← Back to the homepage
Data Processing Addendum
1. Agreement, scope and precedence
This Data Processing Addendum (DPA) forms part of the Advisor Terms of Service or other written agreement under which PsycFin Pty Ltd provides Saywell to the advisor firm identified at signup or checkout (Agreement). It applies when PsycFin processes Customer Personal Data for the Customer in providing Saywell.
The DPA becomes binding when the Customer accepts the Agreement or otherwise agrees to this DPA through the recorded signup, checkout or order process. It continues while PsycFin processes Customer Personal Data for the Customer, including during export, deletion or a lawful restricted hold.
If this DPA conflicts with the Agreement about processing Customer Personal Data, this DPA prevails. The Agreement governs commercial matters, liability, consumer-law rights, governing law and disputes unless this DPA expressly states otherwise. The Privacy Policy explains PsycFin’s wider privacy practices but does not reduce this DPA.
2. Definitions
| Applicable Data Protection Law | a privacy, data-protection, data-breach or direct-marketing law that applies to the relevant party, person, information or processing. Use of this defined term does not state that any particular US state law applies. |
|---|
| Customer Personal Data | personal information or personal data contained in Customer Content that PsycFin processes for the Customer under the Agreement. It includes Client Data and authorised-user data. PsycFin may process limited copies or related metadata independently for its own account administration, billing, security, fraud prevention or legal-compliance purposes. |
|---|
| Client Data | Customer Personal Data relating to an advisor client or prospective advisor client, including supplied correspondence, notes, assessments, profiles, drafting inputs and drafts. |
|---|
| De-identified Information | information processed so that it cannot reasonably identify an individual or Customer, having regard to the available data and controls. It does not include merely pseudonymised Customer Personal Data. |
|---|
| Individual | a person to whom personal information relates, including an advisor client or assessment-taker. |
|---|
| Restricted Hold | a controlled state in which specified information is unavailable for drafting, account calibration and cross-customer learning and may be used only for the documented legal, regulatory or dispute purpose supporting the hold. |
|---|
| Security Incident | a confirmed breach of security resulting in accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data in systems controlled by PsycFin or a Subprocessor. It does not include unsuccessful attempts that do not compromise Customer Personal Data. |
|---|
| Sensitive Information | information treated as sensitive, special-category or similarly protected under Applicable Data Protection Law, including health information where that law applies. |
|---|
| Subprocessor | a third party engaged by PsycFin to process Customer Personal Data in providing Saywell. |
|---|
3. Roles, instructions and processing limits
3.1 Customer and PsycFin roles
The Customer determines why Client Data is used in its advisory practice, what information is entered and what drafts are reviewed or sent. For Customer Personal Data, PsycFin acts on the Customer’s documented instructions to provide the Service. The parties use controller, business, processor, service-provider or contractor terminology only where Applicable Data Protection Law gives those terms legal effect.
PsycFin acts independently for limited purposes described in the Privacy Policy, including its own account records, billing, security, fraud prevention, legal compliance, privacy administration and standalone assessments with no advisor relationship. Those activities remain subject to Applicable Data Protection Law but are outside the Customer’s processing instructions.
3.2 Documented instructions
The Agreement, this DPA, the Customer’s use of Saywell and lawful support directions are the Customer’s documented instructions. They authorise PsycFin to collect, host, organise, retrieve, use, transmit, generate, return, de-identify and delete Customer Personal Data only as reasonably necessary to:
provide, secure, maintain and support Saywell;
create drafts, reports, communication profiles and related account records;
perform private per-account drafting and calibration;
send advisor-triggered assessment invitations, reports and service notices;
provide exports, handle requests and execute retention or deletion;
produce De-identified Information for cross-customer improvement, subject to the gates and opt-outs in section 7; and
comply with a binding legal requirement and protect the security or lawful operation of the Service.
PsycFin must notify the Customer if it reasonably believes an instruction infringes Applicable Data Protection Law, unless law prohibits notice. PsycFin may suspend only the affected processing while the parties resolve the issue.
3.3 Prohibited secondary uses
PsycFin must not sell Customer Personal Data, use it for targeted advertising, permit it to train a third party’s general-purpose artificial-intelligence model, or retain, use or disclose it outside the instructions and limited independent purposes stated above. PsycFin must not combine identifiable Customer Personal Data with another customer’s information, except where needed for security or legal compliance or after the information has genuinely become De-identified Information under section 7.
PsycFin certifies that it understands and will comply with these restrictions. It must notify the Customer if it determines that it can no longer comply. The Customer may take reasonable and proportionate steps through section 15 to verify compliance and require PsycFin to stop and remediate an unauthorised use.
4. Customer responsibilities
4.1 Authority, accuracy and lawful instructions
The Customer warrants that it has the authority, notices, permissions and other legal basis needed to provide Customer Personal Data and instruct its processing. The Customer is responsible for the lawfulness and accuracy of its instructions, the information it supplies and its own use of outputs. PsycFin is not required to determine the Customer’s professional recordkeeping, disclosure or client-consent obligations.
4.2 Client privacy notices
For Australian clients, the Customer must provide the plain-language Saywell notice in Schedule 3 before, or as soon as reasonably practicable after, first entering the client’s information. The primary path is to incorporate that wording into the firm’s existing privacy notice and collection statements. The Customer may instead provide it separately. At onboarding, the Customer must confirm that notice is or will be provided and must keep an appropriate record.
Notice may be omitted only where law prohibits it or where the parties document why notice would be unreasonable or impracticable in the circumstances. For US clients, the Customer must provide the notices required by Applicable Data Protection Law and warrants that its notices adequately cover providers such as PsycFin. This DPA does not impose a separate Saywell notice on a US firm whose existing notice is adequate.
For an advisor-linked assessment, the Customer must use the Saywell process that identifies the advisor and asks the assessment-taker to confirm sharing before the profile and report become available to the Customer. Assessment emails may record delivery and bounce events but must not use tracking pixels or per-recipient tracked links.
4.3 Sensitive and prohibited information
The Customer may provide Sensitive Information only where it is genuinely necessary for the requested communication. An Australian Customer warrants that it has obtained any required consent or holds another lawful authority. A US Customer warrants that it has a lawful basis under Applicable Data Protection Law. Sensitive Information may be used only for the requested Service and private account-level drafting and calibration.
The Customer must not enter government identifiers, authentication credentials, financial account numbers, payment credentials, full dates of birth in free text, detailed holdings or transaction records that are unnecessary for the communication, or unnecessary sensitive information. Government identifiers, authentication credentials, financial account numbers and payment credentials remain prohibited even if an individual consents. Saywell does not promise to detect, redact or prevent prohibited or sensitive information entered in supplied free text.
4.4 Adults and permitted markets
The Customer must not create or profile a Saywell client record for a person under 18. It must use Saywell only for the permitted US and Australian firm and client markets stated in the Agreement and must not enter information about a person in the United Kingdom, European Union or European Economic Area.
5. PsycFin personnel and confidentiality
PsycFin must limit access to Customer Personal Data to people who need it for an authorised purpose, are subject to appropriate confidentiality duties and receive instructions appropriate to their role. At v1, the founder is the sole production administrator and may access production data for support, security, request handling and service operation.
PsycFin must maintain an access register, use individual administrative accounts, require multi-factor authentication for administrative systems, review administrative access records regularly and remove access when no longer needed. Advisor-facing multi-factor authentication becomes a Service control only when verified as live.
Confidentiality obligations survive termination for as long as the information remains confidential. They do not prevent a disclosure required by law, subject to section 14.
6. AI processing and reduced transmission
PsycFin uses an Anthropic Claude model through Anthropic’s commercial API to produce drafts and reports. PsycFin does not commit to a model version in this DPA. A production model is adopted only after a documented checkpoint verifies retention eligibility, current output-watermarking status and other relevant provider characteristics and the model passes PsycFin’s quality-verification suite. A model change requires privacy re-verification.
Before an AI request is transmitted, Saywell deterministically replaces the client’s stored name and email address with neutral placeholders and replaces stored advisor and firm identifiers where they are not needed. Necessary names are restored locally after the draft returns. Full dates of birth, account identifiers and raw assessment answers are excluded from AI prompts.
This reduces directly identifiable information but is not comprehensive free-text redaction. Supplied notes and correspondence may contain incidental names, nicknames, third-party details, personal information or Sensitive Information. The Customer authorises Anthropic to process relevant supplied content for the requested output, subject to this DPA and Anthropic’s verified commercial terms.
Under the standard commercial API position used for the base DPA, Anthropic inputs and outputs are automatically deleted from its backend within 30 days of receipt or generation. Longer retention may apply where required for usage-policy enforcement, law or a feature with different retention. Commercial API content is not used to train Anthropic’s general models by default. Limited provider-personnel access may occur for safety, abuse investigation, support or legal compliance under Anthropic’s terms.
7. Calibration, de-identification and learning opt-outs
7.1 Private account calibration
PsycFin may use the Customer’s voice samples, edits, approvals, regenerations and Customer Personal Data to adapt outputs within that Customer’s account. This per-account calibration is part of the Service, remains tenant-separated and continues despite a firm-level or individual cross-customer learning opt-out.
7.2 Cross-customer improvement gate
After beta, PsycFin may extract De-identified Information from approved sources to improve Saywell across customers. Approved sources exclude advisor writing samples and derived voice profiles, which are used only for private account calibration. De-identification must occur before information enters the separate learning dataset. PsycFin must not attempt re-identification and must maintain an extraction audit trail recording the method version.
Sensitive Information must never enter the learning dataset in identifiable form. No communication content may enter until a written de-identification specification expressly addresses removal or generalisation of sensitive content and free-text identifiers and has passed production-representative testing. Assessment data must use coarse categories and a minimum group-size rule that automatically generalises any combination describing fewer than ten people.
7.3 Firm and individual opt-outs
The Customer may opt the firm out of future cross-customer learning. An individual client or assessment-taker may separately opt out their own future information. PsycFin records the applicable flag and effective timestamp and excludes information generated after that timestamp from later extraction.
Each opt-out is forward-only and corpus-only. Contributions already incorporated into genuinely de-identified aggregates cannot be isolated or withdrawn. An individual opt-out does not opt out the firm or another person and does not prevent the Customer’s ordinary use of that individual’s information within its account, including drafting and private calibration.
8. Security measures and resilience
PsycFin must implement and maintain the administrative, technical and organisational measures in Schedule 2, taking account of the nature, scope, context and purpose of processing and the risks to individuals. PsycFin may update a measure where the change does not materially reduce the overall protection of Customer Personal Data.
PsycFin must test tenant isolation, deletion, backup restoration and logging hygiene before publication and retain short dated results. Recovery objectives are best-effort operational targets, not service-level guarantees: recovery point objective 24 hours and recovery time objective one business day.
The Customer remains responsible for securing its own devices, accounts, identity systems, exports and final communications and for promptly reporting suspected credential or account compromise.
9. Security Incidents
9.1 Notice to the Customer
PsycFin must notify the affected Customer without undue delay and no later than 72 hours after becoming aware of a Security Incident involving that Customer’s information. The 72-hour period is not extended to complete an investigation. The initial notice must provide the facts then known, including the nature of the incident, affected information categories, actions under way and a response contact. PsycFin must provide material updates as the investigation develops.
PsycFin must take reasonable steps to contain, investigate, mitigate and remediate the Security Incident, preserve relevant evidence and cooperate with the Customer’s assessment and legally required notifications. Notice is not an admission of fault or liability.
9.2 Notification responsibilities
The Customer ordinarily leads notification to its affected clients. PsycFin retains the right and, where applicable, the obligation to notify individuals or regulators directly where law requires, where the Customer fails to act when legally necessary or where delay would materially increase the risk of harm. Where both parties must notify, they must coordinate accurate and consistent communications where practicable.
For a breach involving a standalone assessment-taker with no advisor relationship — information PsycFin controls independently, outside the Security Incident definition — PsycFin notifies affected individuals directly under the same 72-hour discipline.
10. Individual requests and assistance
10.1 Request channel and timing
PsycFin maintains a single documented channel, verification procedure and request register for access, correction, export, deletion and learning opt-out requests. PsycFin must provide reasonable assistance so the Customer can meet its obligations and must complete PsycFin’s applicable operational steps within 35 days, or sooner where Applicable Data Protection Law or the Customer’s notified lawful deadline requires.
PsycFin normally coordinates a request relating to Customer Personal Data with the Customer. It may act independently where law requires, for information PsycFin controls independently, for a standalone assessment-taker with no advisor relationship, or where coordination would itself risk harm to the requester. Coordination must disclose only what is reasonably necessary for the request.
10.2 Access and export
A verified assessment-taker may receive their own raw assessment responses in legible question-and-answer form, together with their communication profile and report, subject to a lawful exception. Raw assessment responses must never be disclosed to the Customer. A Customer export contains only information the Customer is entitled to see and excludes raw assessment responses.
10.3 Correction and disputed information
Verified factual errors are corrected directly. PsycFin must review and correct or delete system-generated inferences that are inaccurate, outdated, incomplete or misleading. If the disputed profile was measured from the person’s own assessment, the primary remedy is a fresh assessment that replaces the profile in full; PsycFin does not manually edit a measured result.
Advisor-authored notes and estimates are referred to the Customer. If the Customer declines to amend them, PsycFin must attach the individual’s correction statement or dispute notation. While a dispute is assessed, the information enters Restricted Hold and is suspended from drafting, calibration and cross-customer learning. Drafting may continue using an undisputed advisor estimate or neutral defaults. Original values and correction history may remain only in a restricted audit record where needed to explain the change.
10.4 Client deletion and Customer retention instruction
When a client requests deletion of Customer-held records, PsycFin notifies the Customer. The Customer has 14 days to provide a specific, documented instruction identifying the information to retain and its legal or regulatory basis. Without a valid instruction within 14 days, PsycFin proceeds with deletion on the standard schedule.
If PsycFin accepts an instruction, it deletes everything outside its scope. Covered information enters Restricted Hold, is used only for the stated retention purpose and has the basis and expected deletion date recorded. PsycFin tells the client the categories retained and reason unless law prohibits disclosure. A vague instruction to retain everything for compliance is returned for specificity. PsycFin assesses independently controlled information under its own obligations and does not retain it merely because the Customer objects.
11. Retention, export, deletion and inactivity
11.1 During and after the subscription
Category-specific retention periods appear in the Privacy Policy and Schedule 1. After cancellation, the Customer has a 90-day window to request or complete the available manual export. PsycFin then deletes Customer Personal Data across active systems and managed backup expiry within 35 days, except for a specific Restricted Hold required by law. This commitment applies to systems PsycFin controls and its managed backups; limited provider-side retention described in section 6, such as safety-flagged content held by the AI provider under its terms, expires under the provider’s arrangement and is disclosed rather than promised. Deletion is true deletion of identifiable content; a redacted audit skeleton may retain only non-identifying event type and timestamp information needed to evidence the action.
11.2 Advisor-linked client inactivity
A client record is not automatically deleted at three years. After three years without drafting, correspondence, an assessment, a profile update or other meaningful client activity, PsycFin asks the Customer to confirm the relationship. Confirmation restarts the cycle. If the Customer marks the record inactive, it enters the 90-day export window and is deleted within the following 35-day period.
If the Customer does not respond after two notices over 60 days, the record enters Restricted Hold and a final 30-day notice is given before export and deletion begin. A client’s own deletion request takes priority under section 10.4. Records lawfully required to be retained follow the Restricted Hold procedure.
11.3 Standalone assessments
As PsycFin’s independent commitment stated in the Privacy Policy and noted here for completeness, PsycFin deletes identifiable assessment responses, profile, report and contact details for a person with no advisor relationship after 18 months without meaningful activity, or earlier on request. Meaningful activity means opening the report, engaging with a reminder email, making a request or linking to an advisor. PsycFin sends a reminder at about 12 months and a final notice about 30 days before deletion, with a one-click option to retain the information for another cycle. Deletion at the 18-month point is completed within the standard 35-day window. Linking to an advisor switches the record to advisor-account retention.
11.4 Service discontinuation or wind-down
If Saywell is discontinued or PsycFin winds down, PsycFin gives all Customers notice, provides a 90-day export window and then deletes all Customer and client data within 35 days, and notifies standalone assessment-takers at their email of record and deletes their identifiable information on the same schedule. PsycFin thereafter retains only its own statutory financial records and any specific record that a law or court order requires to remain in Restricted Hold.
12. Subprocessors
12.1 General authorisation and current list
The Customer generally authorises PsycFin to engage the Subprocessors on the current list at saywellhq.com/subprocessors. The published list is the authoritative record and states each provider’s purpose, information categories, processing location and ability to access readable content. PsycFin must bind each Subprocessor to data-protection duties appropriate to its processing and remains responsible to the Customer for the Subprocessor’s compliance with those duties, subject to the Agreement’s lawful liability limitations.
12.2 Notice and objection
Before a new Subprocessor processes Customer Personal Data, PsycFin must update the stable list and give at least 30 days’ notice by email or recorded account notice referencing the list. A Customer objection during that period must state reasonable data-protection or regulatory grounds. The parties must first attempt to resolve the concern, including limiting the affected processing where practical.
If the concern cannot be resolved, the Customer may terminate the affected Service before the new Subprocessor begins processing, and the new Subprocessor does not process that Customer’s information before the termination takes effect. Refunds follow the Agreement’s existing mechanics: an annual subscription receives a refund for unused whole months at the effective monthly rate, while a monthly subscription ends at the close of the current period with no further charge. This clause creates no separate refund formula.
An emergency replacement required for security, service continuity or legal necessity may proceed on shorter notice, with notice as soon as reasonably practicable. A provider that does not process Customer Personal Data is outside this section.
13. International and overseas processing
The Customer authorises processing in the United States and Australia and other locations accurately stated on the current Subprocessor list. Anthropic, Supabase, Vercel, Resend and Sentry are US providers or may process in the United States; Stripe may process billing information in Australia and the United States. Google advertising services process marketing-site visitor information only and do not process Customer Personal Data under this DPA.
PsycFin must use contractual and operational measures reasonably appropriate to the provider, information and risk. A provider or foreign authority may be subject to the law of its processing location. PsycFin does not rely on a privacy-policy update as consent to a materially different overseas use.
14. Legally required disclosure
If PsycFin receives a binding demand for Customer Personal Data, it must, to the extent legally permitted, notify the Customer before disclosure, provide available information about the demand, reasonably consider a lawful challenge requested at the Customer’s expense and disclose only the information legally required. PsycFin may act without prior notice where prohibited by law or where urgent action is reasonably necessary to protect a person or the Service.
15. Information, review and compliance assistance
On reasonable request, PsycFin must provide information reasonably necessary to demonstrate compliance with this DPA, including the current Subprocessor list, relevant policy summaries and available dated verification results. Confidential security information may be supplied under appropriate confidentiality restrictions and may be redacted to protect other customers, system security and trade secrets.
The parties must first use documents, certifications and remote discussion to resolve a compliance enquiry. If Applicable Data Protection Law requires a further audit, the Customer may conduct it no more than once in 12 months, and additionally after a material Security Incident, on reasonable notice, during normal business hours, without accessing another customer’s information or unreasonably disrupting the Service. The Customer bears its audit costs unless the audit identifies a material breach by PsycFin.
PsycFin must provide reasonable assistance with privacy impact assessments, regulator enquiries and consultations relating to Saywell where required by Applicable Data Protection Law. Additional work outside ordinary DPA compliance may be charged only if agreed in advance.
16. Liability, mandatory rights and governing terms
Liability arising from this DPA is governed by the Agreement’s liability section, including its overall cap, exclusions, exceptions for fraud and wilful misconduct, non-excludable obligations and Australian Consumer Law section 64A limitation where applicable, fair and reasonable. Nothing in this DPA excludes or limits a right, remedy or liability that cannot lawfully be excluded or limited.
The Agreement’s governing-law and dispute clauses apply alongside all mandatory privacy, consumer and data-protection rights. A choice of law does not displace a law that applies mandatorily, including the Australian Consumer Law for an Australian purchaser and, after confirmed opt-in, the Privacy Act for processing within its scope.
17. Changes to this DPA
The Agreement’s change-management standard applies. PsycFin gives at least 30 days’ advance notice by recorded account email and a dated change note before materially expanding how identifiable Customer Personal Data is used or disclosed. The change applies prospectively, and an update does not itself create consent or legal authority for a different use of previously collected information.
Routine clarifications, provider-detail updates and changes that reduce processing take effect on publication with a dated note. Urgent security or legal changes may take effect sooner, with notice as soon as reasonably practicable. Subprocessor changes follow section 12. Insertion of the prepared APP provisions after confirmed registration and activation of a feature already disclosed are not material expansions.
18. Contact
PsycFin Pty Ltd
ABN 81 697 454 345
DPA, privacy and legal notices: hello@saywellhq.com
Current Subprocessor list: saywellhq.com/subprocessors
Schedule 1. Processing details
| Item | Processing details |
|---|---|
| Subject matter | Saywell account administration, advisor-voice adaptation, client communication profiling, AI-assisted draft and report generation, assessment delivery, support, security, export, request handling, retention and deletion. |
| Duration | For the subscription and the export, deletion, backup-expiry or lawful Restricted Hold periods described in this DPA. |
| Individuals | Authorised users; adult advisor clients and prospective clients; adult assessment-takers; people whose information appears incidentally in authorised correspondence; support contacts. |
| Account information | Advisor and firm names, work email, country, account settings, authentication and acceptance records, subscription and referral information, support and security events. |
| Voice and usage | Writing samples, derived voice profile, edits, approvals, regenerations and service-activity signals used for private account calibration. |
| Client information | Name, email, optional date of birth, age or age band, notes, correspondence, provenance headers, advisor estimates, profiles and communication inferences. No client phone field at v1, although incidental phone details may appear in supplied content. |
| Assessments | Responses, scores, profiles, reports, consent or notice records and delivery events. Raw responses are never shown to the advisor firm. |
| Drafting records | Inputs, correspondence, drafts, current and approved versions, advisor edits, approval and regeneration events, and client history events. Saywell does not know whether or in what form a draft is sent outside the Service. |
| Sensitive Information | May appear in advisor-supplied content only where genuinely necessary and lawfully authorised. Prohibited identifiers and credentials remain prohibited. |
| Operations | Collection, recording, organisation, storage, retrieval, consultation, transmission, AI generation, private calibration, restricted de-identification, disclosure to approved Subprocessors, export and deletion. |
| Primary locations | United States production storage and provider processing, subject to verification of exact regions; Australian founder administrative access; other locations accurately listed for an approved Subprocessor. |
| Customer export | CSV for structured records, PDF for reports and plain text for drafts and correspondence. Current and approved draft versions are included; intermediate revisions and raw assessment answers are excluded. |
Retention summary
| Category | Ordinary period | End-of-period action |
|---|---|---|
| Active account and client content | Life of active relationship, subject to requests and three-year review. | Export, Restricted Hold or deletion. |
| Standalone assessment | 18 months without meaningful activity. | Notice cycle, then deletion within 35 days. |
| Support records | Two years. | Delete unless law requires retention. |
| Application and error logs | 90 days; designed to exclude personal content. | Scheduled expiry. |
| Security and authentication logs | 12 months. | Scheduled expiry unless active investigation or law. |
| Operational analytics and email events | 12 months. | Scheduled expiry. |
| Billing and statutory financial records | Seven years or another legally required period; advisor billing only. | Delete when statutory period ends. |
| De-identified aggregate information | Indefinite. | Not re-identified for a request. |
| Backups | Managed expiry within overall 35-day deletion window. | Deleted through backup expiry. |