Data Processing Agreement

Between Fingro AI, Inc. ("Processor") and the Employer Organization ("Controller")

For the Fingro.ai B2B2E Financial Wellness Program

Version: 1.7 Effective Date: [Signature Date] Last Updated: 2026-10-01

Version 1.7 changes (2026-10-01): Sections 8 and Appendix A corrected to match the US-only posture. Section 8 previously said that if the Controller or its employees were located outside the United States this DPA would serve as the transfer mechanism, and Appendix A offered the EU Standard Contractual Clauses for employees in the EEA. Neither can be true: the Services are offered only in the United States, the Controller must be a US entity, only US-resident employees are eligible, and registration from outside the United States is refused at signup. Both now say so, and both state that the appropriate mechanism would be executed BEFORE any non-US processing if that ever changed. No change to what we process, how long we keep it, or any security commitment.

Version 1.6 changes (2026-07-15): Removed Teller, Inc. from the Section 4.1 approved sub-processor list. Plaid, Inc. is now the sole financial-account-aggregation sub-processor. No change to categories of data processed, retention, security controls, or Controller rights.

Version 1.5 changes (2026-06-25): Section 4.1 (Approved Sub-Processors) updated to reflect the true production stack: Google Cloud Vertex AI (Gemini 2.5 Flash, us-central1) named as the document-understanding (OCR) sub-processor under the executed Google Cloud Data Processing Addendum; Perplexity AI named for WelX web-search augmentation (public-information queries only); Finnhub named for market-data lookups; Resend named as the live transactional email provider (Amazon SES remains provisioned inside our AWS VPC as a pending alternative — SES production-access approval is in flight and SES is not currently in use). Anthropic row updated to specify Bedrock cross-region inference (us-east-1, us-east-2, us-west-2) and the Bedrock no-retention / no-training guarantee. No reduction of prior commitments; no change to Controller-facing rights, breach SLA, or certification status.

Version 1.4 changes (2026-06-07): Section 7.3 (Sponsorship Termination and Account Portability) rewritten to specify the full Revenue Leakage Guardrails lifecycle: 30-day Grace Period with Controller-initiated Reactivation available, 90-day Suspended state with read-only data preservation, and Day 121 permanent deletion. Added the household composition freeze covering Grace and Suspended states. Cross-references to ToS §5.11 (hashed identifier registry) added. Controller's zero-visibility guarantee post-termination reaffirmed and extended to cover all lifecycle phases.

Version 1.3 changes (2026-05-23): Added Section 1.5 clarifying that Fingro acts as an independent business / controller — not a processor on behalf of Employer — for employee-provided financial data processed under the Privacy Policy and Terms of Service. Added Section 2.5 (re-identification suppression below 20 employees). Added mutual indemnity provision in Section 11.2. Audit scope and frequency aligned with MSA Section 16. Sub-processor list moved to a hybrid model: named providers retained in Section 4.1; the authoritative live list is published at fingro.ai/sub-processors. No softening of prior commitments — the 72-hour breach SLA, enumerated controller obligations, certifications listing, and SCC mapping are all preserved.

Version 1.2 changes (2026-05-22): Processor legal entity name updated to Fingro AI, Inc. (previously "Fingro, Inc."). No change to data processing obligations or sub-processor relationships.

Version 1.1 changes (2026-05-19): Section 2.1 now lists the Controller- provided Coverage Policy fields. New Section 2.3 enumerates the operational fields visible to the Controller in the admin console (and what is not visible). New Section 2.4 describes the Coverage Policy mechanism, the mid-cycle disclosure flow, and how renewal invoices are computed. Section 7.3 now specifies what happens to the employee's account, household, and data when sponsorship ends.

1. Purpose and Scope

1.1 Purpose

This Data Processing Agreement ("DPA") governs the processing of personal data when an employer organization ("Controller" or "Employer") offers the Fingro.ai financial wellness platform ("Services") as an employee benefit. This DPA supplements the Fingro Terms of Service and Privacy Policy.

1.2 Relationship of the Parties

1.3 Key Principle: Zero Employer Visibility (Default)

The employee, not the employer, controls their Fingro account and data. By default, the employer has zero visibility into any individual employee's Fingro activity.

The employer's role is strictly limited to:

• Sponsoring access to Fingro as a workplace benefit
• Providing an employee eligibility list (name and work email only)
• Receiving aggregate, anonymized participation reports (enrollment counts only)

The employer cannot — by design, not by policy:

• See whether a specific employee has enrolled or is active
• Access any employee's financial data, transactions, balances, or net worth
• View any employee's AI conversations, insights, or recommendations
• Access any employee's Vault documents
• See which financial institutions an employee has connected
• Determine an employee's subscription tier
• Take any action on an employee's account

This is an architectural constraint, not a configurable setting. The employer's system access is limited to an aggregate reporting API that enforces minimum cohort thresholds to prevent re-identification.

1.4 Invitation Flow

Fingro's invitation system supports multiple referral channels:

In all channels, the user consents to the specific level of third-party access during onboarding. The user can modify or revoke access at any time from Administration > Privacy & Security.

1.5 Scope of the Processor Relationship

This DPA governs Fingro's processing of personal data that the Controller (Employer) provides to Fingro — specifically the employee eligibility list, employment status, Covered Tier, and Coverage Policy described in Section 2.1. With respect to that data, Fingro acts as a Processor on the Controller's behalf, as set forth in this DPA.

Once an employee creates a Fingro account, the financial data, documents, AI interactions, household-member identities, and other personal information processed in connection with that account are governed by the direct relationship between Fingro and the employee under the Fingro Privacy Policy, Terms of Service, and applicable law. With respect to that employee-provided data, Fingro acts as an independent business / controller — not as a Processor on behalf of the Employer. The Employer does not determine the purposes or means of processing such data, has no rights to such data under this DPA, and is not responsible under applicable privacy laws for Fingro's processing of such data.

This scope distinction is fundamental to the architecture of the Services and to the Parties' allocation of responsibility:

• For Employer-provided data: Fingro processes only on documented Controller instructions, and the obligations of a Processor under applicable law apply.
• For Employee-provided data: Fingro processes pursuant to its direct privacy notice to the employee; the Employer is neither a controller, co-controller, nor joint controller of that data.

2. Data Processed

2.1 Data Provided by the Controller (Employer)

2.2 Data Provided by the Data Subject (Employee)

Once an employee creates their Fingro account, they provide data directly to Fingro as an independent user. This data includes financial account connections, transaction history, documents, and AI interactions as described in the Fingro Privacy Policy.

This employee-provided data is NOT covered by this DPA. Fingro processes this data under its direct relationship with the employee, governed by the Fingro Privacy Policy and Terms of Service. The employer is not a controller of this data.

2.3 Information Available to the Controller in the Admin Console

In addition to the aggregate enrollment count described below, the Controller's admin console exposes a strictly limited set of operational fields about each individual employee they sponsor — and only those fields. These fields are necessary for the Controller to manage the seats it pays for:

2.3.1 Aggregate Program Reports

The Controller also receives a single aggregate metric for the program as a whole:

The Controller does not receive, in either the admin console or aggregate reports:

• Financial data, transaction data, document content, AI conversation content, or any data derived from these
• Engagement rates, feature adoption, page-level usage, or session detail
• The identity of any household member, dependent, or business entity associated with an employee
• The document, account, or event that triggered a coverage adjustment (only the dollar delta and tier transition are surfaced, scoped to an individual employee)

No individual financial data is ever included in reports to the Controller. Counts and dollar amounts surface only to support seat management and renewal billing.

2.4 Coverage Policy and Mid-Cycle Adjustments

The Controller may configure, in the admin console, a Coverage Policy for the three life-event categories (spouse, dependent, business entity). Each category is either "Employer Pays" or "Employee Pays" and is independent of the others. The Coverage Policy is the only mechanism by which Controller-level configuration affects an employee's bill.

When an employee initiates a household action that would grow their plan:

1. Fingro displays an in-product disclosure to the employee that includes the Coverage Policy in effect for that category and the amount that will be charged (to either party).
2. The change is applied only if the employee confirms.
3. If the policy is "Employer Pays," the employee's Covered Tier on the seat is updated, the Controller's seat mix is recalculated, and the prorated dollar delta is recorded as a coverage adjustment for inclusion in the next annual renewal invoice. The Controller sees the employee's name, the tier transition, and the dollar delta — and no other information about the underlying event.
4. If the policy is "Employee Pays," the employee's saved payment method is charged for the prorated delta. The Controller is not billed and the change is not surfaced in the admin console.

Renewal invoices are generated daily on the anniversary of each Controller's subscription and consist of (a) the current seat mix at then-current per-seat pricing and (b) a single rolled-up "coverage adjustments" line representing the sum of "Employer Pays" deltas accrued during the prior term. The Controller may disable auto-renewal at any time; doing so causes the subscription to expire at the end of the current term and converts each sponsored employee's account to a personal subscription as described in §7.3.

3. Processing Instructions

3.1 Processor Obligations

Fingro shall:

1. Process personal data only on documented instructions from the Controller, unless required by law
2. Ensure that persons authorized to process personal data are bound by confidentiality obligations
3. Implement appropriate technical and organizational security measures (described in Section 5)
4. Not engage sub-processors without prior written authorization from the Controller (see Section 4)
5. Assist the Controller in responding to data subject rights requests, to the extent the request relates to employer-provided data
6. Delete or return all personal data upon termination of the agreement, at the Controller's election
7. Make available all information necessary to demonstrate compliance with this DPA
8. Notify the Controller without undue delay upon becoming aware of a personal data breach (see Section 6)

3.2 Controller Obligations

The Controller shall:

1. Ensure a lawful basis exists for providing employee data to Fingro (e.g., legitimate interest in offering financial wellness benefits, or employee consent)
2. Inform employees that Fingro is offered as a workplace benefit and that their name and work email will be shared for account provisioning via invitation email
3. Not request or attempt to access any individual employee's Fingro account data
4. Not attempt to determine whether a specific employee has enrolled or is active on the platform
5. Promptly notify Fingro when an employee's employment is terminated, so eligibility can be updated
6. Not use aggregate enrollment counts to identify, profile, or take adverse action against individual employees
7. Acknowledge that the employee's Fingro account is a personal account — the employer has no rights to the account or its data, even though the employer sponsors access

4. Sub-Processors

4.1 Approved Sub-Processors

Fingro uses the following sub-processors to deliver the Services:

The named providers above are Fingro's current sub-processors. The authoritative, always-current sub-processor list — including specific model versions, any document-processing vendors, and any new sub-processors — is published at fingro.ai/sub-processors and is updated when sub-processors change. Notice of material changes is provided to the Controller in accordance with Section 4.2.

4.2 Changes to Sub-Processors

Fingro will notify the Controller at least 30 days before engaging a new sub-processor (notice may be by email to the Controller's billing contact, by in-product banner in the admin console, or by update to fingro.ai/sub-processors). The Controller may object to a new sub-processor in writing within 14 days of notification on reasonable data-protection grounds. If the parties cannot resolve the Controller's reasonable objection within a commercially reasonable period (not to exceed 30 additional days), the Controller may terminate the affected portion of the Services upon written notice without further obligation other than payment of Fees accrued through the effective date of termination.

4.3 Sub-Processor Obligations

All sub-processors are contractually bound to:

• Process data only as instructed by Fingro
• Implement appropriate security measures
• Not further sub-process without authorization
• Delete data upon termination of their engagement

5. Security Measures

5.1 Technical Measures

Fingro implements the following technical security measures:

5.2 Organizational Measures

5.3 Certifications

Inherited from our infrastructure providers. Fingro's infrastructure is hosted on AWS, which maintains:

• SOC 1, SOC 2, and SOC 3 certifications
• ISO 27001, ISO 27017, ISO 27018 certifications
• PCI DSS Level 1 compliance
• FedRAMP authorization

Fingro's own certifications. Fingro is targeting SOC 2 Type I in the second half of our first production year and SOC 2 Type II within twelve months of go-live. We have not yet engaged an audit firm or completed a formal third-party assessment. Until then, in lieu of a SOC 2 report we will provide the artifacts listed in Section 9.3 below to the Controller upon written request.

6. Data Breach Notification

6.1 Notification Timeline

In the event of a personal data breach affecting employer-provided data (employee names, work emails), Fingro will:

1. Notify the Controller without undue delay, and in any event within 72 hours of becoming aware of the breach
2. Provide the following information:
   • Nature of the breach (categories of data, approximate number of affected individuals)
   • Contact information for Fingro's point of contact
   • Likely consequences of the breach
   • Measures taken or proposed to address the breach and mitigate its effects

6.2 Employee Financial Data

If a breach affects employee financial data (account connections, transactions, documents), Fingro will notify the affected employees directly under its Privacy Policy obligations. The employer will be informed of the breach in aggregate terms (number of affected employees) but will NOT receive details about individual employees' financial data.

6.3 Cooperation

Both parties agree to cooperate in good faith to investigate and remediate any data breach, including cooperating with regulatory authorities if required.

7. Data Subject Rights

7.1 Employer-Provided Data

For data subject rights requests relating to employer-provided data (name, work email):

• The Controller is responsible for responding to employee requests regarding data the Controller provided
• Fingro will assist the Controller by providing or deleting the relevant data within 30 days of receiving a verified request

7.2 Employee Financial Data

For data subject rights requests relating to financial data within Fingro:

• The employee exercises rights directly with Fingro under the Privacy Policy
• Fingro responds to the employee directly
• The Controller is not involved in these requests and does not receive notification

7.3 Sponsorship Termination and Account Portability

Sponsorship ends when (a) the Controller removes the employee from their admin console, (b) the Controller's overall subscription is cancelled or allowed to lapse, or (c) the employee leaves the employer and the Controller notifies Fingro. In all cases the following protections apply:

• The employee's account, household members, household-member access, documents, transactions, AI conversations, and all derived intelligence are preserved without interruption. The Controller has no rights to direct deletion, export, or transfer of this data.
• The subscription converts to a personal subscription at the same tier the employee was on at the moment sponsorship ended, and enters the "Revenue Leakage Guardrails" lifecycle described in Section 5.6 of the Terms of Service:
  • Grace Period (Days 1–30): the employee retains full access while a personal payment method may be added; the Controller may also Reactivate the seat from its admin console during this window, restoring sponsorship with no charge to the employee.
  • Suspended (Days 31–120): if no payment method is added during Grace, the account becomes read-only; data is preserved. The Controller no longer has the ability to Reactivate the seat in this state.
  • Day 121 — Deletion: if no reactivation occurs by Day 121, the account is permanently deleted; Fingro retains one-way hashed identifiers in a fraud-prevention registry for seven (7) years per Section 5.11 of the Terms of Service.
• No coverage adjustment is created for the termination itself. Adjustments accrued during the prior term remain on the Controller's next renewal invoice (if applicable). The employee is not retroactively billed for any "Employer Pays" delta accrued during the sponsorship.
• The Controller is informed only that the seat has been released — the employee's continued use of Fingro, including all subsequent activity, transitions through Grace/Suspended/Deletion, reactivation, or hashed-registry retention is not visible to the Controller.
• Household composition is frozen during Grace and Suspended states. The employee may not add a spouse or dependent until the account returns to Active state. This protects the employee from incurring household-driven charges they cannot consent to while their sub-billing relationship is in flux.

The Controller acknowledges that it has no surviving rights in or to the employee's data, household members, or account configuration following termination of sponsorship.

8. International Data Transfers

All data is processed and stored in the United States (AWS us-east-1 region), and the Services are offered only in the United States. The Controller must be a United States entity, and only employees who are United States residents are eligible to be enrolled — account registration from outside the United States is refused at signup. Fingro therefore does not act as a data importer for personal data transferred out of the European Economic Area, the United Kingdom, or Switzerland, and no such transfer mechanism is required. Should Fingro ever offer the Services outside the United States, this Section will be amended and the appropriate transfer mechanism executed before any such processing begins.

9. Audits

9.1 Right to Audit

The Controller may, at its own expense, conduct or commission an audit of Fingro's data processing activities no more than once per 12-month period, with at least 30 days' prior written notice.

9.2 Audit Scope

Audits shall be limited to:

• Verification of compliance with this DPA
• Review of security measures
• Review of sub-processor management

Audits shall NOT include access to:

• Individual employee Fingro accounts or data
• Fingro's proprietary algorithms, AI models, or source code
• Data of other Fingro customers

9.3 Audit Reports

As an alternative to on-site audits, Fingro will provide on written request:

• A current security questionnaire response (SIG Lite, CAIQ, or custom)
• A current architecture diagram showing data flow, isolation boundaries, and encryption at rest and in transit
• The list of sub-processors and the DPA we have signed with each
• A summary of the most recent third-party security assessment, if any has been completed
• Our incident-notification commitments and the most recent test of our incident response procedures

The following will be provided when each has been completed and is in our possession (not before):

• SOC 2 Type I report (targeted: second half of first production year)
• SOC 2 Type II report (targeted: within twelve months of go-live)
• Penetration test summary report (targeted: prior to SOC 2 Type I attestation)

Fingro will not represent that it holds a certification or report it has not yet received. If a Controller's procurement process requires a current SOC 2 Type II report or a pentest report as a pre-condition of signature, Fingro will disclose its current status in writing before the Controller signs.

10. Term and Termination

10.1 Term

This DPA remains in effect for the duration of the service agreement between the Controller and Fingro.

10.2 Termination

Either party may terminate this DPA with 90 days' written notice. Upon termination:

1. Fingro will cease processing employer-provided data within 30 days
2. Employee accounts transition to personal subscriptions (no data loss)
3. Employer-provided data (eligibility lists) will be deleted within 30 days
4. Final aggregate participation report will be delivered to the Controller
5. Employees will be notified of the transition with at least 30 days' notice

10.3 Data Deletion Certification

Upon request, Fingro will provide written certification that employer-provided data has been deleted, within 30 days of deletion.

11. Liability

11.1 Limitation

Except for liabilities that cannot be limited by law (including liability arising from gross negligence, willful misconduct, or breach of confidentiality), each party's liability under this DPA is subject to the exclusions and limitations of liability set forth in the underlying service agreement (MSA) between the parties, including any uncapped carve-out for material breach of data-protection obligations.

11.2 Mutual Indemnification

Each party shall defend, indemnify, and hold harmless the other party (and its officers, directors, and employees) from and against any third-party claim, action, or proceeding, and any losses, damages, costs, or expenses (including reasonable attorneys' fees) arising from or in connection with:

• the indemnifying party's material breach of this DPA;
• the indemnifying party's violation of applicable data-protection law in performing its obligations under this DPA; or
• the indemnifying party's gross negligence or willful misconduct.

The indemnified party will: (a) promptly notify the indemnifying party of the claim; (b) tender sole control of the defense and settlement (provided that any settlement that imposes a non-monetary obligation on, or admits liability of, the indemnified party requires the indemnified party's written consent); and (c) provide reasonable cooperation in the defense at the indemnifying party's expense.

12. Governing Law

This DPA is governed by the laws of the State of Delaware, without regard to conflict of law principles.

13. Contact

Fingro AI, Inc. 7750 St Marlo Country Club Pkwy Duluth, GA 30097 United States

• DPA inquiries: legal@fingro.ai
• Data protection contact: privacy@fingro.ai
• Security incidents: security@fingro.ai

Signatures

Appendix A: Standard Contractual Clauses

Not currently applicable. The Services are offered only in the United States to United States residents (see Section 8), so Fingro does not process the personal data of data subjects located in the European Economic Area, the United Kingdom, or Switzerland, and the Standard Contractual Clauses are not engaged. This Appendix is retained so that, if Fingro ever offers the Services outside the United States, the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 2: Controller to Processor) would be incorporated by reference into this DPA on the terms set out below — executed before any such processing begins, never retroactively.

The parties agree that:

• Data exporter: The Controller (Employer)
• Data importer: The Processor (Fingro AI, Inc.)
• Categories of data subjects: Employees of the Controller
• Categories of personal data: Name, work email, employment status
• Sensitive data: None transferred under this DPA
• Frequency of transfer: Upon employee onboarding and employment status changes
• Nature of processing: Account provisioning and eligibility management
• Purpose: Providing financial wellness services to employees
• Retention period: Duration of employment + 30 days
• Sub-processor transfers: As listed in Section 4.1

This Data Processing Agreement reflects Fingro's commitment to protecting employee privacy while enabling employers to offer meaningful financial wellness benefits.