Pyro

Back to Pyro ◐ Theme

Data Processing Agreement

What changed in 1.6

• AI reading is processed inside the EU. Pyro reads through Google Vertex

AI on Google's EU multi-region endpoint, under Google Cloud's data processing terms (8.2, 8.3). The Gemini API is now only a fallback that is not in use, and AI reading no longer leaves the EU (section 10). Customers no longer have AI keys of their own, so none are stored (section 9).

• Cost records. Pyro records each call to the AI subprocessor — firm,

Client and document identifiers, kind of call, token counts and cost in euros — and keeps these records 400 days (5, 13). Each Vertex AI request carries billing labels naming only an opaque firm identifier and the kind of call (8.3).

• Replaced the former 10.4 (asking Pyro to restrict a firm to

locally-processed extraction to reduce cross-border AI processing): AI reading no longer leaves the EU, and 10.4 now covers the unused Gemini API fallback.

---

Before you read this

This DPA explains what Pyro does with personal data that reaches it through your use of the service, and what Pyro promises you about it. It is written to be readable. Where a term has a specific legal meaning under the GDPR, that meaning applies.

This DPA forms part of, and is subject to, the Pyro Terms and Conditions (the Agreement). If this DPA and the Agreement conflict on the subject of personal data, this DPA wins.

---

1. Parties

Processor: Trevor St. John, an individual trading as "Pyro" Based in Malta. Postal address available on request. Contact for data protection matters: support@pyroplatform.com

Customer: the accounting firm, business or other organisation that has accepted this DPA through the Pyro application, as identified by the firm record and the accepting user recorded at the time of acceptance.

Together, the Parties.

---

2. Definitions

Terms not defined here have the meaning given in the GDPR.

---

3. Roles of the Parties

3.1 In respect of Personal Data, Customer is the controller (or, where Customer is itself acting as a processor for its own Clients, Customer is a processor and Pyro is a subprocessor). Pyro acts as processor on Customer's behalf in either case.

3.2 Customer is responsible for establishing a lawful basis for the processing, for the accuracy and lawfulness of the Customer Data it submits, and — where Customer acts as a processor for its Clients — for having the authority from those Clients to engage Pyro as a subprocessor.

3.3 Pyro determines the means by which it delivers the service (its architecture, its choice of infrastructure providers and AI models) but does not determine the purposes of the processing. Pyro does not use Customer Data for its own purposes, other than measuring the accuracy of the service as described in section 4A.

3.4 Each Party complies with its own obligations under Applicable Data Protection Law.

---

4. Subject matter, duration, nature and purpose

Subject matter. Automated reading of invoices, bills and related accounting documents submitted by the Customer; proposing an accounting classification and VAT treatment for each line; and, where the Customer instructs it, creating draft entries in the Customer's connected Accounting System.

Duration. For as long as Customer's account is active, and thereafter only as described in section 13 (Deletion and return).

Nature of the processing. Collection, storage, structuring, analysis (including analysis by a third-party AI model — see section 8), retrieval, transmission to the Accounting System at Customer's instruction, and erasure.

Purpose. Solely to provide the service described in the Agreement, to comply with Pyro's legal obligations, and to measure and maintain the accuracy of the service as described in section 4A.

---

4A. Measuring accuracy

4A.1 To check that the service reads and codes invoices correctly, Pyro may keep a copy of a sample of invoices and bills that Customer has already posted in its connected Accounting System, together with how each one was posted (supplier or customer, amounts, accounts and VAT codes). Pyro re-reads these documents with the service and compares the result with what was posted.

4A.2 These copies are used for that comparison and nothing else. They are stored separately from Customer's uploaded documents, read only by Pyro and, for the comparison, by the AI subprocessor listed in section 8.2 under the commitments in section 8.3, never shared with anyone else, and never used to train Pyro's or anyone else's models. From the comparisons, Pyro keeps only their results (whether each field, account and VAT treatment matched), with no further copies of the invoice content.

4A.3 Customer may ask Pyro to delete these copies at any time. They are also deleted when Customer deletes the Client they belong to, and when Customer's data is deleted under section 13.2.

4A.4 Pyro also keeps counts, across all its customers, of how often each of its own methods of choosing an account or a VAT treatment was approved. These are counts only — they contain no invoice content, names, amounts or other Personal Data — and are used to decide how confident the service may be in a suggestion.

---

5. Categories of Personal Data

Pyro does not ask for special category data and the service is not designed to receive it. In practice the following Personal Data reaches Pyro:

From Authorised Users (Customer's own people)

• Email address (obtained through Xero or Zoho Books sign-in — Pyro operates no password system)
• Role within the firm, and firm membership
• Records of actions taken in the application, and who took them (audit log)
• Sign-in and security events, including the IP address each sign-in came from

From documents Customer uploads Whatever appears on the face of an invoice or bill, which typically includes:

• Names of suppliers and customers, including sole traders and individuals
• Business and sometimes residential addresses
• Email addresses and telephone numbers
• VAT registration numbers and company registration numbers
• Bank account details where printed on the document
• Line item descriptions, amounts, dates and payment references

From a connected Accounting System

• Contact records (supplier and customer names and details; in Zoho Books,

vendors and customers)

• Chart of accounts, tax rates and organisation settings
• Invoices and bills read for context

Generated by the service

• A cost record for each call to the AI subprocessor: the identifiers of the

firm, Client and document it was made for, the kind of call (for example reading or coding), the number of tokens used and its cost in euros. These records hold identifiers and figures only — no document content and no names — and are deleted automatically after 400 days.

Categories of data subject: Customer's Authorised Users; Customer's Clients; and the suppliers, customers, employees and representatives of those Clients whose details appear on processed documents.

Note: because the personal data arrives inside accounting documents rather than through structured fields, Pyro cannot fully predict or control what a given document contains. Customer should not upload documents containing special category data (health, biometric, political, religious or similar) or criminal offence data, as the service is not designed for it.

---

6. Customer instructions

6.1 Pyro processes Personal Data only on Customer's documented instructions. The Agreement, this DPA, and Customer's use of the application's own features together constitute those instructions.

6.2 Pyro will tell Customer if, in its opinion, an instruction infringes Applicable Data Protection Law, and may suspend that processing until the issue is resolved.

6.3 If Pyro is required by EU or member state law to process Personal Data beyond Customer's instructions, Pyro will inform Customer of that requirement before processing, unless the law forbids it on important grounds of public interest.

6.4 What Pyro does in the Accounting System. On Customer's instruction Pyro creates draft bills, sales invoices and credit notes, attaches the source document to them, and — only when an Authorised User asks it to — adds a new account to the chart of accounts. Saving a draft for a supplier or customer not yet in the Accounting System's contacts creates that contact. Pyro never approves, authorises, pays, voids or deletes anything in the Accounting System. In Xero it requests only the permissions offline_access, accounting.invoices, accounting.contacts, accounting.settings and accounting.attachments; in Zoho Books it requests no delete or payment permissions.

---

7. Confidentiality and personnel

7.1 Pyro keeps Personal Data confidential and does not disclose it except as this DPA allows, or where legally compelled.

7.2 Pyro is currently operated by a single individual. Access to production systems is limited to that individual. Any person Pyro later gives access to Personal Data will be bound by written confidentiality obligations and given access only to the extent needed.

7.3 Pyro does not sell Customer Data, does not share it for advertising, and does not use it to train its own or anyone else's models.

7.4 Pyro's own access. Pyro's administrators can see account-level information across customers — firm names, Authorised Users' email addresses and roles, Client names and connection status, and usage, AI cost and billing figures — to operate and support the service. They can open Customer's documents and Customer Data only in a support session, and a support session can be started only while Customer's firm owner has allowed support access. The owner allows it for 24 hours at a time and can revoke it at any moment, which ends it at once. The owner is emailed when a support session starts, and every session and everything opened in it is recorded in a support access log the owner can see. Every change an administrator makes is recorded in the security log, naming the administrator.

---

8. Subprocessors

8.1 Customer generally authorises Pyro to engage the Subprocessors listed below. Pyro remains fully liable to Customer for their performance.

8.2 Current Subprocessors

No other AI provider receives Customer Data. Google is the only one.

8.3 AI subprocessor commitments — Google. Pyro sends Customer Data to Google in the following way:

• Google Vertex AI, inside the EU — how Pyro reads today. Pyro sends

Customer Data to Vertex AI through Google's EU multi-region endpoint (aiplatform.eu.rep.googleapis.com, location eu), which keeps the processing inside the EU, under Google Cloud's terms and data processing addendum. Pyro's software accepts only Google Cloud locations inside the EU (the EU multi-region, or a single Google Cloud region in an EU member state), and if the Vertex AI setup is incomplete or fails it refuses the request rather than send it to the Gemini API. Vertex AI is a billed Google Cloud service, and under Google Cloud's terms Google does not use Customer Data to train or fine-tune its AI models without Pyro's permission or instruction, which Pyro has not given. Each request carries two billing labels, so that Google's bill can be split by firm: Pyro's opaque identifier for the firm (a random identifier, not its name) and the kind of call (for example reading or coding). The labels contain no names and no document content.

• The Gemini API (generativelanguage.googleapis.com) — **a fallback, not

in use. Pyro's software uses it only when Vertex AI is not configured at all, which is not the case in production, and only on Google's paid** service: Pyro refuses to send Customer Data on a Google key that is not confirmed as billed, because Google's free tier is not covered by the same terms. Under the Gemini API Additional Terms of Service, Google does not use prompts or responses submitted through its Paid Services to improve its products, and does not train its models on them. Google does not publish a fixed number of days for how long it retains this content — its terms state only that prompts and responses are logged "for a limited period of time", solely to detect and prevent abuse — and content may be processed or cached "in any country in which Google or its agents maintain facilities", so it may be processed outside the EU (section 10). Pyro will notify Customer by email before moving reading to the Gemini API.

Customers do not supply AI keys of their own: every call is made with Pyro's own Google Cloud credentials.

Pyro does not currently hold a zero-data-retention arrangement with Google. Pyro does not claim that Google stores nothing.

Resolved, 2026-09-01. When the fallback is used, Pyro calls the Gemini API directly (generativelanguage.googleapis.com), which is governed by the Gemini API Additional Terms of Service (ai.google.dev/gemini-api/terms), not Google Cloud Platform's general terms — the Cloud DPA at cloud.google.com/terms/data-processing-addendum does not list the Gemini API among its covered services, so it does not apply there. The Gemini API Terms incorporate its own DPA (business.safety.google/processorterms) automatically by use — no separate signature or console toggle to complete, as confirmed against Google's own published terms. Vertex AI, which is how Pyro reads today, is a Google Cloud service and is covered by the Cloud DPA.

8.4 Changes. Pyro will give Customer at least 30 days' notice before adding or replacing a Subprocessor, by email to the firm owner and by updating the published subprocessor list. Customer may object on reasonable data protection grounds within that period. If the Parties cannot resolve the objection, Customer may terminate the Agreement for the affected service without penalty, and receive a pro-rata refund of prepaid fees.

8.5 Xero and Zoho Books are not Subprocessors. Each is the Customer's (or its Client's) own accounting system, under the Customer's own separate agreement with Xero or with Zoho. Pyro reads from and writes to it only at Customer's instruction, using a connection Customer authorises. Pyro is not sending Customer's data to a third party of Pyro's choosing when it sends a draft to the Accounting System — it is returning data to Customer's own system.

⚠️ LAWYER REVIEW. The characterisation in 8.5 is reasonable but arguable; a cautious adviser might prefer to list Xero and Zoho as subprocessors anyway. Have this checked.

8.6 Public registers. To check a supplier's details, Pyro may look up a VAT number in the European Commission's public VIES register, or a company name in the public GLEIF legal-entity register. Only that number or name is sent. These are public lookups, not Subprocessors.

---

9. Security measures

Pyro maintains the following technical and organisational measures. This list describes what is actually implemented — it is not aspirational.

Encryption

• All traffic to and from the application is encrypted in transit (TLS).
• Data at rest in the database and file storage is encrypted (AES-256, managed

by the underlying cloud provider).

• Xero and Zoho Books connection tokens are additionally encrypted at the

application layer using AES-256-GCM before being written to the database, so they are not readable from the database alone. Pyro stores no AI provider keys for Customers.

• Nightly database backups are encrypted before they leave Pyro's systems; the

passphrase is held as an encrypted secret used only by the backup job, never alongside the backups.

Access control

• Authentication is delegated to Xero or Zoho (OpenID Connect), and Pyro

verifies each sign-in token's signature, issuer, audience and expiry. Pyro operates no password system and stores no passwords; nobody, including Pyro's administrators, signs in with a password.

• The signed-in session is held in secure, HttpOnly cookies that page scripts

cannot read, and every request authenticated by cookie must also prove it came from Pyro's own page.

• Database-level row security is enabled on every application table with no

permitting policies, so that only the server's privileged service credential can read or write. A leaked public API key yields no data.

• Separation between firms, and between users and the clients assigned to them,

is enforced in application code on every request.

• The privileged database credential exists only as an environment variable in

the hosting platform and is not present in the source code.

• Pyro support reaches Customer Data only as described in 7.4.

Logging and monitoring

• Security-relevant events (sign-ins with their IP address, Xero and Zoho

Books connect/disconnect, administrative changes, support access, wallet adjustments) are written to a log that the application only ever adds to.

• A per-document audit trail records each action taken on each invoice and who

took it.

• Both logs are kept for 13 months and then deleted automatically.

Data minimisation

• Only the content needed to read and code a document is sent to the AI

subprocessor. Pyro does not transmit its wider database to it. The billing labels on each request carry only an opaque firm identifier and the kind of call.

• The cost record kept for each AI call holds identifiers and figures only,

never document content, and is deleted after 400 days.

• Invoices matching a previously learned supplier layout are read on Pyro's own

servers; the document itself is not sent to the AI subprocessor, although the details read from it may be sent to suggest coding.

What Pyro does NOT currently claim Pyro is transparent about the limits of its current programme. Pyro does not hold ISO 27001 certification, has not completed a SOC 2 audit, has not undergone an independent penetration test, and does not operate a 24/7 staffed security team. Pyro is a small operation and says so rather than implying otherwise.

---

10. International transfers

10.1 Customer Data is stored in the European Union (Paris, France), and Pyro's application runs in the same region.

10.2 AI reading does not transfer Personal Data outside the EU. Pyro reads through Vertex AI on Google's EU multi-region endpoint, which keeps that processing inside the EU (8.3). Personal Data is transferred to the United States in connection with hosting (Vercel, a US company, although Pyro's application runs in its Paris region), payments (Stripe), email (Resend) and encrypted backups (GitHub).

10.3 These transfers rely on the Standard Contractual Clauses approved by the European Commission, incorporated into each Subprocessor's data processing terms. Pyro will provide evidence of the terms on request.

10.4 If reading ever moved to the Gemini API fallback (8.3), which Pyro will notify Customer of beforehand, Personal Data sent for reading could be transferred outside the EEA, not confined to the United States or any other single country, under the Standard Contractual Clauses incorporated in Google's terms for that service (see the resolution note at 8.3).

---

11. Personal data breaches

11.1 Pyro will notify Customer without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting Customer's Personal Data.

11.2 The notification will describe, so far as known: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point.

11.3 Pyro will provide reasonable assistance to Customer in meeting Customer's own notification duties to a supervisory authority or to data subjects.

11.4 Notification is not an admission of fault by either Party.

---

12. Assisting Customer

12.1 Data subject rights. Where a data subject contacts Pyro directly, Pyro will not respond substantively but will forward the request to Customer without undue delay. Pyro will assist Customer in responding to requests for access, rectification, erasure, restriction, portability and objection, using the application's own functions where possible.

12.2 DPIAs and consultation. Taking into account the nature of the processing and the information available to it, Pyro will provide reasonable assistance to Customer with data protection impact assessments and any prior consultation with a supervisory authority.

12.3 Pyro may charge a reasonable fee for assistance that is disproportionate or repetitive, having first told Customer and given Customer the chance to withdraw the request.

---

13. Deletion and return

13.1 On request during the term. Customer may delete a Client at any time from within the application. This removes everything Pyro holds keyed to that Client — the stored document files, the extracted data, the learned coding, history, contacts, supplier templates and notes, and any copies kept under section 4A — except the audit log entries recording what was done, which are kept for up to 13 months (section 9) and then deleted; Customer's billing record of what each invoice cost, which is kept with Customer's account until it is deleted under 13.2; and the cost records described in section 5, which hold identifiers and figures only and are deleted after 400 days.

13.2 On termination. Pyro deletes Customer's Personal Data 30 days after Customer's subscription ends, unless Customer asks in writing before then for it to be returned, in which case Pyro will provide it in a commonly used electronic format before deleting. A firm owner can also export the firm's data from the application. The audit and security logs (section 9) and the cost records (section 5) are not deleted early on termination; they are deleted on their own schedules of 13 months and 400 days.

13.3 Backups. Data deleted from the live system persists in Pyro's encrypted nightly backups for up to 14 days, after which each backup is deleted. Backups are not otherwise processed and are used only to restore the service.

13.4 Legal retention. Pyro may retain Personal Data where required by law, and will tell Customer what it is retaining and why.

13.5 Automatic retention, set by Customer. Customer may set a retention period in the application, after which Pyro automatically deletes the stored source documents it uploaded. A daily job carries this out. Only the source file is deleted; the extracted accounting record — supplier, amounts, VAT treatment, coding — is kept, because that is Customer's own accounting data and the same source file is already attached to the corresponding draft in Customer's Accounting System.

13.6 The starting retention period is 90 days, and Customer decides. A firm created on or after 15 October 2026 starts with a retention period of 90 days for stored source documents. Customer can change it at any time to any period of 30 days or more, or remove it so that documents are kept until deleted under 13.1 or 13.2. A firm that existed before keeps the setting it had; where none was set, no retention period is set by default and documents are kept until deleted under 13.1 or 13.2. Pyro does not otherwise choose a deletion policy on Customer's behalf: Customer is the controller, only Customer knows its own statutory retention obligations, and deleting a firm's records on an assumption would be a worse failure than keeping them. The shortest period Pyro accepts is 30 days.

---

14. Audits and information

14.1 Pyro will make available to Customer the information reasonably necessary to demonstrate compliance with this DPA, including this document, its subprocessor list, and its internal data-hosting and incident-response statements.

14.2 Customer may, no more than once in any 12 months and on 30 days' written notice, request additional written information or a remote interview with the person operating Pyro. This is the realistic form of audit for an operation of Pyro's size; Pyro does not offer on-site inspection of its infrastructure providers, whose own audit reports Customer may request directly from them.

14.3 A supervisory authority's statutory audit powers are unaffected by 14.2.

---

15. Liability

15.1 Each Party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement.

15.2 Nothing in this DPA limits either Party's liability to a data subject under Article 82 GDPR, or any liability that cannot lawfully be limited.

⚠️ LAWYER REVIEW. Because Pyro is currently an individual rather than a limited company, liability under this DPA is personal and unlimited except as the Agreement limits it. This is a significant commercial exposure and should be reviewed before the DPA is offered to customers.

---

16. Term

This DPA takes effect when Customer accepts it and continues for as long as Pyro processes Personal Data on Customer's behalf. Sections that by their nature should survive termination (confidentiality, deletion, liability) do so.

Until a firm owner has accepted the current version of this DPA, Pyro's service refuses to upload, read, post, sync, connect or export that firm's Client data. Deleting data, disconnecting an Accounting System and leaving always remain possible.

---

17. Governing law

This DPA is governed by the laws of Malta, and the courts of Malta have exclusive jurisdiction, without prejudice to any mandatory rights a data subject has to bring proceedings elsewhere.

---

18. Contact

Data protection questions, data subject requests forwarded by Customer, and breach correspondence:

support@pyroplatform.com Trevor St. John, trading as Pyro Malta · postal address available on request

Customer may also complain to the Maltese supervisory authority, the Office of the Information and Data Protection Commissioner (IDPC), https://idpc.org.mt.

---

Annex — Processing summary (GDPR Article 28(3))

---

Pyro DPA v1.6 — effective 16 October 2026. Superseded versions are retained and available on request.