Data Processing Agreement | The Financial Smith

Last updated: October 1, 2026

This agreement applies when an accounting or bookkeeping firm ("the Firm") licenses Voice Confirmations from The Financial Smith LLC ("we", "us"). It forms part of the Voice Confirmations Terms of Service. Where they conflict, this agreement governs the handling of personal data.

1. Roles The Firm is the controller and decides what is processed and why. We are the processor and act only on the Firm's documented instructions — which include these terms, the settings the Firm chooses in the application, and anything else it tells us in writing. If we believe an instruction breaks the law, we will say so rather than carry it out.

2. What we process, and for whom

Whose data: the Firm's clients, and the people at those clients who receive the weekly email.
What: names and email addresses; transactions read from the client's ledger (date, payee, amount, account, category, program); the client's reply, any voice recording and its transcript; and the record of what the Firm approved.
Why: to ask a client to confirm their own transactions, to read the answer, to present it to the Firm for decision, and to record the Firm's decision in the Firm's ledger. Nothing else.
How long: as set out in section 7.

We do not process special categories of data, and ask that none be sent.

3. Our commitments We will process personal data only for the purposes above; keep it confidential and limit access to people who need it; not sell or share it; and not use it to train artificial intelligence models — we opt out of model training on every request to our speech provider, and our language model provider does not train on data submitted through its API.

4. Security We maintain measures appropriate to the risk, currently including:

Encryption in transit (TLS, HSTS) and at rest.
Sign-in by single-use emailed link expiring in fifteen minutes. No passwords are stored, only one-way hashes of session identifiers.
Separation between firms enforced on every query, verified by automated tests that run on every change and attempt to reach another firm's data.
Read-only access to ledger systems. We cannot write to the Firm's ledger.
Administrative access to a Firm's data restricted to named individuals and recorded in an access log visible in the application.
Software built without third-party runtime dependencies, reducing the supply-chain surface.

We may change these measures, but not in a way that materially reduces security.

5. Sub-processors The Firm authorises the following, all located in the United States:

Supabase Inc. — database and file storage
Render Services, Inc. — application hosting
Wildbit / Postmark — sending and receiving email
Deepgram, Inc. — transcription of voice recordings
OpenPhone Technologies, Inc. (Quo) — text messages to recipients who have opted in
Anthropic PBC — reading replies into proposed changes
Netlify, Inc. — serving the client-facing review page

Each is bound by terms no less protective than these. We will give the Firm 30 days' notice before adding or replacing a sub-processor; the Firm may object on reasonable data-protection grounds, and if we cannot resolve it, the Firm may terminate without penalty for the affected part of the Service.

6. International transfers Personal data is processed in the United States and we do not transfer it elsewhere. If that changes, we will implement an appropriate transfer mechanism first and tell the Firm.

7. Retention and deletion

Voice recordings: deleted 12 months after receipt. The transcript, and the sentence quoted as the reason for each approved change, are kept. Audio is the most sensitive thing we hold and the least useful once it has been transcribed and acted on.
Transactions, replies, transcripts and approval records: kept for as long as the Firm is a customer. This is the data the Firm needs to answer its own clients' questions about earlier periods, so deleting it on a timer would work against the purpose it was collected for.
On termination: we stop processing, provide the Firm an export, and delete the remainder within 60 days, except what law requires us to keep — which stays protected by this agreement for as long as we hold it. The Firm keeps the export as its own professional record.
The Firm may instruct a shorter period for any category, in writing, and we will apply it.

We hold data read from a ledger only while it serves the purpose the Firm asked for. When the Firm stops being a customer that purpose ends, which is why deletion is tied to termination rather than left open-ended.

8. Assisting the Firm We will help the Firm, at no charge and within a reasonable time, to: respond to a request from one of its clients to access, correct, delete or receive a copy of personal data; carry out a data protection assessment; and answer a regulator. If a client contacts us directly, we will not act on it ourselves — we will refer them to the Firm.

9. Personal data breach We will notify the Firm without undue delay and in any case within 72 hours of becoming aware of a breach affecting its data, describing what happened, which data and roughly how many people are affected, what we are doing, and what we suggest the Firm does. We will cooperate with the Firm's own notification obligations.

10. Audit Once a year, or after a breach affecting its data, the Firm may ask for information reasonably necessary to confirm we are meeting this agreement, and we will answer a security questionnaire. On-site audits are by agreement, at the Firm's cost, at a time that does not disrupt the Service.

11. Liability The limits in the Terms of Service apply to this agreement.

12. Contact Questions, requests and breach notices: hello@thefinancialsmith.com · The Financial Smith LLC, Atlanta, GA 30314