Data Processing Agreement

Last updated: July 13, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you (the "Controller") and ialae, operator of qbosync (the "Processor"), and applies where we process personal data on your behalf.

1. Roles

For personal data you submit to or generate through the Service, you are the Controller and ialae is the Processor. ialae processes such data only on your documented instructions and as needed to provide the Service.

2. Subject matter and purpose

The Processor provides the bank-statement conversion service described in the Terms, which may involve processing personal data contained in the statements and files you upload (for example, account holder names and transaction descriptions), plus your own account and usage data. Processing lasts for the duration of your account plus any legally required period. Converted files are stored only temporarily and then automatically deleted.

3. Sub-processors

You authorise ialae to engage sub-processors to deliver the Service. Current sub-processors include:

• ScoutVibe (scoutvibe.com) — website analytics and visitor tracking, including device fingerprinting. ScoutVibe processes end-user analytics data as a sub-processor under its own data processing terms.
• PayPal (via sensub) — subscription billing.
• OpenAI — PDF statement extraction and column-mapping suggestions for uploaded files.
• Hosting and infrastructure providers.

ialae remains responsible for its sub-processors' compliance with this DPA.

4. Security

The Processor implements appropriate technical and organisational measures to protect personal data, including hashing of IP addresses in analytics, encryption in transit, and automatic deletion of uploaded and converted files after a short retention window.

5. International transfers

Where personal data is transferred across borders, the parties rely on the Standard Contractual Clauses or another lawful transfer mechanism.

6. Assistance and data subject rights

The Processor assists the Controller, taking into account the nature of processing, in responding to data subject requests and in meeting the Controller's obligations regarding security, breach notification and data protection impact assessments.

7. Deletion and return

On termination, the Processor deletes or returns personal data at the Controller's choice, subject to legal retention requirements. The Controller may request export within 30 days of termination.

8. Contact

DPA enquiries: contact@ialae.com.