HelmsteadHelmstead

Data processing addendum

Version
1.0
Effective date
All legal docs
Table of contents
  • Who’s who. For its own personal data, the Customer is the controller and Helmstead (Suverenum Inc.) is its processor. If the Customer handles personal data for its own clients, the Customer is a processor and we’re its subprocessor.
  • What it covers. Personal data in the content the Customer connects, uploads, or creates in Helmstead.
  • Instructions. We process that data only on the Customer’s documented instructions, or where the law requires it.
  • No sale, ads, or training. We don’t sell Customer content, use it for advertising, or use it to train AI models.
  • Subprocessors. They’re listed in our Subprocessors document. We give 30 days’ notice before adding or replacing one, and the Customer has 30 days to object.
  • Location and transfers. We process and store Customer Personal Data in the United States. Transfers from the EU and UK are covered by the EU Standard Contractual Clauses and the UK Addendum.
  • Security incidents. We tell the Customer without undue delay after we become aware of an incident affecting its personal data, or sooner if the law sets a shorter deadline.
  • When service ends. The Customer can export its data for 30 days after its workspace closes. We then aim to delete it within 30 days, and backup copies expire within 30 days after that. The Customer can instead ask us to delete it without return.
  • Audits and help. We share the information needed to show we comply, allow audits, and help with rights requests, breach notices, and impact assessments.

This DPA is based on the Bonterms Data Protection Addendum v2.0, a standard template written by technology lawyers. The sections below set out where we change it.

If this summary and the full terms below differ, the full terms apply.

This addendum sets out how Suverenum Inc. processes Customer Personal Data when providing Helmstead. It’s made up of the incorporated Bonterms terms, the DPA Details below, the Additional Terms, and Schedules 1–4.

This is Helmstead’s standard DPA. Its schedules are completed with standard values, and its Subprocessor List is our Subprocessors document. A Customer with a Customer Agreement may agree to a different DPA instead.

The parties incorporate by reference the Bonterms Data Protection Addendum Version 2.0 (Signable Version), © 2026 Bonterms, Inc., including Sections 1–10 and Exhibits A and B. This is the exact version at Bonterms DPA v2.0, as published and reviewed on September 24, 2026. Later Bonterms versions aren’t automatically incorporated. The DPA Details in this document replace the blank DPA Details in the Bonterms form. The Additional Terms below expressly modify the Bonterms provisions they identify.

Capitalized terms have the meanings in the incorporated terms unless modified below. “DPA” means this combined agreement. Customer agrees to it by accepting it online at checkout, as the Terms of service describe, or through a Customer Agreement that expressly adopts this version. Publishing this DPA or using Helmstead isn’t, by itself, agreement to it.

Key term Selection
Provider Suverenum Inc., a Delaware corporation; Helmstead is its product
Provider address 2261 Market Street STE 77991, San Francisco, CA, 94114 US
Provider privacy and DPA contact privacy@helmstead.co
Customer The Customer that accepts this DPA, with the legal name and country given at acceptance
Customer address The address given at checkout
Customer privacy contact Customer’s workspace admins and buyer of record, unless Customer names another contact by email to privacy@helmstead.co
Customer incident contact Customer’s workspace admins and buyer of record, unless Customer names another contact by email to privacy@helmstead.co
Customer subprocessor-notice contact Customer’s workspace admins and buyer of record, unless Customer names another contact by email to privacy@helmstead.co
Main Agreement The Terms of service and Plan terms accepted with this DPA, or a Customer Agreement that adopts this DPA
DPA Effective Date The date Customer accepts this DPA
Service Helmstead treasury and accounting workbooks, connected-data features, and AI assistance, as described in Schedule 3
Customer role Controller for its own Customer Personal Data. Processor for Customer Personal Data it processes in Helmstead for its own clients or other controllers, for example as an accounting firm. Each role applies to the datasets it covers
Subprocessor List The Subprocessors document in effect, maintained under Section 2.3 below
Designated EU Governing Law Ireland
Designated EU Member State Ireland
Incident notice Without undue delay after Provider becomes aware; this replaces the Bonterms 48-hour maximum under Section 2.4
Subprocessor change notice 30 calendar days before processing begins; 30 calendar days for objections, under Section 2.3
Security Measures Schedule 2

Ireland is the choice of governing law and courts for EU transfer clauses. It is not a statement that either party is established there.

These Additional Terms modify Bonterms Sections 1.7, 1.26, 2.2, and 2.6 as follows:

  • Customer Data, also called Customer Content, means information supplied, uploaded, connected, or made available by or for Customer through the Service, and information generated from it. It includes source financial and employment records, files and metadata, workbooks and versions, edit history, prompts, retrieved context, tool results, conversations, AI answers, and execution or recovery copies. Feedback that contains or reproduces this material remains Customer Content.
  • Customer Personal Data means Personal Data in Customer Content. The DPA’s confidentiality, instruction, security, return/deletion, and no-reuse commitments also protect Customer Content that is not Personal Data. Statutory duties still depend on the relevant law.
  • The Security Measures are the ones set out above, not an unspecified security description in the Main Agreement. The Main Agreement may add stronger protections.
  • Mandatory Data Protection Laws prevail. The EU SCCs and the UK Addendum, including their mandatory clauses, prevail over conflicting terms. The UK Addendum governs the modifications needed for UK transfers. Subject to that priority, these Additional Terms expressly amend the Bonterms provisions and Exhibits they identify. Otherwise, the Bonterms order of precedence applies.
  • Liability limits, exclusions, audit restrictions, or exclusive remedies in the Main Agreement don’t restrict any of these: mandatory statutory rights; supervisory-authority powers; or rights, obligations, remedies, and liability under the EU SCCs or UK Addendum, including claims between the parties under those instruments. Bonterms Section 2.6 is limited accordingly.

Within that hierarchy, the source-specific restrictions in Section 2.2 and their stop-processing and deletion duties under Section 2.6 prevail over broader permissions, retention periods, or return arrangements in this DPA and its schedules.

The Privacy policy describes Provider’s personal-information practices. It does not amend this DPA, supply Customer Instructions, or authorize additional uses of Customer Content.

This section supplements Bonterms Section 3 and narrows any broader processing permission in the Main Agreement.

Provider will process Customer Personal Data only on Customer’s documented instructions, including instructions about transfers, or as required by applicable law. The Main Agreement, this DPA, the completed schedules, authorized feature selections, and later lawful written instructions make up those instructions. Customer’s instructions must stay within the agreed purposes and permissions. If the law requires Provider to process differently, Provider will tell Customer before processing, unless the law forbids that notice on important grounds of public interest. The transfer instruments’ additional requirements still apply.

Provider will tell Customer immediately if, in its opinion, an instruction infringes applicable EU, UK, or other Data Protection Laws. Provider will suspend that instruction while the parties resolve it. Customer is responsible for lawful instructions, required notices and legal bases, and any controller authorization needed when Customer acts as a Processor. Customer authorization does not replace a legal basis or consent required from an individual.

Provider will ensure that people authorized to process Customer Personal Data are bound by written or statutory confidentiality duties and have access only as needed for their authorized work. Customer Content may be used to deliver the selected features and for narrowly scoped support, security, and troubleshooting needed to provide those features. Human access must be necessary, authorized, and limited to the task. This doesn’t authorize routine human review of content for product development.

These limits apply to Provider, and Provider must impose them on content Subprocessors:

  1. No advertising or cross-customer reuse. Customer Content must not be sold, shared for behavioral advertising, used for advertising audiences, or used for evaluation or benchmarking across customers. This includes financial records, files, prompts, and AI answers.
  2. No model training. This DPA doesn’t authorize training, retraining, or fine-tuning with Customer Content. Any future use needs a separately agreed written amendment that identifies the data, purpose, model, recipients, retention, and safeguards, plus required notices, lawful bases, and consent. Continuing to use the Service isn’t authorization. Customer’s agreement or a later amendment cannot override Google’s, Intuit’s, Xero’s, or other applicable source-specific restrictions.
  3. No general improvement permission. A reference to service improvement, feedback, analytics, operational monitoring, or de-identification in another term does not authorize reuse of Customer Content to develop or improve products or models. This DPA doesn’t incorporate the separate Bonterms AI Addendum or its operational-monitoring allowance. Any same-customer evaluation beyond necessary delivery or troubleshooting needs a specific documented instruction within this DPA’s limits.
  4. Selected AI processing. The deployment uses the AWS Amazon Bedrock or Microsoft Azure OpenAI service identified in Schedule 3, without automatic fallback to the other provider. Model publishers are listed as recipients only if they actually receive Customer Personal Data. Permitted provider retention, automated abuse checks, and any authorized human review must be identified in Schedule 3 and remain consistent with this DPA and source-data restrictions. Selecting a provider doesn’t authorize every feature or setting it offers.
  5. Derived information stays protected. Summaries, extracted information, and other derivatives retain the applicable Customer Content restrictions. Aggregating or anonymizing information does not itself authorize a new use or remove a source-specific restriction.

Provider’s use and transfer of information received through Google APIs will adhere to the Google API Services User Data Policy and Google Workspace user data policy, including Limited Use requirements.

Google data may be used only for permitted user-facing features. Transfers must be permitted by those policies: to provide or improve the permitted features with required user consent, protect security, or comply with applicable law. A transfer in a merger, acquisition, or asset sale requires the user’s explicit prior consent. Any narrower restriction in this DPA continues to apply.

Human access is limited to cases allowed by Google: the user explicitly agrees to access to specific content for support; access is necessary for security or legal compliance; or genuinely aggregated and anonymized information is used for permitted internal operations. Google data must not be sold, used for advertising, or used for creditworthiness or lending decisions. It must not be used to create, train, or improve AI models beyond a specific user’s personalized model for a permitted feature, and this DPA does not authorize even that training. These restrictions extend to derived, aggregated, and anonymized information.

Provider will comply with the Microsoft APIs terms for information accessed or obtained through Microsoft APIs, including Microsoft Graph. “Microsoft APIs Data” includes that information and any aggregated, anonymized, or derived forms, whether or not it is Personal Data. This includes API-derived identity information, mail, files, and metadata.

Provider will request only the minimum permissions and data needed for the intended functionality. It will not request, use, or make data available outside permissions expressly granted by Customer and its authorized users. Provider will obtain all necessary consents before processing and additional consent if processing changes. Customer Instructions do not replace required user consent.

Microsoft APIs Data must not be used or transferred for advertising or marketing. Independently obtained business-contact information is distinct from API-derived identity or contact data. Provider must not relabel API-derived information as independent contacts, telemetry, or other data to bypass this restriction.

Provider will keep stored copies up to date and implement corrections, restrictions, and deletions reflected in the source data. Provider will delete all Microsoft APIs Data associated with a user when they abandon or uninstall the Service, close their account with Provider, or abandon that account, including copies held by Provider or its Subprocessors. These duties apply without a separate deletion request and take priority over general history, return-window, and backup-retention provisions. Specific information may be preserved only where required by law, for the required purpose and duration, under Section 2.6.

Provider will explain how users can revoke access through Microsoft My Apps, including the need for an administrator to remove administrator-granted permissions, and any additional steps to remove local connections. Where personal Microsoft accounts are supported, the applicable route is Microsoft account consent. The Privacy policy’s access guidance describes these controls. These source-data duties are separate from Microsoft Azure OpenAI hosting terms and continue to apply if source data is sent for permitted AI processing.

Provider will comply with Section 12.2 of the Intuit developer terms, dated October 14, 2025. “QuickBooks data” means the User Data and Personal Information accessed through Intuit’s services, including company financial data that is not Personal Data. These limits also protect copies and information derived from that data.

Provider does not process QuickBooks User Data or Personal Information on Intuit’s behalf. Customer may instruct Provider under this DPA for Customer’s own processing purposes, within the limits below. That does not make Provider Intuit’s Processor or Subprocessor. The parties’ legal roles depend on the actual processing purpose and applicable law, not the labels in this DPA.

Provider will store, process, and use QuickBooks data only to provide the Service’s functionality to users, within their consent, Intuit’s permitted uses, and applicable law. Permissions remain tied to the connected company and Customer; copying data or deriving information does not create a new permission. Provider must not sell QuickBooks data or make it available to a third party for a use that does not directly support or facilitate the user’s access to or use of the Service. Before sharing with any permitted third party, including a service provider or AI recipient, Provider must impose written data-protection and security obligations at least as restrictive as Intuit’s terms and applicable law, and enforce compliance. Consent, Customer Instructions, and recipient selections cannot authorize a prohibited use.

Provider keeps each Customer’s QuickBooks data isolated within that Customer’s workspace. Provider does not share one Customer’s QuickBooks data with another customer organization or use it for cross-customer insights, evaluation, or benchmarking. Access by authorized people in Customer’s workspace and permitted service providers is limited to supporting that Customer’s use of the Service, not supplying another customer with data. This DPA’s advertising and model-training prohibitions continue to apply.

If a user revokes consent, disconnects QuickBooks Online, or terminates, deletes, or ceases use of the Service, Provider will immediately stop accessing and processing the affected company’s QuickBooks data. This includes copied and derived data in workbooks, edit and conversation history, AI results, and execution or recovery copies. Provider must ensure that service providers processing the affected data on its behalf also stop immediately. No ordinary history period, 30-day completion aim, backup schedule, continuing Customer purpose, or delay in Intuit’s revocation postpones this duty.

Provider will securely delete QuickBooks data on a valid user request, including a request made through Intuit where Intuit processes it. A valid request through Intuit doesn’t need a repeat request to Provider or a separate Customer Instruction. Deletion covers copied and derived data held by Provider and service providers acting on its behalf. Stopping access and processing isn’t the same as secure deletion: disconnecting doesn’t instantly erase every copy. Copies awaiting secure deletion must stay protected and out of active use. The only exception to secure deletion is specific records that applicable law requires Provider to keep for recordkeeping, for the required purpose and duration, under Section 2.6.

For a Xero connection offered and enabled under Schedule 3, Provider will comply with the Xero developer terms. “Xero API Data” means information accessed, received, transmitted, or generated through the developer platform’s APIs, in raw or processed form. The restrictions protect this data and its derivatives, including data that is not Personal Data.

Provider will use Xero API Data only for the selected features, within granted permissions and use cases approved by Xero. It must not use Xero API Data to train, fine-tune, adapt, or enhance any AI model. Provider must not pass Xero API Data to another third party, including an AI recipient, without the associated user’s consent, or for a purpose or activity that conflicts with Xero’s terms. Consent, Customer Instructions, and selection of an AI provider do not authorize a prohibited use or establish that an inference use case is approved. Provider must not sell user data or aggregate and supply user data or Xero API Data to another app or third party.

The Google, Microsoft, QuickBooks Online, and conditional Xero restrictions apply to the covered source data, not only its personal-data portions, and remain attached to copied and derived information. Subject to Section 2.1’s mandatory-law and transfer precedence, no later Customer Instruction, schedule selection, or amendment may override applicable platform restrictions, including source-specific stop-processing and deletion duties. Narrower limits in this DPA continue to apply.

This section modifies Bonterms Sections 1.31, 4, and 10.1.1. It replaces general permission to process or transfer globally, including through Affiliates.

Customer authorizes only the Subprocessors and processing locations listed in the Subprocessors document in effect when Customer accepts this DPA, with later changes subject to this section. Affiliates receive no separate blanket authorization. Provider will maintain the Subprocessors document with each recipient’s name, what it does, the kind of data it handles, and its processing location, and will give the recipient’s data processing agreement, legal entity, and remote-access, logging, and backup locations on request. Provider publishes each version of the Subprocessors document with its effective date, and keeps earlier versions available.

Before a Subprocessor processes Customer Personal Data, Provider will enter into a written agreement with it that imposes the same applicable data-protection obligations as this DPA, including appropriate security, instruction limits, confidentiality, incident assistance, rights assistance, deletion/return, and transfer protection. Provider remains responsible for the Subprocessor’s performance of those obligations. Recipients of QuickBooks data must also meet the permitted-use and written-agreement limits in Section 2.2. Onward processing must meet any additional requirements of the EU SCCs or UK Addendum.

Provider will notify Customer’s subprocessor-notice contact by email, and in Helmstead, at least 30 calendar days before adding or replacing a Subprocessor. The notice will identify the entity, service, data, locations, and relevant protections, and link to the new version of the Subprocessors document. Customer has 30 calendar days after notice to object on reasonable data-protection grounds.

The parties will work in good faith to resolve an objection, including by avoiding the recipient or providing an alternative. While an objection is unresolved, Provider will not send the affected Customer Personal Data to the proposed recipient. If the parties can’t resolve it, Customer may terminate the affected Service and get a refund of prepaid unused fees. This is not an exclusive remedy for a breach or a restriction on mandatory rights; Bonterms Section 4.4.2 is amended accordingly.

A new processing country, expanded purpose, or material expansion of permitted data requires Customer’s prior written agreement to an updated Schedule 3 or Subprocessors document. Silence after a notice doesn’t authorize a new country or purpose. A Subprocessor replacement within the agreed scope and locations follows the notice and objection process above.

Bonterms Section 5 applies with Schedule 2, and with these modifications to Sections 1.28 and 5.2.2: Provider will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data. The default 48-hour Specified Notice Period is removed, and no fixed-hour maximum is selected. If the law sets a shorter mandatory deadline, that deadline applies.

Provider will send notice to Customer’s incident contact. The notice will give the information available about the incident’s nature, affected data and individuals, likely consequences, containment, and corrective measures, and a contact for follow-up. Provider will send more information in phases as it becomes available. It won’t delay the first notice to complete its investigation. Provider will investigate, contain, and remediate within its responsibility, preserve relevant incident records, and help Customer with required notices and other response duties.

Customer decides what notices to give its controllers, affected individuals, and authorities, subject to Provider’s own legal duties and the transfer instruments. Provider will coordinate with Customer where legally permitted. An unsuccessful attack is excluded only if it does not compromise Customer Personal Data within the Security Incident definition.

Bonterms Sections 6 and 7 apply. The condition in Section 7.1 that Customer cannot reasonably fulfill a request independently does not limit assistance required by law or the transfer instruments.

Taking account of the nature of processing and information available to it, Provider will assist Customer with access, correction, deletion, restriction, portability, objection, and other applicable rights through appropriate technical and organizational measures. Provider will forward requests concerning Customer Personal Data without undue delay and will not decide them on Customer’s behalf unless instructed or required by law. Provider may help an individual identify the responsible Customer and explain that routing. Direct duties to individuals under the EU SCCs, UK Addendum, or applicable law remain intact.

Provider will assist with security obligations, breach notifications, impact assessments, prior consultation with authorities, and transfer assessments as required by applicable law. Provider’s assistance must come in time to meet applicable legal deadlines. The deletion aim below doesn’t extend those deadlines.

This section replaces Bonterms Section 8, including its default backup and record-retention exceptions and any conflicting Main Agreement term.

The source-specific duties in Section 2.2 apply on their stated triggers. The Microsoft API-source deletion duties apply without a separate deletion request. The QuickBooks Online duties require an immediate stop to access and processing when consent or use ends, and secure deletion on a valid user request made directly or through Intuit. These duties take priority over general history, retention, return windows, the 30-day completion aim, and backup expiry in this section and the schedules, subject to Section 2.1. Any legally required preservation must stay within the narrow limits below.

During the Service, Customer may request access, return, correction, restriction, or deletion through available Service functions or privacy@helmstead.co. Provider will act on valid, authorized instructions, including instructions concerning copied or derived content and relevant Subprocessor copies.

In this section and Schedule 3, termination means the day Customer’s workspace closes. At termination or expiration, Customer chooses return followed by deletion, or deletion without return, as recorded in Schedule 3 or a later written instruction. Provider will offer a reasonable opportunity for return before deletion and provide the data in an agreed, commonly used, accessible format. Return does not authorize indefinite retention of Provider’s copies. Subject to Section 2.1’s mandatory-law and transfer precedence, neither this choice nor a return window may delay the QuickBooks stop required by Section 2.2 or restart prohibited processing.

Provider will act without undue delay and aim to complete deletion within 30 days after a valid, authorized deletion request or, at termination, after the 30-day return window in Schedule 3 ends, subject to lawful Customer instructions and applicable law. This is an aim, not an absolute service-level guarantee. Mandatory deadlines, source-specific stop-processing and deletion duties, and the EU SCCs’ or UK Addendum’s deletion/return duties are not extended by this aim. Provider will tell Customer about material delays, their reason, and the expected completion date.

Backups awaiting expiry must remain protected, isolated from active use, and unavailable for unrelated processing. They must be securely deleted or expire within the maximum residual backup period in Schedule 3, including copies held by Subprocessors. That period is a finite maximum, not an indefinite exception. Provider will not reset it by copying or restoring the data. A restore must remain restricted until relevant deletion instructions, source-specific processing restrictions, and expiry rules have been reapplied, before any permitted active use. Delayed backup expiry is permitted only to the extent consistent with applicable law, the mandatory transfer clauses, and Section 2.2’s source-specific duties.

If law requires specific information to be retained, Provider will identify the legal requirement, scope, and duration to Customer unless legally prohibited. It will protect that information, restrict processing to the legally required purpose, and delete it when the requirement ends. No accounting label, audit record, append-only storage design, or standard internal retention policy creates a blanket exemption. For QuickBooks data, this exception covers only recordkeeping required by applicable law, with retained records kept out of active use and securely deleted when that obligation ends.

On request, Provider will give Customer a written deletion confirmation that accurately identifies completed deletion, any remaining protected backup copies and their expiry deadline, and any legally required retention. It must not certify deletion that has not occurred. This DPA continues to protect retained Customer Personal Data until processing ends.

This section modifies Bonterms Sections 9.2.3 and 9.3. Provider will make available all information necessary to demonstrate compliance and allow for and contribute to audits, including inspections, by Customer or an auditor mandated by Customer, as required by Article 28, applicable US privacy laws, and the transfer instruments.

Available third-party reports may support an assessment but are not a mandatory substitute for audit or inspection rights. The parties may agree reasonable notice, scope, confidentiality, and arrangements to protect other customers and avoid unnecessary disruption. Agreement on a plan must not become a veto or delay legally required access. No annual limit, independent-auditor-only condition, business-hours restriction, facilities limitation, confidentiality term, or allocation of costs may prevent an audit required by law, the transfer instruments, a competent authority, or a substantiated compliance concern or Security Incident.

Provider will make relevant Subprocessor compliance information available and secure the necessary cooperation through its contracts. Regulator access and disclosure of findings to competent authorities remain unrestricted to the extent required by law. This section does not represent that Provider holds any certification or audit report.

Bonterms Exhibit B, Section A applies when the CCPA applies and is supplemented and narrowed as follows. Comparable Controller/Processor duties under other applicable US state privacy laws also apply.

  • Customer discloses Customer Personal Data only for the limited and specific purposes in Schedule 1 and the Service described in Schedule 3. “Otherwise performing under the Main Agreement” in Exhibit B, Section A.2.1 does not authorize additional purposes.
  • Provider will comply with applicable CCPA obligations, provide the same level of privacy protection the CCPA requires, and act as a service provider or contractor as applicable to the processing.
  • Provider will not sell or share Customer Personal Data; retain, use, or disclose it for an unrelated commercial purpose; or use it outside the direct business relationship with Customer, except as required by law. It will not combine it with information from other customers or its own interactions with individuals except where both permitted by law and necessary for the specific instructed Service. Advertising and cross-customer evaluation or benchmarking remain prohibited.
  • Customer may take reasonable and appropriate steps to monitor compliance, including the audits described above, and, on notice, stop and remediate unauthorized use. Provider will cooperate with those steps and notify Customer promptly if it determines that it can no longer meet its obligations.
  • Provider will support consumer requests and apply the required protections to downstream recipients. By agreeing to this DPA, Provider certifies that it understands and will comply with these restrictions.

Bonterms Exhibit A applies as completed in Schedule 4 and subject to the agreed locations in Schedule 3. Provider will not make a Restricted Transfer without an applicable lawful mechanism and the required protections. For contractual safeguards, the parties will complete the applicable transfer assessment or UK data protection test and implement necessary supplementary measures. A location entry is not itself a transfer mechanism.

Provider will comply with the EU SCCs’ and UK Addendum’s provisions on government access, notice, review and challenge of requests, disclosure minimization, and inability to comply. If required protections cannot be maintained, the affected transfer must be suspended and the parties must follow the applicable termination, return, or deletion requirements. Mandatory safeguards must be in place before processing proceeds.

Bonterms Exhibit A, Section 4 does not establish that Suverenum Inc. is certified under any Data Privacy Framework. This DPA selects no DPF reliance for transfers to Provider. A later adequacy-based route may be used only if it actually covers the recipient and processing, is lawful at the time, and is documented in an agreed Schedule 3 update. Statutory adequacy rules do not themselves expand the agreed locations or purposes.

Provider will supply copies of applicable transfer safeguards on request to privacy@helmstead.co, with only the redactions permitted by the relevant instrument or law.

Party Details
Data exporter Customer identified in Section 1; contact and address as stated there
Customer activities relevant to processing Customer’s business use of Helmstead for accounting and treasury work, on the datasets Customer connects, uploads, or creates in Helmstead
Customer role As stated in Section 1: Controller for its own data, and Processor for data it processes for its own clients or other controllers
Controllers represented by a Processor Customer The controllers for whom Customer processes data in Helmstead. Customer keeps their names and contact details and gives them to Provider on request
Data importer Suverenum Inc.; address and privacy contact as stated in Section 1
Provider activities Providing the Helmstead Service, including instructed ingestion, storage, retrieval, workbook operations, AI inference, and related support and protection
Provider role Processor for Controller Customer; subprocessor for Processor Customer
Acceptance and date Customer’s acceptance of this DPA under Section 1 also executes the applicable transfer instruments from the DPA Effective Date

For Module 3, Customer confirms that its controller has authorized the processing and Subprocessors, and that Customer can give the instructions in this DPA. Provider will assist Customer in meeting its obligations to that controller. The controller’s rights under Module 3 are preserved.

Item Description
Subject matter Customer’s use of the Helmstead treasury, accounting, workbook, and AI features
Data subjects Customer’s authorized users, employees and other personnel, contractors, customers, prospective customers, suppliers, vendors, professional contacts, and correspondents; other people named in Customer’s records, files, or communications
Personal-data categories Names and contact details; business identities and roles; account and connection identifiers and permissions; financial and commercial records, transactions, and invoices; employment, pay, payroll deductions, and tax records; bank account/routing details and tax identifiers; uploaded or connected files, workbook cells, versions and edits; messages and attachments; file authors and site/library/drive metadata; prompts, retrieved context, tool results, generated answers and inferences; content-related support and audit metadata
Sensitive information Where included in Customer’s instructed source data: employee Social Security numbers or other national/tax identifiers, vendor tax identifiers, bank account and routing details, access credentials, and private correspondence. Payroll deductions or arbitrary uploaded material may reveal health, union membership, protected characteristics, or other specially protected information. Customer must tell Provider at privacy@helmstead.co before any intended special-category or criminal-offense processing, with its lawful conditions; incidental receipt remains protected by this DPA
Sensitive-data restrictions Use only for instructed features; minimize fields and retrieved context; restrict human and system access to the task; apply Schedule 2 protections; no advertising, training, cross-customer evaluation, or unrelated reuse; no new purpose through aggregation or de-identification
Nature of processing Collection or import; recording and storage; organization and retrieval; calculation and analysis; display to authorized users; workbook editing and history; instructed AI inference; limited execution and recovery copies; export, correction, restriction, and secure deletion
Purpose Deliver the Service on Customer Instructions, including accounting and financial analysis, finding requested information, maintaining workbooks and history, generating requested assistance, and necessary support and security. No independent product-improvement purpose is included
Frequency Ongoing during the Service, with individual transfers occurring on authorized synchronization, uploads, user requests, or scheduled processing that Customer turns on
Duration For the Main Agreement’s term and the limited return/deletion period in Section 2.6; category-specific clocks appear below
Subprocessor transfers Only for the functions, data, and locations in the Subprocessors document, subject to Section 2.3

The categories describe the permitted Service scope, not a requirement to upload every category. Customer may narrow them by written instruction. Provider must not expand the scope through a unilateral schedule change.

Actual data categories depend on the selected source and permissions. Sage ingestion can include employee Social Security numbers, pay, payroll deductions, vendor tax identifiers, and bank account/routing details. QuickBooks Online accounting access covers the chart of accounts, customers, vendors, invoices, bills, journal entries, payments, and reports read into workbooks; it does not itself grant payroll access. Mail, files, and uploads may incidentally contain any of the listed sensitive categories. Xero, where offered and enabled, may supply accounting categories such as accounts, contacts, transactions, and invoices only within the selected feature and permissions; these examples do not establish current access or approval.

All defaults below are subject to the source-specific duties in Section 2.2 and their priority under Section 2.6, including Microsoft API-source deletion without a separate request when its triggers occur and the immediate QuickBooks access-and-processing stop when consent or use ends. Ongoing Customer work, history, provider-side AI retention, and execution, recovery, or backup periods do not extend QuickBooks permissions.

Data Default instruction, subject to lawful deletion requests and any narrower agreed schedule
Customer source records, files, and workbooks Retain during the instructed Service for Customer’s ongoing work and history, then follow Customer’s return/deletion choice
Main conversations Until user deletion or an earlier applicable Customer deletion instruction or termination
Workbook conversations Up to 5 years after the last message, or earlier deletion
Workbook edit history Up to 5 years after each edit, or earlier deletion; handle separately from conversation deletion
Device-local workbook recovery Expires 7 days after the last saved update. The app checks expiry when it accesses or cleans the browser store; there’s no guaranteed immediate background purge while the app is closed
Optional durable execution inputs Cleared when the run ends; expire no later than 1 hour after acceptance
Optional durable replay copies Expire 24 hours after the run ends, with an absolute 25-hour limit after acceptance; access expiry and physical cleanup are distinct
Service support, security, and audit records containing Customer Personal Data Only for the instructed support or security purpose and the purpose-specific period in Schedule 3; identifiers remain Personal Data where linkable
Provider-side AI copies and logs Only for the specific purposes and periods stated for the selected service in Schedule 3; no universal zero-retention term is assumed
Backups Protected and out of active use pending secure deletion or expiry within the Schedule 3 maximum, subject to Section 2.6

These 5-year periods are maximums, not minimum retention requirements or guarantees that all history will remain available. Valid deletion requests, account closure, service termination, and applicable source-specific limits take priority.

Provider will explain how Customer can clear local recovery data. Customer controls its devices and downloaded exports; server deletion alone does not erase those copies. Provider’s duties concerning its own processing and Service-controlled copies remain in force.

The competent EU supervisory authority is determined under Clause 13 of the EU SCCs:

  • Where Customer is established in an EU member state, it’s the authority responsible for Customer’s establishment.
  • Where Customer isn’t established in the EU but has appointed a representative, it’s the authority of the member state where the representative is established.
  • Where Customer isn’t established in the EU and doesn’t need a representative, it’s the authority of the member state where the affected data subjects are.

The Irish governing-law selection does not determine the supervisory authority. For UK transfers, the competent authority is the Information Commissioner as provided by the UK Addendum. Swiss transfers, if relevant, follow Bonterms Exhibit A, Section 2.

These are proportionate measures Provider contracts to implement and maintain for the agreed Service. They describe contractual obligations, not certifications, audit results, or a guarantee that every risk is eliminated. Provider will review their effectiveness and adapt them to the nature, scope, context, and risks of processing without materially reducing protection.

Area Contracted measures
Authentication and authorization Validate sessions and permissions server-side at protected access points; limit access by role and business need; restrict administrative and service credentials and remove access when no longer authorized
Customer isolation Use tenant-scoped access controls, including database row-level security for tenant data and separate authorization checks for account/control records; preserve owner and sharing permissions for conversations, files, and workbooks
Encryption and secrets Protect transfers over external networks with TLS or equivalent encryption and hosted stores with storage-layer encryption. Use application-level encryption for designated credentials and content stores, including encrypted chat and optional durable-execution payloads. Restrict access to keys and secrets and manage their lifecycle. This does not promise that every field has application-level encryption, that all keys are KMS-held, or that encryption prevents authorized processing
Sensitive records Limit access to raw financial, employment, and identity records; minimize content copied into tools, prompts, and support material; apply additional safeguards agreed for intended sensitive-data processing
Audit and diagnostics Maintain access and security records appropriate to the risk, including tamper-evident audit records for relevant actions; minimize and filter personal information in ordinary diagnostics; keep credentials and raw Customer Content out of general analytics and audit metadata
Personnel and support Bind authorized personnel to confidentiality, communicate their data-protection responsibilities, and limit support access to the necessary task. Apply the stricter Google-data access rules where relevant
Application and change security Review and test relevant changes, address vulnerabilities according to risk, restrict production changes and secret access, and assess the continuing effectiveness of access and isolation controls
Availability and recovery Maintain recovery arrangements proportionate to the Service and test restoration as appropriate; apply the agreed backup lifecycle and restrict restored copies until deletion instructions and expiry have been reapplied
Retention and rights Maintain data-class and retention information sufficient to act on Customer Instructions; restrict expired content from ordinary use and carry out deletion, return, and rights assistance, including relevant Subprocessor copies
Durable processing, if turned on Encrypt short-lived execution and replay content; bind access to the authorized customer/user context; enforce the Schedule 1 expiry windows and include these copies in applicable export and deletion handling
Supplier and infrastructure controls Assess recipients for the processing they perform, contract for appropriate safeguards, and restrict processing to the agreed entities and locations. Use hosting providers’ physical and infrastructure protections within that defined scope
Incident management Maintain procedures for detection, escalation, containment, investigation, notice without undue delay, and corrective action under Section 2.4

For Subprocessors, Provider will require measures appropriate to their function and the same applicable protection obligations.

This schedule sets the standard deployment for Helmstead’s standard plans. A product or vendor brand alone does not identify the contracting legal entity. Nothing in this schedule authorizes an unlisted recipient, location, purpose, or retention period.

Item Standard selection
Schedule version This DPA version, accepted with Customer’s plan
Enabled features and connectors The features and connectors Customer’s users turn on in the workspace, within the permissions they grant. Every standard plan includes every feature
Durable workbook processing Not turned on. Provider will give notice under Section 2.3 before turning it on for Customer’s workspace
AI service The AWS Amazon Bedrock or Microsoft Azure OpenAI service configured for Customer’s workspace, as listed with its function and regions in the Subprocessors document. Its legal entity is available on request. Provider will tell Customer which one its workspace uses on request
Provider processing locations United States, including remote support and administration
Hosting, storage, logging, and backup locations United States. The Subprocessors document lists each recipient’s processing location; its remote-access, logging, and backup locations are available on request
Scope restrictions Schedule 1 scope
Intended special-category or criminal-offense data Not instructed
Support/security/audit retention Support records: while needed, and no longer than 2 years after the request closes. Security logs: up to 1 year. Provider keeps the audit log only as long as needed for security and to establish or defend legal claims. It holds references and hashes only, never Customer Personal Data content. References that can be linked to a person remain Personal Data, and Section 2.6 applies to them
Provider-side AI retention and review As stated for each AI service in the Subprocessors document; no training, and no human review except as Section 2.2 allows
Return choice at termination Return followed by deletion. Customer may instead instruct deletion without return
Return format and arrangements Export through the Service’s export functions, or on request to privacy@helmstead.co, in a commonly used format, for 30 days after Customer’s workspace closes
Maximum residual backup period 30 calendar days after deletion from active systems, for all relevant Provider and Subprocessor backups
Additional security/transfer measures None beyond Schedule 2. Customer Personal Data is processed and stored in the United States; transfers from the EU and UK rely on Schedule 4

The backup period is a finite maximum. It cannot displace an earlier mandatory deadline, the source-specific stop-processing and deletion duties in Section 2.2, or the transfer instruments. A backup window or provider retention setting cannot postpone the immediate QuickBooks stop. Any storage lock or other restriction affecting deletion must be reconciled with those duties; it is not an automatic retention authorization.

The Subprocessor List is our Subprocessors document, in the version in effect, as updated under Section 2.3. It lists each recipient that processes Customer Personal Data for Provider, with what it does, the kind of data it handles, and its processing location. Each recipient’s data processing agreement, legal entity, and remote-access, logging, and backup locations are available on request. Under the general authorization selected in Schedule 4, it also supplies the subprocessor information referenced by the UK Addendum.

The Subprocessors document is the binding authorization, subject to Section 2.2’s source-specific limits, including the QuickBooks permitted-use and written-agreement requirements. For onward contractual safeguards, Provider must identify the correct exporter/importer relationship; the customer-to-Provider clauses alone do not execute agreements with downstream recipients.

Own-purpose analytics and advertising. PostHog website/application analytics and Google Ads, Meta Ads, and LinkedIn Ads used for Provider’s own marketing are described in the Privacy policy. They are not authorized content Subprocessors by this DPA. Provider must not relabel Customer Content as telemetry or contact data to bypass the restrictions above. Any separate instructed use involving Customer Personal Data requires the appropriate recipient entry and lawful terms.

Customer-chosen integrations. Customer’s Microsoft/Google sign-in, Google Workspace, Microsoft 365, Sage, QuickBooks Online, Xero (where offered and enabled), and other independently selected connected services may operate under Customer’s own relationship with their providers. Connecting them doesn’t, by itself, make them Provider’s Subprocessors. Sign-in permission is separate from mailbox or file permission. Provider’s handling of information copied from those services remains subject to this DPA and its source-specific restrictions, including the QuickBooks Online-source information limits. If Provider separately engages the same company to process that information on its behalf, that distinct role must be listed as a Subprocessor.

For transfers to which they are legally applicable, the parties incorporate the unaltered applicable modules of the EU SCCs in Commission Implementing Decision (EU) 2021/914 of 4 June 2021, available in the official decision, through Bonterms Exhibit A. This schedule supplies only the permitted selections and annex information. It doesn’t rewrite the SCCs.

Provision Selection
Parties Customer is exporter; Suverenum Inc. is importer, as identified in Schedule 1.A
Module 2 Applies to controller-to-processor transfers where Customer is Controller and Provider is Processor
Module 3 Applies to processor-to-subprocessor transfers where Customer is Processor for a third-party Controller and Provider is its subprocessor
Mixed roles Apply the relevant module separately to the datasets identified in Schedule 1; one module does not displace the other for a different processing role
Clause 7 Optional docking clause does not apply
Clause 9(a) Option 2, general written authorization; 30 calendar days’ advance notice and the Section 2.3 objection protections apply
Clause 11(a) Optional independent dispute-resolution language does not apply; mandatory complaint and redress rights remain
Clause 13 / Annex I.C Competent authority determined under Schedule 1.D
Clause 17 Option 1; Irish law, as selected in Section 1
Clause 18(b) Courts of Ireland, as selected in Section 1; Clause 18(c) data-subject rights remain
Annex I.A Section 1, Schedule 1.A, and Customer’s acceptance of this DPA
Annex I.B Schedule 1.B–C and the processing, location, and retention details in Schedule 3
Annex I.C Schedule 1.D
Annex II Schedule 2
Subprocessor information The Subprocessors document under Schedule 3.B

If the 2021/914 SCCs are not legally available for a particular transfer, the parties must agree another applicable safeguard before that transfer. The Article 28 obligations in this DPA remain in place. Swiss-specific modifications in Bonterms Exhibit A, Section 2 apply only to covered Swiss transfers.

For covered UK Restricted Transfers, the parties enter into the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B.1.0, issued by the ICO and laid before Parliament on February 2, 2022, effective March 21, 2022, with revisions only as provided by its mandatory terms. The official UK Addendum is incorporated through Bonterms Exhibit A and the completed tables below.

UK table Completed selection and information
Table 1: Start date DPA Effective Date in Section 1
Table 1: Exporter Customer’s full legal name, address, registration details where applicable, and key contact in Section 1 and Schedule 1.A
Table 1: Importer Suverenum Inc.; Helmstead is its product name; a Delaware corporation; 2261 Market Street STE 77991, San Francisco, CA, 94114 US; key contact: privacy@helmstead.co
Table 1: Signatures Customer’s acceptance of this DPA also signs the UK Addendum as of the DPA Effective Date
Table 2: Selected SCCs, modules, and clauses The 2021/914 SCCs with Module 2 and/or Module 3 for the respective role, completed with the selections in Schedule 4.A, the annexes identified there, and only supplementary terms compatible with the mandatory clauses
Table 3: Annex 1A, parties Section 1, Schedule 1.A, and Customer’s acceptance
Table 3: Annex 1B, transfer description Schedule 1.B–C and Schedule 3
Table 3: Annex II, security measures Schedule 2
Table 3: Annex III, subprocessors The Subprocessors document under Schedule 3.B, updated under Section 2.3
Table 4: Ending when the approved Addendum changes Both Importer and Exporter may end the Addendum in accordance with Section 19 of its mandatory clauses

The parties expressly incorporate the following without alteration:

Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.

The UK Addendum makes its required changes to the SCCs for UK transfers, including applicable law, courts, regulator, and protected rights. It prevails over any incompatible Irish-law selection or other commercial term for that purpose. This DPA selects the UK Addendum; it does not also execute a separate UK International Data Transfer Agreement (IDTA).

Customer agrees to this DPA, including the incorporated Bonterms v2.0 terms as modified, the schedules, and the applicable EU SCCs and UK Addendum, by accepting it online at checkout. The person who accepts for Customer confirms they’re authorized to do so. Provider is bound from the DPA Effective Date.

A Customer with a Customer Agreement may instead sign this DPA, or agree to a negotiated DPA that replaces it.

Foundation: Bonterms Data Protection Addendum Version 2.0 (Signable Version), © 2026 Bonterms, Inc., available at the source document, licensed under Creative Commons Attribution 4.0 International (CC BY 4.0).

Helmstead modifications: Suverenum Inc. added the DPA Details and processing, security, deployment, recipient, and transfer schedules, completed with default values for standard plans; narrowed instructions, content reuse, and locations; replaced the fixed 48-hour incident deadline; strengthened return/deletion, backup, audit, US privacy, and precedence provisions; and added Google Limited Use, Microsoft API-source, QuickBooks Online, and conditional Xero data-use restrictions, including QuickBooks role and customer-isolation disclosures, source-specific stop-processing and deletion priority, and protection of derivatives. The official EU SCCs and UK mandatory clauses are incorporated as their own legal instruments, not rewritten or relicensed here.

Bonterms does not endorse these modifications. Bonterms does not provide legal advice, guarantee the enforceability or effect of its terms, or accept liability relating to their use.