Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the agreement between you (“Customer”) and Kipper Inc. (“Kipper,” “we,” “us,” or “our”) governing your access to and use of the Kipper conversational finance intelligence platform (the “Service”) (the “Agreement”).

This DPA reflects the parties’ agreement on the processing of Personal Data in connection with the Service. Where this DPA conflicts with the Agreement with respect to the processing of Personal Data, this DPA controls.

Table of Contents

1. Definitions
2. Roles of the Parties
3. Scope and Purpose of Processing
4. Customer Obligations
5. Confidentiality
6. Security Measures
7. Use of Artificial Intelligence; No Model Training
8. Sub-processors
9. Data Subject Rights
10. Personal Data Breach
11. Return and Deletion of Personal Data
12. Audits
13. International Transfers
14. Liability
15. Term

• Annex A — Details of Processing
• Annex B — Sub-processors
• Annex C — Technical and Organizational Measures

1. Definitions

• “Personal Data” means any information relating to an identified or identifiable natural person that Kipper processes on Customer’s behalf under the Agreement.
• “Customer Data” means data Customer’s authorized users submit to, or that the Service retrieves from Customer’s connected systems, in the course of using the Service.
• “Processing” means any operation performed on Personal Data, whether automated or not (collection, storage, retrieval, use, disclosure, deletion, etc.).
• “Controller,” “Processor,” “Data Subject,” and “Supervisory Authority” have the meanings given under applicable Data Protection Laws.
• “Data Protection Laws” means all laws applicable to the processing of Personal Data under the Agreement, including, where applicable, the California Consumer Privacy Act as amended (“CCPA/CPRA”) and other U.S. state privacy laws, and — to the extent Customer is subject to them — the EU and UK General Data Protection Regulations (“GDPR”).
• “Sub-processor” means any third party engaged by Kipper to process Personal Data in connection with the Service.

2. Roles of the Parties

For Personal Data processed under the Agreement, Customer is the Controller (or processor acting on behalf of a third-party controller) and Kipper is the Processor (or sub-processor). For purposes of the CCPA/CPRA, Kipper acts as a Service Provider and processes Personal Data solely to perform the Service for Customer.

3. Scope and Purpose of Processing

Kipper processes Personal Data only:

• to provide, secure, support, maintain, and improve the Service;
• in accordance with Customer’s documented instructions, including those set out in the Agreement and this DPA; and
• as required by applicable law (in which case Kipper will, where legally permitted, inform Customer of the requirement before processing).

The Service queries Customer’s connected systems to generate responses to natural-language queries. Kipper does not write to, modify, or delete data in Customer’s connected systems. The level of access required varies by integration; some connected systems require administrative permissions to read the data needed to provide the Service. The subject matter, nature, categories of Data Subjects, and types of Personal Data are described in Annex A.

4. Customer Obligations

Customer is responsible for the accuracy and legality of Customer Data and for having an appropriate legal basis to provide it to Kipper for processing. Customer is responsible for configuring data-access controls for its authorized users within the Service.

5. Confidentiality

Kipper ensures that personnel authorized to process Personal Data are bound by appropriate obligations of confidentiality and access Personal Data only on a need-to-know basis.

6. Security Measures

Kipper maintains technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. A summary appears in Annex C.

7. Use of Artificial Intelligence; No Model Training

The Service uses large language models (“LLMs”) to interpret natural-language queries and generate responses. LLM inference runs through AWS-managed Amazon Bedrock, within Kipper’s own AWS account and infrastructure — not a separate third-party AI vendor. Under AWS’s published Amazon Bedrock documentation, AWS states that Bedrock:

• does not store customer input data or model output data;
• does not share that data with the third-party model providers whose models it hosts — each model provider operates within a dedicated model deployment account that the provider cannot access, and model-invocation traffic stays within the AWS network; and
• does not use that data to train any models.

Accordingly:

• No model training. Unless otherwise agreed in writing, Customer Data and Personal Data are not used to train, fine-tune, or otherwise develop or improve any third-party foundation models or generalized machine-learning models.
• Purpose limitation. Personal Data sent for LLM inference is processed to generate the response to the originating query. Amazon Bedrock operates an automated abuse-detection mechanism, with no human access to input or output data.

No separate model-provider sub-processor receives Customer Data; all LLM inference occurs within the AWS infrastructure described in Annex B.

8. Sub-processors

Customer provides general written authorization for Kipper to engage Sub-processors to process Personal Data. Kipper engages each Sub-processor under written terms requiring data-protection obligations materially consistent with this DPA or as required by applicable law.

A current list of Sub-processors is maintained at kipper.com/subprocessors, which is incorporated into this DPA by reference (see Annex B). Customer’s continued use of the Service after a change is posted constitutes acceptance of the updated list.

9. Data Subject Rights

Taking into account the nature of the processing, Kipper will provide reasonable assistance to Customer, through appropriate technical and organizational measures, to respond to requests from Data Subjects to exercise their rights under Data Protection Laws. If Kipper receives such a request directly, it will, where legally permitted, direct the Data Subject to Customer.

10. Personal Data Breach

Kipper will notify Customer of a Personal Data breach affecting Customer’s Personal Data in accordance with applicable law, and will provide information reasonably available to it to assist Customer with Customer’s own obligations.

11. Return and Deletion of Personal Data

Upon termination or expiry of the Agreement (including after a trial or evaluation ends), Kipper will delete or return Personal Data in accordance with the Agreement, except where retention is required by applicable law. Kipper stores a working copy of Customer’s financial data to provide the Service; this copy is not Customer’s authoritative books and records, which remain in Customer’s connected systems, and will be deleted within a reasonable period following termination, subject to applicable legal retention requirements.

12. Audits

Kipper will make available information reasonably necessary to demonstrate compliance with its obligations under this DPA, subject to reasonable confidentiality, security, scheduling, and non-disruption requirements.

13. International Transfers

Kipper processes Personal Data in the United States. Customer is responsible for determining whether its use of the Service involves a transfer of Personal Data subject to applicable data protection law and for ensuring an appropriate legal basis exists for any such transfer. Where Customer determines that a transfer mechanism is required, Kipper will cooperate with Customer to put in place an appropriate mechanism. Kipper’s total liability arising from any such transfer remains subject to the limitations of liability in the Agreement.

14. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions of liability set out in the Agreement.

15. Term

This DPA takes effect when Customer accepts the Agreement — including through any free trial, pilot, beta, evaluation, or other unpaid access to the Service — and remains in force for as long as Kipper processes Personal Data on Customer’s behalf.

---

Annex A — Details of Processing

Subject matter	Provision of the Kipper conversational finance intelligence Service.
Nature of processing	Retrieval and storage of data from Customer’s connected systems; natural-language query processing; generation and delivery of responses through messaging and chat interfaces, such as Slack, Microsoft Teams, or SMS. Kipper does not write back to Customer’s connected systems.
Purpose	Enabling authorized users to query their data in plain language.
Categories of Data Subjects	Customer’s authorized users; and individuals referenced within Customer’s data (e.g., customer/vendor contacts, employees named on transactions).
Categories of Personal Data	Names, business contact details, and any personal data contained in records Customer chooses to query (e.g., names on invoices, bills, or payments).
Special-category data	The Service is not designed to process GDPR special-category data, and Customer must not intentionally use it for that purpose.

Annex B — Sub-processors

The current list of Sub-processors — each Sub-processor’s identity, purpose, the Personal Data it processes, and its primary processing location — is published and maintained at kipper.com/subprocessors, which is incorporated into this DPA by reference and is the source of truth. That page also identifies the customer-directed integrations that are not Kipper Sub-processors.

The list is reproduced there rather than here so that a single published page governs; it is not duplicated in this DPA, and no version of the list appearing elsewhere supersedes that page.

Annex C — Technical and Organizational Measures

• Read-only behavior. Kipper does not write to, modify, or delete data in Customer’s connected systems. The authorization scopes required vary by connected system; some systems require administrative permissions to read the data needed to provide the Service.
• Segregation. Customer Data is logically separated within Kipper’s environment using application-level access controls and other safeguards.
• Encryption. Within Kipper-controlled infrastructure, Personal Data is encrypted in transit and at rest where practicable. Personal Data delivered through third-party channels (such as SMS, Slack, or Microsoft Teams) is subject to those providers’ own security and transport protections, which Kipper does not control.
• Access control. Access controls designed to limit personnel access to those with a business need.
• Audit logging. The platform may log access and query activity for security and audit purposes.
• Session recording. Kipper may record and analyze authorized users’ session activity within the platform for security, support, and product-improvement purposes. All text input fields are configured to be masked in these recordings. See our Terms of Service for further detail.
• AI processing. LLM inference runs through AWS-managed Amazon Bedrock, within Kipper’s own AWS account; data is not used for model training (see §7).

---

Questions about this DPA: legal@kipper.com. Related: Privacy Policy · Sub-processors · Terms of Service.