Data processing agreement

These are the terms between a firm, which decides what happens to its client’s statement, and Zava Solutions LLC, a Wyoming limited liability company, whose registered address is 30 N Gould St Ste N, Sheridan, WY 82801, United States, which reads it. They add to the terms and do not replace them: where the two disagree, the terms prevail.

A firm that the FTC Safeguards Rule covers, such as a firm in the business of completing income tax returns (16 CFR 314.2(h)(2)(viii)), has to bind its service providers by contract to maintain safeguards for customer information (16 CFR 314.4(f)(2)). These terms are the contract Evidilo offers for that purpose. Whether they, and the safeguards the security page lists, meet a firm’s own obligations is for the firm to decide, and we make no representation that they do.

Evidilo is offered only to firms established in the United States, so these terms are written for the law of the United States. They are not the processor terms of Article 28 of the GDPR or of the UK GDPR, and a firm that needs those may not use Evidilo.

A firm’s owner accepts these terms in Settings, and the acceptance is recorded with the date, the version of these terms and the person who made it. Until a firm accepts them, they describe what the service does, and the terms bind both sides; the security page states the same.

The subject matter, the duration, the nature and the purpose are these.

• Subject matter. Reading a bank statement into a file QuickBooks or Xero imports, and checking the rows against the balances the bank printed.
• Duration. For as long as the firm holds an account. The uploaded files and the records beside them stay after that under the licence in the terms, as the end of the service sets out, and the windows the data is held under are on the security page.
• Nature. Reading the pages of a statement, holding the rows read from it, applying the corrections a person makes, producing the export file, keeping each uploaded file with a record of what was read from it, the corrections and the rows downloaded, and, for a file cleared for training, copying it and its record to a computer of ours to train and test the reading.
• Purpose. Producing the import file the firm asked for, and, only for a statement the firm cleared for training under the licence the terms give us, training and improving how Evidilo reads and converts statements.

We use and disclose a statement the firm has not cleared for training only to provide Evidilo to the firm, to protect against a claim about the service, and where a law, a court order or a public authority requires it. We use it for nothing else, and keep it as the terms say.

We process the firm’s data on its instructions: this page, the terms and what the firm does in the app. Where a law we are subject to requires something else, we do that and tell the firm, unless the law forbids the telling.

Our own people who can reach the firm’s data are bound to keep it confidential, and that obligation survives the end of the service. Each sub-processor below holds the data under its own terms with us, and the table says what each one receives. Which of a firm’s own people can reach what is decided by their role, one of owner, admin, member or viewer.

What protects the firm’s data today:

• Encryption. A statement file and its training record are written with AES-256-GCM under a key the application derives and holds, and every connection is served over TLS through Cloudflare.
• Access. The stored file sits in an object store with no public address and no listing, and a file is read back only through a link minted for five minutes. Sign-in is by a link, a passkey or a code from an authenticator app.
• Training copies. A file cleared for training is copied only to a computer of ours whose disk is encrypted, into a folder only our own user account opens, and no AI assistant is given a copy.

Three things are partial, and we name them rather than imply them. The database is copied once a day and six days of copies are kept, so it can be restored to the state of the last copy, but there is no point-in-time restore; no penetration test has been run; and database records are not encrypted by the application.

We keep at least the safeguards the security page lists in place while we hold the firm’s data. That page is where the list is kept, item by item, with its state today. Where this section and that page disagree, that page is the record and this one is wrong.

The firm authorises the sub-processors below. We may add or replace one: the list here and on the security page carries its date, and a firm that does not accept a change can stop using Evidilo. Each sub-processor works under its own terms with us.

This authorisation takes effect when a firm’s owner accepts the terms in Settings, which records the date, the version and the person who accepted them.

The terms give Zava Solutions LLC a perpetual licence to every file a firm uploads, to what Evidilo read from it, to the corrections made to its rows and to the rows downloaded: to provide Evidilo and keep them, and, for a file cleared for training, to train and improve how Evidilo reads and converts statements. A file is cleared only if it was uploaded under the terms of October 20, 2026 or later while the firm’s owner had turned on “Our clients agreed to training” in Settings. We use them for nothing else, never sell them, and share them only with the sub-processors above and where a law, a court order or a public authority requires it.

The promise the firm gives by turning that setting on, that its clients agreed to training, is in the terms. The licence survives the end of these terms.

The firm decides what it uploads and why, gives the instructions, and holds the authorisation for every client’s statement it uploads, and, while its owner has training turned on, the client’s consent to training, as the terms set out.

A firm tells us when one of its clients makes a request about their data, so we can help the firm answer it. The firm answers its own client and its own regulator.

Where someone asks a firm for a copy, a correction or the deletion of their data, we pass the request to the firm without delay, answer the firm’s questions about it, and carry out what the firm instructs for the firm’s own rows. A file and its training record in the archive are deleted only where a law that binds us requires it. Once the firm is deleted, nothing ties a kept file to it, so we find the file by what it contains, which the request has to describe. We do not answer the person directly, because the firm is the party that holds the relationship with them.

We tell the firm without undue delay after we become aware that someone without authorisation has reached data we hold for the firm and can still tie to it, with what happened, what it affects and what we have done about it, and we record every such incident. A file and its record kept in the archive are detached from the firm that uploaded them, so once the firm is deleted we cannot tell it about them; for those, and for files uploaded without an account, we make the notices the law requires of us.

What follows is the firm’s: where the FTC Safeguards Rule applies to it, a notice to the FTC no later than 30 days after discovery of an event that involves 500 or more consumers (16 CFR 314.4(j)(1)), and the notices state law requires of it. We give the firm the information we have for each of them.

When a firm is deleted, the service deletes its conversions, the rows read from them, the corrections made to them, its export files, its members and its invitations, and removes the name and details that identify the firm from its billing record. Three things stay: the uploaded files with the records beside them, detached from the firm, under the licence in the terms; the audit log of who uploaded, viewed and downloaded which file; and the billing and tax records, which are kept for seven years after the end of the tax year they belong to, and longer while a tax law, an audit or a legal claim needs them.

The firm can export the rows it wants to keep as a QBO or a CSV file before it deletes the firm. What deletion looks like today is on the security page.

The FTC Safeguards Rule asks a firm to assess its service providers from time to time (16 CFR 314.4(f)(3)). What a firm can read for that is the security page and this page, and we answer a firm’s written questions about the safeguards within a reasonable time. There is no right to inspect our systems or premises, or those of the sub-processors.

The security page records what does not exist: no SOC 2 report, no ISO 27001 certificate, no penetration test, and no written answers to a security questionnaire.