1. Project Description
(a) The Parties represent and acknowledge that they are engaged in Twine Biller (Project).
(b) The primary objective of the Project is to manage software subscriptions for clients (Objective).
(c) The Parties require access and authority to use the Data outlined in Clause 2 and Schedule 1 of the Agreement in order to achieve the Objective. The Data will assist in achieving the Objective by enabling the Parties to track, manage and rebill client software subscriptions through the Twine Biller platform.
2. Data
(a) “Data” refers to customer financial data including transaction records, invoicing information, business registration details, and related metadata collected through the cloud-based software platform. A comprehensive description of the data is attached in Schedule 1 — Data Specification.
(b) The scope of this Agreement is limited to the data described in Schedule 1 - Data Specification. For the avoidance of doubt, this Agreement does not cover access to and use of data not listed in Schedule 1, including data that might otherwise be related to the Project.
(c) The Parties represent and undertake that they have full and unqualified rights to share the Data. The Parties further represent and undertake that they will maintain full and unqualified rights to share the Data throughout the Term of this Agreement.
(d) The Parties represent and acknowledge that the Data is to be shared and used exclusively for the purposes outlined in this Agreement. Distribution and use of the Data not covered in the terms of this agreement will amount to improper and actionable use of the injured party’s data.
3. Access
The Parties agree to do all things necessary to make the Data available and accessible to the software development and engineering team, designated system administrators, database administrators responsible for data security and backup operations, and authorized technical support personnel.
4. Permitted Use
(a) The Data may only be used for the purpose of facilitating the Project. The Parties may not use the Data for any project or purpose unrelated to the Project as specified in Clause 1. For the avoidance of doubt, permitted use of the Data is outlined in detail in Schedule 1.
(b) The Parties must dispose of shared Data as soon as reasonably possible after the termination of this Agreement. The Parties may store the Data for a maximum of 7 years after the termination of this Agreement.
5. Intellectual Property
(a) Nothing in this agreement affects the ownership of intellectual property rights created before the Commencement Date.
(b) Intellectual Property created in the course of this Agreement will be governed by a separate Agreement by the Parties.
6. Confidentiality
(a) The Parties acknowledge and agree that all shared Data is private and confidential. The Parties agree to take reasonable steps to ensure only persons listed in Schedule 2 – Access List have access to the Data.
(b) The Parties acknowledge and agree that all shared Data will remain confidential even after the completion of the Term.
(c) For the avoidance of doubt, the terms of this clause survive the termination of this Agreement.
7. Data Breach Management
(a) Any unauthorised access to the Data will constitute a data breach (Data Breach) for the purposes of this Agreement. A Data Breach will include but not be limited to:
- (i) Exposure of Data to the public due to a security breach of any form, such as malware attacks, viruses, third-party hacking or phishing,
- (ii) Data loss due to security breaches,
- (iii) Unauthorised Data modification by third parties,
- (iv) Negligent data exposure, loss or modification.
(b) In the event of a Data Breach, the affected Party must immediately inform the other Party of the Breach, as well as the steps taken to remedy the Breach.
(c) The Parties reserve all rights in respect of any damage or losses arising out of a negligent Data Breach by either of the Parties to this Agreement.
Schedule 1 — Data Specification
This Schedule describes the Data shared under this Agreement for the Twine Biller Project. It is limited to data Twine Biller actually accesses or stores in the ordinary operation of the platform.
Retention. Shared Data may be retained for a maximum of 7 years after termination of this Agreement (see clause 4(b)).
Storage. Primary application Data is stored in Australia on Amazon Web Services (AWS) and MongoDB (confirmed 27 October 2026). OAuth tokens and similar credentials are held encrypted and are not reproduced in this Schedule.
Permitted use (applies to all rows below unless a row states otherwise). Rebilling of client software subscriptions; creation, sync and issue of invoices; margin calculation and related reporting; customer support and troubleshooting for the Project; and payment collection status for invoices paid via Stripe Connect.
| Data category | Source | Fields (high-level) | Permitted use | Retention | Storage |
|---|
| Organisation / tenant | QuickBooks Online; Xero | Organisation or company name; tenant / realm identifiers; legal name where supplied; base currency; country code; connection status | Rebilling; invoicing; support | 7 years after termination | Australia (AWS + MongoDB) |
| Client / contact details | QuickBooks Online; Xero; customer CSV upload (including Employment Hero billing exports) | Display / company name; email; phone; shipping or postal address components where supplied; payment terms | Rebilling; invoicing; support | 7 years after termination | Australia (AWS + MongoDB) |
| Subscription / billing plan data | Customer CSV upload mapped into Twine Biller (QuickBooks, Xero and Employment Hero plan catalogues); plan and margin configuration held in the platform | Client / organisation name; product or price-plan name; quantity (including employee counts where mapped); unit and line amounts; tax; discounts; billing period notes where present | Rebilling; margin calculation; invoicing; support | 7 years after termination | Australia (AWS + MongoDB) |
| Invoices and line items | Created in Twine Biller; synced to or from QuickBooks Online and Xero | Invoice number; issue and due dates; status; currency; line descriptions, quantities, amounts and tax; totals; amount due / paid; provider invoice identifiers and links | Invoicing; rebilling; margin calculation; support | 7 years after termination | Australia (AWS + MongoDB) |
| Products, tax and tracking settings | QuickBooks Online; Xero | Item / service codes and names; sales prices; tax rates and codes; classes, locations or tracking categories where enabled | Invoicing; rebilling; support | 7 years after termination | Australia (AWS + MongoDB) |
| Stripe payment status (invoice collections) | Stripe Connect (connected Express accounts) | Checkout session and payment intent identifiers; payment link URL; payment status (none / pending / paid / failed / expired); paid-at timestamp; payer email where supplied; dashboard transaction reference | Invoicing; support; reconciliation of paid invoices | 7 years after termination | Australia (AWS + MongoDB); payment processing also via Stripe (United States) |
| Platform subscription (Twine Biller itself) | Stripe Billing | Stripe customer and subscription identifiers; plan / entitlement status; entitled integrations; billing period end; cancel-at-period-end flag | Platform billing and access control for the Project | 7 years after termination | Australia (AWS + MongoDB); billing also via Stripe (United States) |
| Integration connection metadata | QuickBooks Online OAuth (com.intuit.quickbooks.accounting); Xero OAuth (accounting.invoices, accounting.contacts.read, accounting.settings.read, offline_access); Employment Hero (non-OAuth / CSV) | Provider name; connection / tenant identifiers; token expiry and last-sync timestamps (token values themselves are not listed) | Maintaining integrations; support | 7 years after termination | Australia (AWS + MongoDB) |
Employment Hero is listed in the Twine Biller integration catalogue with requiresOAuth: false. Subscription and billing rows for Employment Hero enter the platform via customer-uploaded CSV (and related plan mapping), not via a live Employment Hero API connection in the reviewed codebase.
Schedule 2 — Access List
Access to shared Data is limited to the following categories of persons, on a need-to-know basis, and only for purposes permitted under this Agreement and Schedule 1. This list is by role; it does not name individuals.
| Role / category | Organisation | Access purpose | Notes |
|---|
| Authorised staff (support and engineering) | Twine Apps Pty Ltd | Platform operation, engineering, customer support and security / backup administration for the Project | Need-to-know only; subject to confidentiality under clause 6 |
| Authorised users of the Customer | The Customer (party to this Agreement) | Use of Twine Biller for rebilling, invoicing, margin calculation and related Project functions | Access controlled by the Customer’s account administration |
| Authorised sub-processors | Stripe; Intuit (QuickBooks Online); SendGrid; Mixpanel | Payment processing and billing; accounting integration; transactional email; product analytics | United States, consistent with Privacy Policy section 10. Other integration providers (including Xero) may process Data under their own terms where the Customer connects them |
Primary application data for Twine Biller is stored in Australia on AWS and MongoDB (confirmed 27 October 2026).
