AI Native · Invitation-only alpha

Data processing agreement

1. Parties and instructions

This Data Processing Agreement (“DPA”) is between 1E6 Labs L.L.C-FZ, incorporated in Meydan Free Zone, Dubai, United Arab Emirates, at 6th Floor, Meydan Grandstand, Meydan Road, Dubai, United Arab Emirates (“Provider”), and the Customer organization identified in the recorded acceptance or signed order. It forms part of the AI Native agreement. The Customer is the controller, or a processor acting with the relevant controller’s authority, for Customer personal data. We act as its processor when providing the service. Our own account, security and business-administration processing is described separately in the Privacy Policy.

We process Customer personal data only under documented lawful instructions in the agreement, the Customer’s permitted use of the service and its authorized support requests, unless applicable law requires otherwise. We will inform the Customer of that legal requirement where permitted and notify it if we believe an instruction infringes applicable data-protection law. This DPA governs personal-data processing in a conflict with the other service documents.

2. Processing details and alpha scope

The subject matter is provision of AI Native organizational records, conversations, document storage, permitted integrations and AI assistance for business work. Processing includes collection, organization, storage, retrieval, transmission to approved providers, generation of drafts or results, access control, security investigation, correction and return or deletion. Processing continues during the service and the lawful return, retention and deletion process.

Data subjects can include the Customer’s employees, contractors, business contacts and people lawfully mentioned in its ordinary work records. Data can include names, business contact and identity details, membership and role information, work messages, documents, task records, outputs, source metadata, connection credentials and usage/audit information. The Customer decides what work content to supply and is responsible for appropriate notices and a lawful basis.

The initial alpha is for adults and ordinary business information. Do not submit health information, biometrics, government identity documents, payment-card data, children’s data, sensitive personal information, regulated records, or information requiring in-country-only processing or a fixed deletion deadline without a separate supported arrangement agreed before submission. The service is not intended to make legally significant decisions about a person.

3. Safeguards and confidentiality

We maintain safeguards appropriate to the service: database-enforced organization separation on the shared estate; application membership and permission controls; restricted production operator access; protected server-side credentials; HTTPS for service connections; encrypted cloud storage and protected recovery copies; malware checks for admitted uploads; and audit and security records. Authorized personnel must be bound by confidentiality and access only the data necessary for their role. These measures do not create a dedicated-infrastructure or zero-risk commitment.

The Customer manages its Users, invitations, connected-service permissions, content classification and review of assistant actions. It must report suspected misuse promptly. We will provide information reasonably needed to assess the safeguards, subject to confidentiality, other customers’ isolation and service security.

4. Approved subprocessors

The Customer generally authorizes these providers for the stated purposes: Microsoft Azure for UAE North application hosting, database, storage, security and geo-redundant recovery; Anthropic for commercial API inference with global routing and a reviewed United States workspace; OpenAI for commercial API inference; and Google for paid Gemini API inference. Google Workspace handles support communications when the Customer sends information to support@1e6.ai. Google and Microsoft also operate the Customer’s chosen sign-in and connected-service accounts under their applicable roles and terms. No connection is enabled by accepting this DPA alone.

Customer-data inference and fallbacks in this alpha are restricted to Anthropic, OpenAI and Google. DeepSeek and Moonshot are excluded. We do not authorize generalized model training on Customer Content or opt Customer work content into provider feedback or training-sharing programs. Provider safety and abuse retention still applies. We bind subprocessors to appropriate data-protection obligations and remain responsible for their processing of Customer personal data to the extent required by the agreement and applicable law.

Before adding or materially replacing a subprocessor, we will give at least 30 days’ notice through the Customer’s designated contact, unless an urgent legal or security issue requires earlier action. A Customer may object within that period on reasonable data-protection grounds. We will discuss a reasonable alternative or allow termination of the affected service if the objection cannot be resolved; we will not silently send affected data to the disputed provider while the objection is being resolved.

5. Locations and transfers

The shared application’s primary database and file storage are in UAE North with geo-redundant recovery. Model requests, support communications and connected services can be processed outside the UAE, Qatar or the United States, including other global service locations. This alpha provides no in-country-only processing commitment.

We will use the safeguards required by the law applicable to the particular international transfer and assist the Customer with relevant information and assessments. Consent to a connection does not replace a required transfer mechanism. If additional jurisdiction-specific clauses or approvals are required, they must be agreed and in place before the affected data is submitted; this DPA does not claim that a separate transfer instrument has already been executed.

6. Incidents, requests and assessment

We will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer personal data, provide available information about the incident and mitigation, and supplement it as the investigation proceeds. We will cooperate reasonably with the Customer’s response and legally required notifications. An initial notice does not require every fact to be known.

We will reasonably assist the Customer with access, correction, deletion, restriction, portability and other applicable individual rights; security and impact assessments; and communications with competent authorities. Requests may require verification of identity and authority. We will refer a request about Customer-controlled work data to the Customer where appropriate and avoid acting on conflicting instructions without clarification, except where law requires action.

At reasonable intervals, and following a relevant incident or a competent authority’s requirement, we will make available compliance information and cooperate with a proportionate audit agreed in advance. Audits must protect other customers’ data and service security. Reasonable assistance outside ordinary service can require an agreed fee, but no fee excuses a mandatory legal obligation or delays an urgent legally required response.

7. Return, deletion and retained copies

At the end of the service, the Customer may instruct us to return available Customer personal data or erase it, subject to a legal requirement to retain it. Contact support@1e6.ai to arrange the scope, format and schedule. We will carry out lawful instructions without undue delay and within any deadline required by applicable law. Export and organization erasure currently require coordinated support work; there is no complete automated organization-export or erasure facility in this alpha.

The 30-day export window and completion of active-data erasure or de-identification by day 60 are implementation targets being reviewed. They are not a supported contractual deadline in this alpha. A Customer needing a fixed deadline must agree a supported process before supplying the affected data. This does not waive a statutory right or deadline.

The deletion process must cover conversations, documents, derived context, connector records and file versions, rather than only removing a member or disconnecting a provider. Active document token bundles are removed on disconnection; provider-side grants must be revoked separately. The current work-audit default redacts bodies after 30 days and deletes audit rows after 400 days, with a scheduled sweep up to a day later. A valid erasure instruction must separately address personal data in retained audit evidence; routine retention is not an automatic exception to that instruction.

Database recovery copies use a seven-day backup window; blob and container soft-delete recovery use 30 days; technical logs use a default 30-day window. Protected recovery copies remain unavailable for ordinary use until expiry. If restored, applicable deletion instructions must be reapplied. Legal holds must be limited to the data and purpose required by law, with access restricted and retention ending when the justification ends. De-identification must prevent reasonably likely re-identification. We will explain applicable exceptions and provide available completion evidence.

8. Contact and agreement

Privacy, support and legal notices: support@1e6.ai. This DPA takes effect only through the Customer’s recorded acceptance or a signed agreement identifying its version. Liability and dispute provisions follow the service agreement, subject to mandatory data-protection law. Material changes to processing require the agreed notice or acceptance process.

Version 2026-10-11 · Effective 11 October 2026