Quill Data Processing Agreement

Effective date: November 10, 2026

Last updated: November 10, 2026

This Data Processing Agreement ("DPA") forms part of the Agreement between Flowlie Technologies, Inc., a Delaware corporation doing business as Quill ("Quill"), and the customer that is party to it ("Customer"), as described in the Quill Customer Terms of Service (the "Terms"). It applies whenever Quill processes Client Personal Data in providing the Services. It reflects the parties' agreement on the processing of personal data, and it is designed to meet the requirements of the Data Protection Laws defined below.

Capitalized terms not defined in this DPA have the meanings given in the Terms.

At a glance

Roles	Customer decides why its personal data is processed. Quill processes it on Customer's behalf, as a "processor" or "service provider."
Purposes	Only to provide the Services described in the Agreement and the SOW, and the other purposes listed in Section 5.1.
Subprocessors	Listed in Annex 3. Quill gives thirty (30) days' notice of new ones (Section 7).
Breaches	Quill notifies Customer without undue delay, and within seventy-two (72) hours of becoming aware (Section 8).
End of service	Quill returns or deletes Client Personal Data, and other Customer Content, within thirty (30) days after the Services end (Section 9).
Transfers	Data is stored and processed in the United States. Some of Quill's personnel work from Brazil, Romania, and the Philippines, and one Subprocessor's provider is based in the United Kingdom. EU, UK, and Swiss transfer terms are built in (Section 11).

1. Definitions

1.1 "Client Personal Data" means personal data contained in Customer Content or Customer Materials that Quill processes on Customer's behalf in providing the Services.

1.2 "Data Protection Laws" means all laws relating to the privacy, security, or processing of personal data that apply to a party's processing of Client Personal Data under the Agreement. These include, as applicable:

• (a) the EU General Data Protection Regulation 2016/679 ("GDPR");
• (b) the GDPR as it forms part of UK law, together with the UK Data Protection Act 2018 ("UK GDPR");
• (c) the Swiss Federal Act on Data Protection ("FADP");
• (d) the California Consumer Privacy Act, as amended, and its regulations ("CCPA");
• (e) the other comprehensive U.S. state privacy laws ("U.S. State Privacy Laws"); and
• (f) U.S. state data-security and breach-notification laws.

1.3 "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Client Personal Data that Quill or its Subprocessors process. It does not include unsuccessful attempts or activities that do not compromise the security of Client Personal Data, such as unsuccessful log-in attempts, pings, port scans, and denial-of-service attacks.

1.4 "SCCs" means the standard contractual clauses for the transfer of personal data to third countries, approved by European Commission Implementing Decision (EU) 2021/914, as amended or replaced from time to time.

1.5 "Subprocessor" means any third party, other than Quill's personnel, that Quill engages to process Client Personal Data. This includes the vendors listed in Annex 3 and any Subcontractors that perform Professional Services. Quill's personnel are its employees and the individual contractors who work as part of Quill's team under its direction, including those engaged through their own single-member company. They work on Quill-managed equipment, except for the limited use of personal mobile phones described in Annex 2, item 12, and are bound by written confidentiality and data-protection obligations (Section 4.2).

1.6 "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, as amended or replaced from time to time.

1.7 Terms such as "controller," "processor," "business," "service provider," "data subject," "consumer," "personal data," "personal information," "processing," "sell," "share," and "supervisory authority" have the meanings given in the applicable Data Protection Laws. "Personal data" includes "personal information."

2. Scope and roles

2.1 Customer as controller

For Client Personal Data, Customer is the controller (or, under the CCPA, the business), and Quill is its processor (or service provider). Where Customer is itself a processor acting on behalf of a third-party controller, Quill is Customer's subprocessor. In that case, Customer warrants that its instructions, including the appointment of Quill, have been authorized by that controller.

2.2 Quill as controller

This DPA does not apply to personal data that Quill processes as a controller for its own purposes, as described in the Quill Privacy Policy. This includes Users' account and contact details used to administer the relationship, and Usage Data used under Section 5.5 of the Terms.

2.3 Description of processing

Annex 1 describes the subject matter, duration, nature, and purpose of the processing, the types of Client Personal Data, and the categories of data subjects.

3. Customer responsibilities

3.1 Lawfulness

Customer is responsible for:

• having a lawful basis for the processing it instructs, and for disclosing Client Personal Data to Quill;
• giving data subjects any notices, and obtaining any consents, that Data Protection Laws require; and
• the accuracy of Client Personal Data and the lawfulness of the means by which it was obtained.

3.2 Data minimization

Customer will provide only the Client Personal Data that is reasonably necessary for the Services. It will follow the restrictions on sensitive information in Section 5.3 of the Terms, and the restrictions on AI Input in Section 6.3 of the Terms.

3.3 Lawful instructions

Customer's instructions to Quill will comply with Data Protection Laws.

4. Quill's obligations

4.1 Instructions

Quill will process Client Personal Data only on Customer's documented instructions. Customer's complete instructions at the date of this DPA are:

• the Agreement, including this DPA and each SOW;
• Customer's configuration and use of the Services; and
• any further written instructions that are consistent with the Agreement.

Quill will inform Customer if, in its opinion, an instruction infringes Data Protection Laws. Quill may then suspend the affected processing until the instruction is confirmed or modified. If Applicable Laws require Quill to process Client Personal Data in another way, Quill will inform Customer of that legal requirement before processing, unless the law prohibits it.

4.2 Confidentiality of personnel

Quill will ensure that everyone it authorizes to process Client Personal Data is bound by an appropriate duty of confidentiality, whether contractual or statutory. It will also limit access to those who need it to provide the Services.

4.3 Security

Quill will implement and maintain appropriate technical and organizational measures to protect Client Personal Data, taking into account the state of the art, the costs of implementation, the nature, scope, context, and purposes of the processing, and the risks to individuals. These measures include, at a minimum, the measures described in Annex 2.

Quill may update its security measures from time to time, provided that the updates do not materially reduce the overall protection of Client Personal Data. Customer is responsible for its own use of the Services, including keeping credentials secure, managing User access, and configuring Connected Systems.

4.4 Data subject requests

If Quill receives a request from a data subject relating to Client Personal Data, it will promptly forward the request to Customer and will not respond to it, except to direct the data subject to Customer, unless Customer authorizes Quill to respond. Taking into account the nature of the processing, Quill will provide reasonable assistance so that Customer can respond to requests from data subjects to exercise their rights under Data Protection Laws.

4.5 Other assistance

Taking into account the nature of the processing and the information available to Quill, Quill will provide reasonable assistance with Customer's obligations relating to:

• the security of processing;
• notifying Personal Data Breaches;
• data protection impact assessments and risk assessments; and
• prior consultation with supervisory authorities.

Quill may charge reasonable fees for assistance that goes beyond what is required to provide the Services. It will give Customer an estimate of those fees in advance.

4.6 Records

Quill will maintain the records of processing activities that Data Protection Laws require of a processor.

5. Business purposes and U.S. state law terms

5.1 Specific business purposes

Quill will process Client Personal Data only for the following business purposes:

• (a) performing the Professional Services described in the applicable SOW, such as accounting and bookkeeping, receivables and payables support, payroll administration support, financial planning and analysis, management and board reporting, systems implementation, and fundraising preparation;
• (b) providing, operating, securing, and supporting the Software, including AI Features, and connecting to the Connected Systems that Customer authorizes;
• (c) detecting, preventing, and responding to security incidents and fraud, and debugging errors that impair intended functionality;
• (d) the machine-learning use described in Section 6, unless Customer has opted out; and
• (e) complying with Applicable Laws.

5.2 CCPA and U.S. State Privacy Laws

To the extent Client Personal Data is subject to the CCPA or U.S. State Privacy Laws, Quill:

• (a) will not sell or share Client Personal Data;
• (b) will not retain, use, or disclose Client Personal Data for any purpose, including any commercial purpose, other than the business purposes in Section 5.1, or as otherwise permitted by the CCPA and its regulations;
• (c) will not retain, use, or disclose Client Personal Data outside the direct business relationship between Quill and Customer;
• (d) will not combine Client Personal Data with personal data that Quill receives from or on behalf of anyone else, or collects from its own interactions with individuals, except as permitted by the CCPA and its regulations;
• (e) will comply with its applicable obligations under the CCPA and U.S. State Privacy Laws, and provide the same level of privacy protection that they require of Customer;
• (f) will notify Customer if it determines that it can no longer meet its obligations under the CCPA or U.S. State Privacy Laws;
• (g) grants Customer the right, on notice, to take reasonable and appropriate steps to stop and remediate any unauthorized use of Client Personal Data. These steps may include requiring Quill to provide documentation that verifies deletion;
• (h) grants Customer the right to take reasonable and appropriate steps, including under Section 10, to help ensure that Quill uses Client Personal Data consistently with Customer's obligations under those laws; and
• (i) will assist Customer in responding to consumer requests as described in Section 4.4.

Quill certifies that it understands and will comply with the restrictions in this Section 5.2. The parties agree that Customer does not sell or share Client Personal Data to Quill, and that Customer does not provide it to Quill in exchange for anything of value.

6. Machine learning and de-identified data

6.1 Machine learning

As described in Section 5.6 of the Terms, Quill may use Customer Content, excluding Customer's Confidential Information, for machine learning to support and develop features and functionality within the Software and similar products and services, unless Customer opts out.

• Opting out. Customer may opt out at any time under Section 5.6 of the Terms. Quill will implement the opt-out within thirty (30) days.
• Who may use the data. Quill will not permit any third party, including its AI technology providers, to use Client Personal Data to train that third party's own models.
• Safeguards. Quill will apply the security measures in Annex 2 to any Client Personal Data used for machine learning.

6.2 De-identified data

Where Quill de-identifies, aggregates, or anonymizes data derived from Client Personal Data, Quill will:

• (a) take reasonable measures to ensure the data cannot be associated with an individual or with Customer;
• (b) publicly commit to keeping the data in de-identified form and not attempting to re-identify it, except as permitted by law; and
• (c) contractually require any recipient of the data to comply with the same commitments.

7. Subprocessors

7.1 Authorization

Customer gives Quill general written authorization to engage Subprocessors to process Client Personal Data. Quill's current Subprocessors are listed in Annex 3, which Quill will also maintain on its Legal Hub at withquill.ai/legal. Subcontractors who perform Professional Services also require Customer's prior permission under Section 4.8 of the Terms.

7.2 Notice of new Subprocessors

Quill will give Customer at least thirty (30) days' notice before a new Subprocessor begins processing Client Personal Data. Notice will be given by email to Customer's designated contact or by updating the list referred to in Section 7.1. Customer may object, on reasonable grounds relating to data protection, by notifying Quill in writing within that notice period. The parties will then discuss Customer's concerns in good faith. Customer's other rights under the Agreement are not affected, including its right to terminate for convenience under Section 8.4 of the Terms.

7.3 Subprocessor obligations

Quill will:

• (a) carry out reasonable diligence on each Subprocessor's data-protection and security practices before engaging it;
• (b) enter into a written agreement with each Subprocessor that imposes data-protection obligations no less protective of Client Personal Data than those in this DPA, to the extent applicable to the services the Subprocessor provides; and
• (c) remain responsible to Customer for each Subprocessor's performance of its obligations, as it is for its own.

7.4 Connected Systems and Customer-connected AI tools

Providers of Connected Systems that Customer engages directly, such as Customer's own accounting, banking, card, or payroll providers, are not Quill's Subprocessors. They process data under Customer's own agreements with them.

The same applies to AI applications that Customer's Users connect to the Software through Quill's MCP server (Section 3.6 of the Terms). Quill makes Client Personal Data available to those applications only at the User's direction and within that User's permissions, and it logs that access. The provider of a connected application processes the data under Customer's own agreement with it.

8. Personal Data Breaches

8.1 Notification

Quill will notify Customer of a Personal Data Breach without undue delay, and in any event within seventy-two (72) hours after becoming aware of it. Notice will be given by email to Customer's designated contact.

8.2 Information

To the extent it is available, Quill's notice and follow-up updates will describe:

• (a) the nature of the breach, including the categories and approximate number of data subjects and records concerned;
• (b) a contact point for more information;
• (c) the likely consequences of the breach; and
• (d) the measures taken or proposed to address the breach and mitigate its effects.

Where Quill cannot provide all of this information at once, it may provide it in phases without undue further delay.

8.3 Response

Quill will take reasonable steps to contain, investigate, and remediate the Personal Data Breach. It will also give Customer reasonable cooperation so that Customer can meet its own obligations to notify authorities and individuals.

Unless the law requires otherwise, Customer decides whether to notify authorities or affected individuals, and how. Quill will not notify Customer's data subjects directly unless Customer instructs it to, or the law requires it.

8.4 No admission

Quill's notification of, or response to, a Personal Data Breach is not an acknowledgment of fault or liability.

9. Return and deletion

9.1 Export

During the Subscription Period, Customer may export, or ask Quill to provide, a copy of Client Personal Data in a commonly used format.

9.2 Deletion

Within thirty (30) days after the Services end, Quill will, at Customer's choice:

• return Client Personal Data to Customer; or
• delete it, together with existing copies.

If Customer makes no choice within that period, Quill will delete it.

9.3 Exceptions

Quill may keep Client Personal Data:

• (a) where Applicable Laws require it to be stored, for as long as they require; and
• (b) in backups, until they expire under Quill's backup schedule. Database snapshots are kept for up to twelve (12) months. Prior versions and replicas of stored files are kept for no longer than that.

Retained data remains subject to this DPA and to Section 12 of the Terms, and Quill will not actively process it for any other purpose.

9.4 Certification

On Customer's written request, Quill will confirm in writing that deletion has been completed.

9.5 Other Customer Content

Sections 9.1 through 9.4 also apply to Customer Content that is not personal data, as if it were Client Personal Data. This Section 9 does not affect Quill's rights in Usage Data, or in aggregated, anonymized, or de-identified data, under Sections 5.5 and 5.6 of the Terms.

10. Audits

10.1 Information

Once in any twelve (12) month period, on Customer's written request, Quill will:

• complete a reasonable security and privacy questionnaire; and
• provide documentation reasonably necessary to demonstrate its compliance with this DPA, such as policies, summaries of security measures, and the list of Subprocessors.

Once Quill has a current SOC 2 report, it will provide the report, under confidentiality obligations, in place of the questionnaire. Customer may still request information that the report does not reasonably cover.

10.2 On-site audits

Customer, or an independent auditor it appoints, may audit Quill's compliance with this DPA, including through an on-site inspection, only where:

• (a) the information under Section 10.1 is not sufficient to demonstrate compliance with Data Protection Laws, and a supervisory authority or Data Protection Laws require such an audit; or
• (b) a Personal Data Breach has occurred.

10.3 Conditions

Any audit under Section 10.2 will:

• be limited to once in any twelve (12) month period, unless a supervisory authority or a further Personal Data Breach requires otherwise;
• be requested with at least thirty (30) days' written notice;
• take place during normal business hours, under a scope and plan agreed in advance;
• be conducted in a way that minimizes disruption to Quill's business and protects the confidentiality of Quill's other customers and its security; and
• be conducted by an auditor bound by confidentiality obligations and not a competitor of Quill.

Customer bears its own audit costs and reimburses Quill's reasonable costs, except where the audit reveals a material breach of this DPA by Quill. Audit results are Quill's Confidential Information.

10.4 CCPA reviews

The rights in this Section 10 also satisfy Customer's right to take reasonable steps under Section 5.2(h).

11. International transfers

11.1 Location

Quill and the Subprocessors listed in Annex 3 store and process Client Personal Data in the United States. Quill's personnel work from the United States and from Brazil, Romania, and the Philippines, and may access Client Personal Data from those countries, on Quill-managed equipment and under the measures in Annex 2. The one exception is that personnel may read and send Quill email and Slack messages, which can contain Client Personal Data, on their personal mobile phones, under the conditions in Annex 2, item 12. One Subprocessor, API Hero Ltd (Trigger.dev), is established in the United Kingdom and may access Client Personal Data from there, as shown in Annex 3. Some Subprocessors use service providers of their own, which may be located in other countries, including the United Kingdom and the European Union. Each Subprocessor's published list identifies them, and Section 7.3 applies to Quill's agreement with that Subprocessor. Quill will not itself transfer Client Personal Data to any other country, or allow its personnel or a new Subprocessor to store or access it from any other country, without giving notice under Section 7.2, and without implementing a transfer mechanism that Data Protection Laws recognize where they require one.

11.2 EU transfers

To the extent Customer, or a controller on whose behalf Customer acts, transfers Client Personal Data that is subject to the GDPR to Quill in a country without an adequacy decision, the SCCs are incorporated into this DPA as follows:

• (a) Modules. Module Two applies where Customer is a controller, and Module Three applies where Customer is a processor. Customer is the "data exporter," and Quill is the "data importer."
• (b) Clause 7. The optional docking clause does not apply.
• (c) Clause 9. Option 2 (general written authorization) applies. The time period for prior notice of Subprocessor changes is the period in Section 7.2.
• (d) Clause 11. The optional language does not apply.
• (e) Clause 13. The competent supervisory authority is determined in accordance with Clause 13 and the data exporter's establishment or representative.
• (f) Clauses 17 and 18. The SCCs are governed by the law of Ireland, and disputes are resolved by the courts of Ireland.
• (g) Annexes. Annex I of the SCCs is completed with the information in Annex 1 of this DPA. Annex II is completed with Annex 2 of this DPA. Annex III is completed with Annex 3 of this DPA.

11.3 UK transfers

To the extent the UK GDPR applies, the UK Addendum is incorporated into this DPA and amends the SCCs as set out in Section 11.2. Tables 1 to 3 of the UK Addendum are completed with the information in Section 11.2 and Annexes 1 to 3. In Table 4, neither party may end the UK Addendum when the Approved Addendum changes.

11.4 Swiss transfers

To the extent the FADP applies, the SCCs apply as set out in Section 11.2, with these adaptations:

• (a) references to the GDPR are to be read as references to the FADP;
• (b) the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; and
• (c) the term "Member State" does not exclude data subjects in Switzerland from bringing claims in their place of habitual residence.

11.5 Alternative mechanisms

If a transfer mechanism in this Section 11 is invalidated, or replaced by a mechanism that a supervisory authority or court requires, the parties will cooperate in good faith to adopt an alternative lawful mechanism. Any valid certification of a recipient under the EU-U.S. Data Privacy Framework, or its UK or Swiss extensions, may also be relied on for transfers to that recipient.

11.6 Countries of concern

Quill will not engage in any transaction involving Client Personal Data that is prohibited or restricted under the U.S. Department of Justice rule on access to Americans' bulk sensitive personal data and government-related data by countries of concern (28 C.F.R. Part 202). Quill will also not permit access to Client Personal Data by any country of concern or covered person under that rule, except in compliance with it.

12. Requests from authorities

If Quill receives a legally binding request from a public authority for access to Client Personal Data, Quill will:

• (a) notify Customer promptly, unless the law prohibits it;
• (b) review the legality of the request, and challenge it where, after careful assessment, Quill concludes there are reasonable grounds to consider it unlawful; and
• (c) disclose only the minimum information permissible in response.

13. Liability

Each party's liability arising out of or relating to this DPA, including under the SCCs, is subject to the exclusions and limitations of liability in Section 10 of the Terms. This Section 13 does not limit either party's liability to data subjects under the SCCs or Data Protection Laws, where such a limitation is not permitted.

14. General

14.1 Term

This DPA remains in effect for as long as Quill processes Client Personal Data. Sections 9 and 13 survive the end of the Agreement.

14.2 Precedence

If this DPA conflicts with the Terms or an SOW, this DPA prevails for the processing of Client Personal Data, and for the return and deletion of Customer Content under Section 9.5. If this DPA conflicts with the SCCs or the UK Addendum, the SCCs or the UK Addendum prevail.

14.3 Changes

Quill may update this DPA in the same way as the Terms under Section 16.1 of the Terms. Quill may also update it, without reducing the protection of Client Personal Data, where needed to comply with changes in Data Protection Laws or with a supervisory authority's requirements.

14.4 Governing law

Except for the SCCs (Section 11.2(f)), this DPA is governed by the law and courts set out in Sections 16.2 and 16.3 of the Terms.

Annex 1 — Description of processing

A. Parties

	Data exporter	Data importer
Name	Customer, as identified in the SOW	Flowlie Technologies, Inc., dba Quill
Address	As stated in the SOW	1460 Broadway, Suite 9051, New York, NY 10036, United States
Contact	Customer's designated contact in the SOW	support@withquill.ai
Role	Controller (or processor acting for a controller)	Processor (or subprocessor)
Activities	Receiving the Services under the Agreement	Providing the Services under the Agreement
Signature and date	By signing or accepting the SOW	By signing or accepting the SOW

B. Description of the processing

Categories of data subjects	Customer's employees, contractors, and job applicants (for example, in payroll and expense records); Customer's own customers, vendors, and their contacts (receivables and payables); Customer's shareholders, option holders, investors, and board members (capitalization-table and investor materials); Users of the Software
Categories of personal data	Names and contact details; job titles and employment details; compensation, payroll, benefits-deduction, and reimbursement records; bank-account and payment-card transaction records; invoices and payment records; tax identification numbers; equity holdings and investment amounts; communications and documents provided for the Services; User account and access data
Sensitive data	Government identification numbers (such as Social Security numbers or taxpayer identification numbers) and financial-account numbers, where reasonably necessary for the Services under Section 5.3 of the Terms. These are protected by the measures in Annex 2, including access restricted to personnel who need it. Customer does not intend to provide special categories of data under Article 9 of the GDPR.
Frequency of transfer	Continuous, for the duration of the Services
Nature of processing	Collection, including through read-only connections to Connected Systems; storage; organization; reconciliation; analysis; reporting; preparation of Deliverables; AI-assisted processing through AI Features, and through the company-licensed AI tools Quill personnel use in delivering the Services; internal communication about the Services by email and Slack; making data available, at a User's direction, to AI applications Customer connects through Quill's MCP server; transmission to Customer; and deletion
Purposes	The business purposes in Section 5.1
Duration and retention	For the Subscription Period, plus the return and deletion period in Section 9
Transfers to Subprocessors	As listed in Annex 3, for the purposes stated there, for the duration of the Services

Annex 2 — Security measures

Quill maintains the following technical and organizational measures:

1. Governance. An assigned person is responsible for information security. Written security policies are reviewed at least annually.
2. Access control. Access to Client Personal Data is granted on a least-privilege, need-to-know basis, and is reviewed periodically. Access is promptly revoked when personnel leave or change roles.
3. Authentication. Multi-factor authentication is required for personnel access to systems that store Client Personal Data. Unique accounts are used, with no shared credentials.
4. Encryption. Client Personal Data is encrypted in transit over public networks, using TLS 1.2 or higher, and at rest in production databases and storage, using AES-256.
5. Connected Systems. Read-only permissions are used for connections to Customer's systems wherever the Services allow. Connection credentials and tokens are stored encrypted.
6. Segregation. Each customer's data is logically separated within the Software.
7. Logging and monitoring. Access to, and administrative actions on, production systems are logged, including administrator access to customer data and access through the MCP server. Logs are reviewed for anomalous activity. Application logs are kept for at least thirty (30) days, and cloud-account activity logs for at least one (1) year.
8. Vulnerability management. Systems and dependencies are patched in a timely manner based on risk. Vulnerabilities are tracked to remediation.
9. Backups and resilience. Client Personal Data in production databases is backed up regularly. Backups are encrypted, and restore procedures are tested at least annually.
10. Vendor management. Subprocessors are assessed before engagement and bound by written data-protection terms (Section 7.3).
11. Personnel. Personnel and Subcontractors with access to Client Personal Data are bound by confidentiality obligations and receive security and privacy training at onboarding and at least annually.
12. Devices. Company computers used to access Client Personal Data use full-disk encryption, screen lock, and up-to-date operating systems. Client Personal Data may not be stored on personal mobile devices or removable media.
- • Personal mobile phones (exception). Personnel may use their personal mobile phones only to read and send Quill email and Slack messages. No other personal device may be used to access Quill systems. A personal phone must have a screen lock, may not be shared, must be reported at once if lost or stolen, and may not be used to download, store, or work on Client Personal Data, including attachments and files. Messages remain stored in Google Workspace and Slack. The email and Slack apps may keep temporary copies on the phone to display them.
- • Disclaimer. Quill does not manage personal phones, so the controls above for company computers (such as full-disk encryption managed by Quill) do not apply to them. Quill relies on the conditions in this item and on its internal policies for them.
13. Incident response. A documented incident-response procedure is maintained, including the Customer notification steps in Section 8.
14. Secure deletion. Data is deleted using methods appropriate to the storage medium, in line with Section 9.
15. Monitoring tools. Product-analytics, session-recording, and error-monitoring tools used in the Software are configured to mask or exclude Client Personal Data.

Annex 3 — Subprocessors

Subprocessor	Purpose	Location of processing
Amazon Web Services, Inc.	Cloud infrastructure: hosting, compute, and storage for the Software	United States (us-east-2, Ohio)
MongoDB, Inc.	Hosted database for the Software	United States
Plaid Inc.	Read-only connections to Customer's bank accounts (balances, transactions, and account details), where Customer chooses to connect them	United States
OpenAI, LLC	AI model processing for AI Features; ChatGPT, under Quill's company-licensed business plan, used by Quill personnel in delivering the Services	United States
Anthropic PBC	AI model processing for AI Features; Claude, under Quill's company-licensed team plan, used by Quill personnel in delivering the Services	United States
Google LLC (Google Workspace)	Email, document storage, and collaboration used in delivering the Services	United States
Zendesk, Inc.	Customer support ticketing	United States
Slack Technologies, LLC (a Salesforce company)	Internal messaging used by Quill personnel in delivering the Services	United States
API Hero Ltd (Trigger.dev)	Background job processing for the Software	United States (AWS us-east-1); provider established in the United Kingdom
PostHog Inc.	Product analytics and session recording within the Software, configured to mask on-screen text and typed inputs	United States
Functional Software, Inc. d/b/a Sentry	Error and crash monitoring for the Software, configured to exclude Client Personal Data from error reports	United States

AI tools used by personnel. Quill personnel use ChatGPT and Claude only through company licenses that Quill holds under business agreements with OpenAI and Anthropic (currently the ChatGPT Business and Claude Team plans), never through individual or personal accounts. Those agreements do not allow OpenAI or Anthropic to use Customer's data to train their models, and Quill does not permit model training on Customer data in either tool. Personnel may use only the AI tools approved under Quill's internal policies.

Subcontractors. Quill does not currently engage Subcontractors to perform Professional Services. Before it does, Quill will obtain Customer's permission under Section 4.8 of the Terms and add the Subcontractor to this list under Section 7.2.

Plaid. When a person connects a bank account through Plaid, Plaid also processes the data they provide in accordance with its own End User Privacy Policy, which that person accepts during the connection.

Contact

Security incidents and vulnerability reports: security@withquill.ai. Questions about this DPA: support@withquill.ai, or Flowlie Technologies, Inc., dba Quill, Attention: Privacy, 1460 Broadway, Suite 9051, New York, NY 10036.