Data Processing Addendum

Numbrr.ai Data Processing Addendum (DPA) Last Updated: January 26, 2026 1. Definitions "Client Data": Information provided by Client. "Sub-Processor": Third party appointed by Numbrr.ai. 2. Processing of Data Processed solely for bookkeeping, tax, and CFO services. No use for model training outside specific engagement. 3. Authorized Sub-Processors - QuickBooks Online (Intuit) - USA - Xero - USA / NZ - Stripe - USA 4. Security Measures - Encryption at rest and in transit. - Access Control. - Vulnerability Management. 5. Data Breach Notification Notify Client without undue delay (max 72 hours). 6. Return or Deletion of Data Upon termination, delete or return data at Client's choice.