user's membership of the Customer's Organisation and keeps the Engagement Data they created there, without them recorded as its author. Where that user is the Organisation's only member, the Organisation and its Engagement Data are deleted with the account, after the thirty-day period of section 14.2 unless the user asks in writing for sooner deletion. Hayatiq does not delete an Organisation at the request of its only owner while it has other members: it first asks that owner to make another member an owner or to close the Organisation. An Organisation whose paid subscription is still running is not deleted until that subscription is cancelled (Privacy Policy, section 15). A departing user's e-mail address stays in the release records of the engagements saved in the Organisation after they released them; those records are Engagement Data, kept until the Customer deletes those engagements.
11. Personal Data Breaches
- Hayatiq will notify the Customer without undue delay and in any event within forty-eight (48) hours after becoming aware of a Personal Data Breach affecting the Customer's Personal Data.
- The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point; information Hayatiq does not yet have follows as it becomes available.
- Hayatiq will cooperate with the Customer's investigation and with any notification the Customer must make to a Supervisory Authority or to Data Subjects. Hayatiq's notice is not an admission of fault.
12. International transfers
- Storage. Hayatiq stores Personal Data on Supabase in Frankfurt, Germany, its application functions run in Frankfurt, and its encrypted database backups are kept under European Union jurisdiction (Annexes 2 and 3). Sub-processors in other countries receive only what Annex 3 describes.
- Saudi Arabia. Where the Customer is established in the Kingdom, or the Personal Data relates to people in the Kingdom, the transfer to Hayatiq and its Sub-processors is a transfer outside the Kingdom under the PDPL. The parties enter into the SDAIA Standard Contractual Clauses for that transfer, which are incorporated into this DPA as Annex 5 in their controller-to-processor form or, where the Customer is a processor for its clients, their processor-to-processor form, by the Customer's acceptance of the Terms of Service. Hayatiq maintains the transfer risk assessment that supports the clauses, written for the Customer to adopt as controller, and provides it under section 13. Hayatiq has not registered on the Kingdom's national register of controllers or appointed a representative in the Kingdom; if either becomes required, Hayatiq will update this section and Annex 5. Where the clauses require it, the Customer as data exporter and Hayatiq as data importer complete the annexes to those clauses using Annex 1 and Annex 3 of this DPA.
- EU and UK. Where the GDPR applies to the Customer, the transfer from the Customer to Hayatiq (established in the United Arab Emirates) and onward to Sub-processors outside the EEA or the UK relies on: the European Commission's Standard Contractual Clauses of 4 June 2021 (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor) or, where the Customer is a processor for its clients, Module Three (processor to processor), with Clause 9 Option 2 (general written authorisation, thirty (30) days), Clause 17 Option 1 and Clause 18 (the law and courts of Ireland), and, where the UK GDPR applies, the UK Information Commissioner's International Data Transfer Addendum to those clauses, all completed as Annex 6 and entered into by the Customer's acceptance of the Terms of Service. The United Arab Emirates holds no EU or UK adequacy decision at the date of this DPA. Hayatiq relies on each Sub-processor's own transfer mechanism (EU SCCs and UK Addendum in its data processing addendum) for the onward transfer, as recorded in Annex 3.
- United Arab Emirates. Where the UAE PDPL applies, the Customer instructs Hayatiq to store Personal Data in Germany and to use the Sub-processors in Annex 3. Hayatiq binds each Sub-processor by written terms to protect the data to at least the standard this DPA requires (section 9.3), and the parties treat this DPA and those terms as the contractual safeguard for the transfer outside the State.
- Hayatiq will tell the Customer if it can no longer comply with the clauses under this section, and the Customer may then suspend the transfer and terminate the affected subscription.
13. Audit and information
- On written request, no more than once in any twelve (12) months unless a Supervisory Authority requires otherwise or a Personal Data Breach has occurred, Hayatiq will answer a reasonable written security questionnaire and provide the documentation listed in Annex 2 (including the results of the automated row-level-security suite for the current release) and the security documentation its Sub-processors publish.
- Where that information is not enough to demonstrate compliance with this DPA, the Customer (or an independent auditor bound by confidentiality) may audit Hayatiq's processing, on thirty (30) days' notice, during business hours, at the Customer's cost, without access to other customers' data and without disrupting the Service. Hayatiq's infrastructure is operated by its Sub-processors; an audit of their facilities is limited to the reports and certifications they make available.
14. Return and deletion
- The Customer can delete any engagement, and with it its Engagement Data, at any time in the Service. For an engagement with the no-storage flag, the purge job, which runs every night at 03:00 UTC (Annex 2), deletes its saved snapshots and their working rows: the mapping, the questionnaire answers, the cash-flow worksheet and the review notes. It keeps the engagement record, the export records and the rounded statement figures recorded by an export made before the engagement was flagged, until the Customer deletes the engagement. A mapping template the Customer downloaded is a file on its own device, outside the purge's reach. An export made from a draft saved with the flag records no statement figures; an export from a browser that still holds an earlier copy of the draft, saved without the flag, can record them. Otherwise, when the Customer exports a saved engagement, Hayatiq records that version's rounded statements, checklist results and warning codes (the rounded statements encrypted, Annex 2) and, for each file, its format, size and a hash — never the file itself, which is streamed to the Customer's browser and not stored.
- On termination of the Service, Hayatiq will, at the Customer's choice made within thirty (30) days, return the Customer's saved engagements as exported files, provided without charge and regardless of plan limits for this purpose, and then delete them, or delete them without return. After that period Hayatiq deletes all Personal Data and existing copies, except what Data Protection Law or the Customer's billing history requires Hayatiq to keep (the Organisation's subscription and purchase records, kept with Paddle's identifiers but linked to no account once the Organisation is deleted, for the retention in the Privacy Policy, section 10), which remains subject to this DPA. Deleted rows may persist in the encrypted database backups described in Annex 2 for the retention stated there (up to about ninety (90) days) and are then removed with the last backup that holds them. What the assistant sent is deleted by the model provider on its own schedule (Annex 3), and Hayatiq cannot delete it sooner.
15. Liability
Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service (including the higher limit that section 15 of the Terms sets for breach of section 7 of the Terms or of this DPA), which apply in aggregate across the Terms and this DPA, except that: (a) nothing in the Terms of Service limits either party's liability towards a Data Subject under the clauses incorporated under section 12, or under Data Protection Law where that law does not allow it to be limited; and (b) as between the parties, those limits apply to liability under the clauses incorporated under section 12 only to the extent the clauses themselves permit.
16. Term and termination
This DPA takes effect on the Customer's acceptance of the Terms of Service and lasts as long as Hayatiq processes Personal Data for the Customer, including the return-and-deletion period in section 14. A countersigned Annex 4 records the DPA between the named parties; it does not change when the DPA took effect.
17. Governing law
This DPA is governed by the law and forum chosen in the Terms of Service; where clauses incorporated under section 12 specify their own governing law or forum for the matters they cover, those provisions apply to those matters.
Annex 1 — Details of the processing
| Item | Description |
|---|---|
| Subject matter | Providing Hayatiq Financials: turning the Customer's trial balances into draft financial statements for professional review, storing the Customer's saved engagements, and rendering exports |
| Duration | The life of the Customer's account, plus the return-and-deletion period in section 14; for the guest download, the request only: nothing is stored (Terms of Service, section 5) |
| Nature of the processing | Storage (saved snapshots, recorded statement versions), retrieval on the Customer's request, server-side rebuilding of statements from a snapshot at export and streaming of the exported file to the Customer's browser (a released draft's file printing the release statement: the releasing user's account e-mail address and the date), and transmission to the assistant's model provider of account codes and names, of account names with the statement line each is mapped to, or of each note as it prints, with its figures and the Customer's answers to the questions it draws on, including any text typed for them, or, where the Service offers it, of a document the Customer chooses to have read (the prior year's issued financial statements or the commercial registration extract), whole, for that reading, and not stored by Hayatiq; and a nightly encrypted backup of the database (Annex 2), held under EU jurisdiction. Parsing, mapping, statement building, tie-outs and the checklist run in the Customer's browser and are not processing by Hayatiq |
| Purpose | Performance of the Terms of Service for the Customer; no other purpose |
| Types of Personal Data | Names of natural persons where they appear in Engagement Data: in account names (for example a director's loan account), in related-party, key-management, employee-benefit and going-concern answers, in note worksheet tables, and in the entity name of a sole proprietorship. Amounts associated with those names. The confirmation trail of a mapping records a role label ("preparer"), not a name; a later version may record the confirming user's identifier. When a user releases a draft for export, the release records that user's account e-mail address, which the exported files print with the date in the release statement beneath the draft-for-review statement; the Customer decides who receives those files. Where the Service offers document reading, the names, and any identification numbers, nationalities, dates of birth, addresses and signatures, of people printed in a document the Customer chooses to have read (owners, partners, managers and signatories): the document is received for that reading only; identification numbers of people are not requested, are discarded if detected in the reply, and are not stored by Hayatiq; the names it proposes are held in the Customer's browser until confirmed and, once confirmed, are Engagement Data like any answer. For owners, whether each is Saudi or GCC (yes / no / unknown), never the nationality itself. No special-category data is expected; the Customer must not enter any |
| Categories of Data Subjects | Directors, shareholders, partners, key management, related parties and employees of the Customer's client entities (or of the Customer itself), and signatories of the client entity's prior financial statements; the Customer's own users |
| Frequency | Continuous while an engagement is saved; event-driven at save, assistant (including a document reading, where the Service offers it), narrative and export |
| Retention | Privacy Policy section 10 and section 14 above; at the assistant's model provider, as Annex 3 states for Anthropic, PBC: deleted within thirty (30) days of receiving or generating it under the data-retention policy Anthropic publishes for its commercial API customers, longer only where that policy says so, such as content flagged under its usage policy (which Anthropic may keep for up to two years), or where the law requires it |
Annex 2 — Security measures
Hayatiq does not represent a planned measure as in place. Dated 27 October 2026.
Implemented today
| Measure | Detail |
|---|---|
| Row-level security on every table | Every tenant table carries the organisation identifier and a policy that checks membership of that organisation; organisations and members are created only through controlled database functions. The public (unauthenticated) database role holds no table grants. An automated test suite proves, on every change and in continuous integration, that a user in one organisation cannot read or write another's rows |
| Processing on the Customer's device by default | The engine runs in the browser in a Web Worker; Engagement Data reaches Hayatiq only at the four explicit actions in Annex 1. Trial balance files are never received: only a file name, size, content hash, layout and row counts are kept, as metadata in the saved snapshot |
| Save boundary and sign-in | A save stores canonical balance rows and a rebuildable snapshot of the draft's choices, the assumptions it applied and any release record, with version numbers — never the file bytes, never per-suggestion rows. Sign-in to Hayatiq ID is by one-time e-mailed link; no password store exists. Live at the date of Annex 2 |
| Export | Word (DOCX), Excel (XLSX) and PDF files are rendered on the server from the snapshot and streamed to the Customer's browser; they are not stored. For a saved engagement, Hayatiq records that version's rounded statements, encrypted as below, its checklist results and warning codes (for an export made from a draft saved with the no-storage flag, only the checklist results and warning codes; section 14.1) and, for each file, its format, size and a hash, under the same row-level security. A draft that rests on assumptions is rendered for a signed-in user only after that user releases it under their own account e-mail address, which the file prints with the date in the release statement beneath the draft-for-review statement; the recorded version keeps the release's counts, never the address |
| No client financial data in logs or analytics | Logging accepts reason codes and counts only, enforced by a lint rule that bans console output everywhere except one reviewed module; analytics events carry counts, category values and flags only; billing-event records hold only the fields acted on, never names, addresses or amounts |
| Assistant payload control | The mapping-suggestion request carries a fixed set of fields (codes, names, a category label — no balances) and scrubs figure-shaped tokens and currency codes from free-text labels before sending; the proposal requests carry account names under opaque references with the statement line each is mapped to, never a balance; the narrative request carries each note as it prints with its figures, so the assistant can write about them, and the Customer's answers to the questions that note draws on, including any text typed for them, never the trial balance or the entity-name field (a note's text shows "the Company" in its place; a name in those answers or in the note as it prints can be sent as it appears); the assistant never supplies a figure to a note's narrative — every number in a paragraph must match the engine's figures, the note's fixed allow-list or text the Customer entered or confirmed for that note, or the paragraph is refused; every mapping, proposal and narrative request also carries the company's country and the framework the draft uses, which hold no Personal Data; the assistant runs on the terms set out below in this annex |
| Encryption in transit | HTTPS between the browser, Hayatiq and every Sub-processor; encryption at rest of database volumes as provided by Supabase's infrastructure |
| Column-level encryption in the application | Each saved engagement snapshot, each questionnaire answer, and the rounded statement figures recorded at export are encrypted on Hayatiq's server with AES-256-GCM before they are written, with a key held in the hosting provider's encrypted configuration and never in the database; each value is bound to its column, its engagement and its row, so it does not decrypt elsewhere, and the database refuses to store a value in those columns that is not in this encrypted form. The engagement's name, country, period, currency and framework choice, and the metadata records beside it (export records, checklist results and warning codes) are not encrypted this way and rest on row-level security and the disk encryption above |
| No-storage purge job | Runs every night at 03:00 UTC in the database's own scheduler and, for every engagement with the no-storage flag, deletes its saved snapshots, mapping, questionnaire answers, cash-flow worksheet and review notes; it keeps the engagement record, the export records and the rounded statement figures recorded by an export made before the engagement was flagged (section 14.1) |
| Request limits | Counts kept in the server's memory only, never in the database or a log: per IP address for sign-in links, the signed-out guest download, the public forms, browser error reports and script-policy reports; per e-mail address, held as a SHA-256 digest, for sign-in links; per user for document reading, where the Service offers it; per user and per Organisation, with a daily number, for the assistant |
| Browser error reports, script-policy reports and uptime check | A failure in the browser sends Hayatiq's own server a report of fixed codes only (its source, kind, the route pattern, the build, the browser family and a count), never a message, a stack, an address with identifiers, or anything the Customer typed or uploaded; each report is one line in the hosting provider's function log. A browser's report of a script that the Service's stricter script policy would refuse is reduced on Hayatiq's server to fixed codes, written to the same log as one line for each different combination of those codes, with a count; the page's address, the script's address and any sample of its text are dropped. A scheduled check reads the Service's health answer, which holds no Personal Data |
| Secrets management | No secret is committed to source control; credentials live in the encrypted secrets store of the provider that uses them — the hosting provider's environment configuration for the application, the backup runner's encrypted secrets for the backup credential and storage keys — and the backup decryption key is held by Hayatiq's owner outside every provider; an automated guard blocks tooling from writing secret files; production database changes are applied by Hayatiq's owner, or by tooling the owner runs and supervises, in a reviewed change |
| Change control | Every change goes through a pull request with required automated checks (type-check, lint, tests including the row-level-security suite, build) and a protected main branch; a security review of parsing, storage, logging, authentication and third-party calls is part of the release process |
| Preview-deployment protection | Every preview deployment, and each production deployment's own generated address, opens only for a member of Hayatiq's hosting team signed in to the hosting provider (Vercel Authentication); Hayatiq's automated checks reach previews with a bypass secret held in the continuous-integration configuration. The public service at financials.hayatiq.ai is the open address. Previews carry no database (the row below) |
| Synthetic data in development and test | Development, tests and the assistant's own tests use synthetic fixture data only; no real client data is copied into a development environment |
| SDAIA Standard Contractual Clauses and transfer risk assessment | The clauses are incorporated as Annex 5 (section 12.2); the transfer risk assessment that supports them is adopted, maintained by Hayatiq for the Customer to adopt as controller, and provided under section 13 |
| Nightly encrypted logical dump of the database | Taken nightly by a scheduled job, encrypted before upload to a key held by Hayatiq's owner outside every provider, stored under EU jurisdiction; thirty nightly and three monthly copies kept, so a deleted row may persist in a dump for up to about ninety (90) days. One restore verified against the dump's own manifest; the verification is repeated after the first real client data is saved. Point-in-time recovery is not in use; a restore returns the database to the previous night's copy |
| No development database | The pre-launch development project was retired on 2026-09-27: preview and development deployments carry no database, and nothing is stored there. |
Planned
| Measure | Status |
|---|---|
| Document reading | Offered only where the Service shows the option to read a document; where it is not shown, nothing is read. Where it is offered: a document the Customer chooses to have read (the prior year's issued financial statements or the commercial registration extract) is received for that request only, sent whole to the model provider, never with a balance, account name or entity name beside it, and not stored by Hayatiq; the reply is held to closed fields and identifier-shaped values are discarded: the assistant is not asked for, and is instructed not to return, any person's identification number, date of birth, nationality or signature, and Hayatiq's server discards any such number it detects; the assistant proposes facts and figures, each naming its page, and nothing it proposes is used until the Customer confirms it |
| Independent security assessment | Not yet carried out. Hayatiq will have one carried out before the first Partner-plan customer's data is processed; its summary is available under section 13 on request under confidentiality |
Not in place, and not requested
| Measure | Status |
|---|---|
| Zero data retention with the assistant's model provider | Not in place, and Hayatiq has not requested it. The assistant runs on the terms set out in this annex: no training on what is sent (Anthropic's commercial terms; Hayatiq has not opted in); under the data-retention policy Anthropic publishes for its commercial API customers, Anthropic deletes what is sent, and what it returns, within thirty (30) days of receiving or generating it and keeps it longer only where that policy says so, such as content flagged under its usage policy, or where the law requires it, for every request the assistant makes; what is sent is account names and codes, the Customer's answers (including any text typed for them), and each note as it prints with its figures, so the assistant can write about them, and, where the Service offers it, a document the Customer chooses to have read, whole, for that reading; the assistant never supplies a figure to a note's narrative — every number in a paragraph must match the engine's figures, the note's fixed allow-list or text the Customer entered or confirmed for that note, or the paragraph is refused (Annex 3) |
Annex 3 — Sub-processors
Notice of changes: section 9. Dated 27 October 2026.
| Sub-processor | Purpose | Location of processing | Personal Data received | Transfer mechanism (EU/UK) |
|---|---|---|---|---|
| Supabase, Inc. | Database and authentication | Frankfurt, Germany (AWS eu-central-1) | All stored Personal Data: saved snapshots, recorded statement versions, export records, user e-mail addresses and roles | Data stays in the EEA; Supabase's data processing addendum (EU SCCs and UK Addendum) covers support access from elsewhere |
| Vercel, Inc. | Hosting of the web application, serverless functions, edge network, product analytics | Global edge network; functions pinned to Frankfurt, Germany (fra1) | Personal Data in transit through the application at save, assistant, narrative and export; connection logs; analytics events (counts and flags only) | Vercel's data processing addendum (EU SCCs and UK Addendum) |
| Anthropic, PBC | The assistant's language model | United States | Account names and codes, the Customer's answers (including any text typed for them), and each note as it prints with its figures, so the assistant can write about them; the assistant never supplies a figure to a note's narrative — every number in a paragraph must match the engine's figures, the note's fixed allow-list or text the Customer entered or confirmed for that note, or the paragraph is refused. A note can carry individuals' names (directors, related parties) where the note states them. Where the Service offers it, and when the Customer chooses to have them read, Anthropic also receives the prior year's issued financial statements and the commercial registration extract, whole, including the names, and any identification numbers, nationalities, dates of birth, addresses and signatures, of people printed on them. Under its commercial terms, Anthropic does not use what is sent to train its models unless the customer permits it; Hayatiq has not given that permission and sends Anthropic no feedback. Under the data-retention policy Anthropic publishes for its commercial API customers, it deletes what is sent, and what it returns, within thirty (30) days of receiving or generating it, and keeps it longer only where that policy says so, such as content flagged under its usage policy (which Anthropic may keep for up to two years), or where the law requires it; this applies to every request the assistant makes. The retention setting of Hayatiq's organisation with Anthropic shows the same thirty (30) days, and the organisation has not joined Anthropic's development partner programme or allowed user feedback (read 2026-09-27). Zero data retention is not in place, and Hayatiq has not requested it. The assistant runs on the terms set out in this annex | Anthropic's commercial terms and data processing addendum (EU SCCs and UK Addendum) |
| Resend, Inc. | Transactional e-mail (sign-in links, service notices) | United States | The user's e-mail address and the e-mail content | Resend's data processing addendum (EU SCCs and UK Addendum) |
| GitHub, Inc. | Runs the nightly backup job (a scheduled workflow on a GitHub-hosted runner) | United States (GitHub-hosted runners) | A transient copy of the production database for the duration of the nightly run, encrypted on the runner before anything is uploaded; the runner is discarded at the end of the job and the workflow keeps no copy | GitHub's data protection agreement (EU SCCs and UK Addendum) |
| Cloudflare, Inc. | DNS for the hayatiq.ai domain (DNS only; the proxy is not in front of financials.hayatiq.ai) and storage of the encrypted nightly database dumps in an R2 bucket under EU jurisdiction | Global network, United States; the backup bucket under EU jurisdiction | Connection metadata (the hostname requested by a resolver); the encrypted dumps, which Cloudflare cannot read because the key is held by Hayatiq's owner outside Cloudflare | Cloudflare's data processing addendum (EU SCCs and UK Addendum) |
Paddle.com Market Ltd (or its affiliate shown at checkout) is the merchant of record for every purchase: checkout, payment, tax, invoices and refunds. It receives the billing contact and payment data of the Customer's buyer as an independent controller under its own notice, and Hayatiq receives identifiers, plan and status only. Paddle is not a Sub-processor for Hayatiq and receives no Engagement Data.
Each provider's published security and privacy documentation: Supabase, Vercel, Anthropic, Resend, GitHub, Paddle, Cloudflare.
Annex 4 — Execution (optional signed copy)
| Field | Customer | Hayatiq |
|---|---|---|
| Legal name | [Customer to complete] | HAYATIQ AI SOLUTIONS F.Z.E |
| Registered address | [Customer to complete] | B.C. 1306744, Ajman Free Zone C1 Building, Ajman Free Zone, Ajman, United Arab Emirates |
| Hayatiq Financials account (owner e-mail, organisation) | [Customer to complete] | — |
| Applicable Data Protection Law (tick all that apply) | UAE PDPL · PDPL (Saudi Arabia) · GDPR (EU) · UK GDPR · [Customer to complete — other law, if any] | — |
| Contact for data-protection matters | [Customer to complete] | privacy@hayatiq.ai |
| Signed by (name, title) | [Customer to complete] | [Hayatiq's authorised signatory: name and title, completed on each countersigned copy] |
| Signature and date | [Customer to complete] | [Hayatiq's authorised signatory: signature and date, completed on each countersigned copy] |
Annex 5 — SDAIA Standard Contractual Clauses
See section 12.2. The Standard Contractual Clauses for Personal Data Transfer published by the Saudi Data & Artificial Intelligence Authority on 1 September 2024 under the Regulation on Personal Data Transfer Outside the Kingdom — their controller-to-processor form where the Customer is the Controller of Engagement Data, and their processor-to-processor form where the Customer is itself a processor for its clients (section 1) — are incorporated into this DPA without modification; where they conflict with this DPA, they prevail (section 3.3). The information the clauses ask the parties to supply is completed as follows.
| The clauses ask for | Completed from this DPA |
|---|---|
| Personal Data Exporter | The Customer: the Organisation that holds the Hayatiq Financials account (name, address and contact as in Annex 4 where a signed copy is made; otherwise the account owner's details on the account). Role: Controller, or Processor for its clients in the processor-to-processor form |
| Personal Data Importer | HAYATIQ AI SOLUTIONS F.Z.E, B.C. 1306744, Ajman Free Zone C1 Building, Ajman Free Zone, Ajman, United Arab Emirates; contact privacy@hayatiq.ai. Role: Processor, or Sub-processor in the processor-to-processor form |
| Purpose of the transfer | Performance of the Terms of Service for the Customer: storing saved engagements, rebuilding statements at export and the assistant (Annex 1, "Purpose" and "Nature of the processing") |
| Basis of the transfer | The transfer implements the agreement between the Customer and Hayatiq and serves the Customer's own duty or contract to prepare financial statements; the safeguard is these clauses |
| Categories of Data Subjects | Directors, shareholders, partners, key management, related parties and employees of the Customer's client entities or of the Customer, and signatories of the client entity's prior financial statements; the Customer's own users (Annex 1) |
| Categories of Personal Data | Names of natural persons where they appear in account names, answers, note worksheet tables or a sole proprietorship's entity name, with the amounts beside them; user e-mail addresses and roles; where the Service offers document reading, the names, and any identification numbers, nationalities, dates of birth, addresses and signatures, of people printed in a document the Customer chooses to have read, received for that reading only; the names it proposes are held in the Customer's browser until confirmed and, once confirmed, are Engagement Data like any answer (Annex 1). No sensitive data: the Customer must not enter any |
| Nature and frequency of the processing | Storage and retrieval; server-side rebuilding of statements at export; streaming of the export; transmission to the model provider, including, where the Service offers it, a document the Customer chooses to have read, whole, for that reading and not stored by Hayatiq; a nightly encrypted backup of the database (Annex 2). Continuous while an engagement is saved; event-driven at save, assistant (including a document reading, where the Service offers it), narrative and export (Annex 1) |
| Duration | The life of the Customer's account plus the return-and-deletion period (section 14; Annex 1); at the model provider, as Annex 3 states: deleted within thirty (30) days of receiving or generating it, longer only in the cases stated there |
| Country of the importer and of onward processing | United Arab Emirates (the importer); Germany (storage and application functions); United States (the model provider, transactional e-mail, DNS, and the transient nightly backup run); the encrypted backup store under EU jurisdiction (Annex 3) |
| Sub-processors and onward transfers | Annex 3; each engaged under section 9 (thirty days' notice, objection, termination); each engaged on written terms that protect Personal Data to at least the standard this DPA requires, as appropriate to the service provided |
| Security measures | Annex 2, implemented and planned as marked |
| Data Subject requests and complaints | Section 10; privacy@hayatiq.ai; the Customer answers as Controller; for a transfer under these clauses, a Data Subject may notify the Saudi Data & Artificial Intelligence Authority |
| Return and deletion | Section 14 |
| Governing law and forum of the clauses | As the clauses themselves fix them; section 17 defers to them |
| Date and signature | Entered into by the Customer's acceptance of the Terms of Service; a countersigned Annex 4 records the parties' names for a signed copy |
Annex 6 — EU Standard Contractual Clauses and UK Addendum
See section 12.3. The standard contractual clauses for the transfer of personal data to third countries annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 — Module Two (controller to processor) where the Customer is the Controller, and Module Three (processor to processor) where the Customer is a processor for its clients — and, for transfers subject to the UK GDPR, the Information Commissioner's International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B1.0, in force 21 March 2022), are incorporated into this DPA without modification; where they conflict with this DPA, they prevail (section 3.3). Options selected: Clause 7 not included; Clause 9(a) Option 2 (general written authorisation; thirty (30) days' notice; section 9.2); Clause 11(a) without the optional body; Clause 13 the supervisory authority of the exporter's Member State; Clause 17 Option 1, the law of Ireland; Clause 18(b), the courts of Ireland. The annexes and tables are completed as follows.
Annex I.A — List of parties.
| Detail | Data exporter | Data importer |
|---|---|---|
| Name and address | The Customer, as on the account (Annex 4 where a signed copy is made) | HAYATIQ AI SOLUTIONS F.Z.E, B.C. 1306744, Ajman Free Zone C1 Building, Ajman Free Zone, Ajman, United Arab Emirates |
| Contact | The Customer's data-protection contact (Annex 4) or account owner | privacy@hayatiq.ai |
| Activities relevant to the transfer | Preparing draft financial statements for its own entity or its clients' entities through the Service | Providing Hayatiq Financials: storage of saved engagements, rebuilding at export, the assistant |
| Role | Controller (Module Two) or Processor (Module Three) | Processor (Module Two) or Sub-processor (Module Three) |
| Signature and date | By acceptance of the Terms of Service; the countersigned Annex 4 for a signed copy | The same |
Annex I.B — Description of the transfer.
| Item | Content |
|---|---|
| Categories of data subjects | Directors, shareholders, partners, key management, related parties and employees of the Customer's client entities or of the Customer, and signatories of the client entity's prior financial statements; the Customer's own users (Annex 1) |
| Categories of personal data | Names where they appear in account names, answers, note worksheet tables or a sole proprietorship's entity name, with the amounts beside them; user e-mail addresses and roles; where the Service offers document reading, the names, and any identification numbers, nationalities, dates of birth, addresses and signatures, of people printed in a document the Customer chooses to have read, received for that reading only; the names it proposes are held in the Customer's browser until confirmed and, once confirmed, are Engagement Data like any answer (Annex 1) |
| Sensitive data | None; the Customer must not enter any (Annex 1) |
| Frequency | Continuous while an engagement is saved; event-driven at save, assistant (including a document reading, where the Service offers it), narrative and export |
| Nature of the processing | Storage and retrieval; server-side rebuilding of statements at export and streaming of the file; transmission to the model provider of account codes and names, of account names with their statement lines, of each note as it prints with its figures and the answers it draws on, or, where the Service offers it, of a document the Customer chooses to have read, whole, for that reading and not stored by Hayatiq (Annex 1) |
| Purpose | Performance of the Terms of Service for the Customer; no other purpose |
| Retention | Privacy Policy section 10 and section 14 of this DPA, including the backup retention in Annex 2 and the model provider's retention in Annex 3 |
| Transfers to sub-processors | Those in Annex 3, for the purposes and durations stated there, under section 9 |
Annex I.C — Competent supervisory authority. The authority of the Member State in which the data exporter is established (Clause 13(a), first option), as the Customer identifies it in Annex 4; for the UK Addendum, the Information Commissioner.
Annex II — Technical and organisational measures. Annex 2 of this DPA in full, implemented and planned as marked.
Annex III — List of sub-processors. Annex 3 of this DPA (Supabase, Vercel, Anthropic, Resend, GitHub, Cloudflare), with each one's purpose, location and mechanism. Under Clause 9(a) Option 2 the list is agreed by the general authorisation and updated on thirty (30) days' notice.
The UK Addendum, Part 1.
| Table | Content |
|---|---|
| Table 1 — Parties | As Annex I.A; start date: the Customer's acceptance of the Terms of Service |
| Table 2 — Selected SCCs, modules and clauses | The EU SCCs as set out above (Module Two or Three; Clause 7 not included; Clause 9(a) Option 2, thirty (30) days; Clause 11 without the optional body; Clauses 17 and 18 as above, with the Addendum's mandatory clauses prevailing for UK transfers) |
| Table 3 — Appendix information | Annex I.A, I.B, II and III as completed above |
| Table 4 — Ending this Addendum when the ICO's addendum changes | Importer and Exporter (either party may end it under the Addendum's own terms if the Information Commissioner's revision makes it unworkable) |