Data Processing Addendum

1. About this Addendum

This Data Processing Addendum (the “DPA”) forms part of the Invoicevisor Terms of Service (the “Terms”) between Codevisor LLC (“Codevisor”, “we”, “us”, “our”) and the business that holds an Invoicevisor Account (“Customer”, “you”, “your”).

It sets out how we process personal information contained in Your Data on your behalf, and the commitments we make as your service provider and processor. It applies automatically to every Account for as long as we process Customer Personal Information, and needs no separate signature.

Capitalised terms not defined here have the meanings given in the Terms.

2. Definitions

“Customer Personal Information” — personal information contained in Your Data that we process on your behalf in providing the Service. It includes information about Your Clients and their contacts, and any other individuals named in your records, documents, receipts, attachments, and notes.
“Data Protection Laws” — the privacy and data-protection laws of the United States and Canada that apply to the processing of Customer Personal Information under this DPA, including, where applicable, the California Consumer Privacy Act as amended (the “CCPA”), other US state comprehensive consumer privacy laws such as the Texas Data Privacy and Security Act, the Personal Information Protection and Electronic Documents Act (“PIPEDA”), and provincial private-sector privacy laws, including Quebec’s Act respecting the protection of personal information in the private sector.
“Security Incident” — a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Information while in our or our Subprocessors’ control.
“Subprocessor” — a third party we engage to process Customer Personal Information on our behalf.

3. Scope and roles

You decide; we process. For Customer Personal Information, you determine the purposes and means of processing and we process it on your behalf. Under the Data Protection Laws, you act as the business, controller, or organisation in control of the information, and we act as your service provider, processor, or organisation to which its processing is entrusted.

Information this DPA does not cover. Information about you and your Users as our account holders — names, login credentials, security settings, subscription and billing records, support correspondence, and logs of use of the Service — is processed by us for our own purposes, under our Privacy Policy. Stripe processes payment information as an independent controller under its own terms, and is not our Subprocessor.

Details of processing. The subject matter, nature, purpose, and duration of the processing, and the categories of information and individuals involved, are described in Annex 1.

4. Our obligations

4.1 Instructions. We process Customer Personal Information only to provide the Service to you, and otherwise only on your documented instructions. The Terms, this DPA, and your use and configuration of the Service — for example, sending a document to a recipient you choose — are your complete instructions. If we believe an instruction violates the Data Protection Laws, we will tell you, and we may decline to follow it. We may also process Customer Personal Information where the law requires us to; where lawful, we will tell you first.

4.2 What we will not do. We will not:

sell Customer Personal Information, or share it for cross-context behavioural advertising or targeted advertising;
retain, use, or disclose it for any purpose other than the business purposes set out in this DPA, or outside our direct business relationship with you;
combine it with personal information we receive from or on behalf of anyone else, or collect ourselves, except as the Data Protection Laws permit for a service provider;
use it to build profiles of, or market to, any individual;
use it to create aggregated or de-identified statistics, or for analytics of any kind; or
use it to train artificial intelligence or machine learning models, ours or anyone else’s.

4.3 Compliance. We will comply with the obligations that the Data Protection Laws place on us as a service provider or processor, and provide Customer Personal Information the same level of privacy protection that those laws require of you. We will tell you if we determine that we can no longer meet those obligations. If we process Customer Personal Information in a way this DPA does not permit, you may take reasonable and appropriate steps to stop and remediate it, including by instructing us to stop.

4.4 Confidentiality. Everyone we authorise to process Customer Personal Information is bound by a duty of confidentiality, and has access only to the extent their role requires — for example, to operate the Service or to resolve a support request you raise.

4.5 Security. We maintain the administrative, technical, and physical safeguards described in Annex 2, appropriate to the nature of the information and the risks of processing it. We may update these safeguards over time, provided the overall level of protection is not reduced.

5. Subprocessors

5.1 Authorisation. You authorise us to engage the Subprocessors listed in Annex 3, and new Subprocessors in accordance with this section.

5.2 Our responsibilities. Before a Subprocessor processes Customer Personal Information, we bind it by written contract to data-protection obligations that protect the information at least as well as this DPA. We remain responsible to you for each Subprocessor’s performance of those obligations.

5.3 Changes. We will give you at least 30 days’ notice before a new Subprocessor begins processing Customer Personal Information, by email to the Account Owner and by updating Annex 3.

5.4 Objection. You may object to a new Subprocessor on reasonable data-protection grounds by writing to privacy@invoicevisor.com within the notice period. We will discuss the concern with you in good faith. If we cannot resolve it, you may terminate the affected Service by written notice before the change takes effect, and we will refund any prepaid fees for the unused part of the Billing Period.

6. Assistance

6.1 Individuals’ requests. If an individual asks us to access, correct, or delete Customer Personal Information, or exercises another right under the Data Protection Laws, we will not respond on your behalf except to refer them to you, where we can identify you. The Service lets you access, correct, export, and delete the records you hold. Where you cannot do something through the Service, we will provide reasonable assistance on request.

6.2 Assessments and regulators. Taking into account the nature of the processing and the information available to us, we will provide reasonable information and assistance for your privacy impact assessments — including assessments required before personal information is communicated outside Quebec — and for your dealings with privacy regulators about our processing.

6.3 Legal requests. If a government authority or other third party asks us to disclose Customer Personal Information, we will refer it to you where possible. If we are legally compelled to disclose, we will notify you first where lawful, and disclose only what is legally required.

7. Security Incidents

7.1 Notice. We will notify you without undue delay, and in any event within 72 hours, after we confirm a Security Incident affecting Customer Personal Information. We will notify the Account Owner by email and, where appropriate, in the Service.

7.2 What we tell you. Our notice will describe, to the extent then known, the nature of the incident, the categories and approximate volume of information and individuals affected, the likely consequences, and the measures we have taken or propose to take. We will provide further information as it becomes available.

7.3 Response. We will take reasonable steps to contain, investigate, and remediate the incident, and reasonably cooperate with you so that you can meet your own obligations to notify affected individuals or regulators, such as under US state breach-notification laws or where an incident presents a real risk of significant harm under Canadian law. We will keep a record of each Security Incident.

7.4 No admission. Our notice of, or response to, a Security Incident is not an acknowledgement of fault or liability.

8. Return and deletion

8.1 During the subscription. You can export Your Data at any time using the Service’s export tools, and delete records within the Service.

8.2 After the Account ends. When your Account is closed or deactivated, we keep Your Data for 90 days, during which you can reactivate and recover it, and then delete it from our active systems. Residual copies may remain in encrypted database backups for up to 14 days, and in previous versions of uploaded files for up to 30 days, until they expire. We do not restore deleted data from backups except to recover the Service from a failure.

8.3 Retention required by law. If the law requires us to keep any Customer Personal Information longer, this DPA continues to protect it, and we will process it only for the purpose the law requires.

8.4 Confirmation. On request, we will confirm in writing that Customer Personal Information has been deleted.

9. Information and audits

9.1 Information. On written request, no more than once in any twelve-month period, we will provide information reasonably necessary to demonstrate our compliance with this DPA, such as answers to a reasonable security questionnaire and a description of our safeguards.

9.2 Assessments. Where the Data Protection Laws give you the right to assess our processing and the information in 9.1 does not reasonably satisfy that right, you may carry out an assessment, or have a qualified, independent assessor bound by confidentiality do so. You must give at least 30 days’ written notice, agree the scope with us in advance, conduct it during business hours without unreasonably disrupting our operations, and bear its costs. You may assess no more than once in any twelve-month period, unless a regulator requires it or following a Security Incident. In place of an assessment, we may provide a report from an independent assessor covering the same matters.

9.3 Confidentiality. All information we provide under this section is our confidential information under the Terms.

10. Where Customer Personal Information is processed

We store and process Customer Personal Information in the United States, in the AWS us-east-1 region. Some Subprocessors may process limited information in other countries where they operate, as listed in Annex 3.

Information processed in the United States is subject to United States law and may be accessible to United States courts, law enforcement, and national-security authorities under lawful process. You are responsible for informing Your Clients, where required, that their information may be stored and processed outside Canada. Under this DPA, we provide a level of protection comparable to that which the information would receive under the Canadian Data Protection Laws.

11. Your responsibilities

You are responsible for:

having a lawful basis, and any notice or consent the Data Protection Laws require, for collecting Customer Personal Information and having us process it;
the accuracy and lawfulness of Your Data, and for not uploading sensitive information that the Service does not need;
the instructions you give us through your use of the Service; and
the security of your Account, including your Users’ credentials and enabling multi-factor authentication.

12. Liability, duration, and precedence

12.1 Liability. Each party’s liability arising out of or relating to this DPA is subject to the limitations and exclusions of liability in Section 22 of the Terms.

12.2 Duration. This DPA takes effect when you accept the Terms, and continues for as long as we process Customer Personal Information, including after the Terms end.

12.3 Precedence. If this DPA conflicts with the Terms on the processing of Customer Personal Information, this DPA prevails. Otherwise, the Terms apply.

12.4 Changes. We may update this DPA to reflect changes in the Data Protection Laws or in our Service. We will give you at least 30 days’ notice of any material change, and we will not reduce the overall level of protection it gives Customer Personal Information.

12.5 Governing law. This DPA is governed by the law and dispute-resolution terms of Section 24 of the Terms, except where the Data Protection Laws require otherwise.

Annex 1 — Details of processing


Subject matter	Providing the Invoicevisor Service to the Customer
Duration	The term of the Customer’s subscription, plus the deletion periods in Section 8
Nature of processing	Hosting, storage, retrieval, display, and transmission of records; generating documents and PDFs; sending documents, reminders, and notifications the Customer instructs; extracting text from receipts the Customer uploads; backup and recovery; support the Customer requests
Purpose (business purpose)	To provide, secure, and support the Service for the Customer, as instructed by the Customer
Categories of individuals	Your Clients and their contacts; recipients of documents the Customer sends; other individuals named in the Customer’s records, receipts, attachments, notes, and appointments
Categories of information	Names; email addresses; phone numbers; billing and shipping addresses; document contents, including line items, amounts, taxes, and terms; payment records; appointment details; notes; receipt images and extracted text; attachments; and anything else the Customer chooses to enter
Sensitive information	Not required by the Service. The Customer may choose to enter tax identifiers or upload documents that contain sensitive information; it is protected under Annex 2 like all Customer Personal Information

Annex 2 — Security measures

Encryption

Encryption in transit using TLS on all connections; the file store refuses unencrypted access.
Encryption at rest for the database, backups, and file storage.
Encryption of sensitive stored secrets, such as authenticator-app seeds.

Access control

Logical separation of each Account’s data, enforced in the data-access layer, so that one Account cannot read another’s records.
Role-based access control within each Account.
Multi-factor authentication for Users, using authenticator apps, SMS, email codes, or passkeys; passwords stored only as salted cryptographic hashes.
Administrative access for our staff, granted on a least-privilege basis and protected by multi-factor authentication.

Monitoring and abuse prevention

Audit logging of significant actions in each Account, and of our staff’s administrative actions.
Rate limiting and abuse detection on authentication and other sensitive endpoints.
A web application firewall, bot protection on sign-up, and blocking of anonymising networks on sign-up and other email-sending endpoints.

Resilience

Automated, encrypted database backups, retained for 14 days.
Versioning of stored files, so that replaced or deleted files can be recovered for 30 days.
Deletion protection on the production database.

Operations

Regular patching and dependency updates.
Infrastructure defined as code, with changes made through reviewed pull requests.
Personnel with access to Customer Personal Information are bound by confidentiality.

Annex 3 — Subprocessors

Subprocessor	Service	Customer Personal Information involved	Location
Amazon Web Services, Inc.	Hosting, database, file storage, and backups; sending email (Amazon SES); receipt text extraction (Amazon Textract); push-notification routing (Amazon SNS); web application firewall	All Customer Personal Information	United States (us-east-1)
Apple Inc.	Apple Push Notification service, for Users who enable notifications on iOS	Notification content, which may include a document number, an amount, a client’s name, or the reason a client gave for declining an estimate	United States / global
Google LLC	Firebase Cloud Messaging, for Users who enable notifications on Android	Notification content, which may include a document number, an amount, a client’s name, or the reason a client gave for declining an estimate	United States / global

We will update this list in accordance with Section 5.