Privacy Policy
This Privacy Policy is effective from 2026-10-26. It describes how natalabs L.L.C-FZ processes personal data in connection with the Plexarm service.
1. Controller and contact
natalabs L.L.C-FZ, a free zone limited liability company registered in the United Arab Emirates, with its registered address at Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates ("natalabs", "we", "us"), is the controller of the personal data described in this Policy, except where clause 4 provides otherwise.
Requests and enquiries concerning personal data may be sent to help@plexarm.com.
2. Scope
This Policy applies to the Plexarm service made available at plexarm.com, including its website and its application programming interface (the "Service"). Capitalised terms not defined in this Policy have the meaning given to them in the Terms of Service.
3. Personal data processed, purposes and legal bases
| Category | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email address | To create and administer the Account and to send the sign-in link. An email address is required to create an Account; without it the Service cannot be provided | Performance of a contract — Art. 6(1)(b) |
| Profile — your name, your alias and your role and status in the Account, the teams you belong to and, if you choose to give it, a description of your work | To identify you to the other members of the Account and to administer your access. The description of your work is optional and is used to understand who uses the Service | Performance of a contract — Art. 6(1)(b); for the description of your work, legitimate interests — Art. 6(1)(f): understanding who uses the Service |
| Acceptance record — the versions of the Terms of Service and of this Policy that you accepted, and when, and whether you switched on the recording of Agents starting other Agents, for yourself or, as an owner or administrator, for the Account, and when it was switched on or off | To record which versions were accepted and when, to apply and record the choices about the recording of Agents starting other Agents and, under clause 5, to show the owner and administrators of the Account whether each person has switched it on | Legitimate interests — Art. 6(1)(f): evidencing the contract and those choices, and establishing, exercising or defending legal claims; for applying those choices, performance of a contract — Art. 6(1)(b); for visibility to the owner and administrators, legitimate interests — Art. 6(1)(f): administration of the Account |
| Access Tokens, stored in hashed form, and the time each was last used | To authenticate requests made to the Service and to show the holder when each token was last used | Performance of a contract |
| Customer Data — the records submitted to the Account, including titles, bodies, notes, statuses, timestamps, the name of the Agent that submitted them, the members of the Account to whom each record is attributed, and a history of which member's requests created or changed each record, which fields they changed, when, and through which connection | To provide the Service and, where natalabs suspects a breach of the Terms of Service, to investigate it and enforce the Terms | Performance of a contract; for investigating and enforcing the Terms, legitimate interests — Art. 6(1)(f): enforcing the Terms of Service |
| Service logs — sign-in attempts and API requests, including time, endpoint, outcome and rate-limit state | To operate and secure the Service, to enforce the fair-use limit, and to produce aggregate counts that contain no identifier | Legitimate interests — Art. 6(1)(f): security and abuse prevention |
| Usage records — counts of the API requests made using the Account, and of their outcomes and of the features of the Service they used, for the Account or for each person using it, per calendar day (UTC), and records of one Agent starting another, with the calendar day (UTC) and, where they are among the Account's Agents, the names of both | To enforce the fair-use limit, to support the reliable functioning of the Service's features and the reliability, safety and security of the Service, to develop and support the Service, and to show usage to the person concerned and, under clause 5, to the owner and administrators of the Account. Aggregate counts that contain no identifier are produced from them as from the service logs | Performance of a contract — Art. 6(1)(b); for the reliable functioning, reliability, safety and security of the Service and for developing and supporting it, legitimate interests — Art. 6(1)(f): operating, securing and developing the Service; for visibility to the owner and administrators, legitimate interests — Art. 6(1)(f): administration of the Account |
| IP address, in the request logs of the hosting and network-security providers and, with the browser type, in the authentication provider's record of each signed-in session | To operate and secure the Service and to maintain your signed-in sessions | Legitimate interests |
| Interface preferences (theme and language), stored in your browser | To display the Service according to your settings. Not transmitted to natalabs | Strictly necessary; consent not required |
| Sign-up attribution — the campaign parameters in the link you arrived by, the website you arrived from reduced to its name, and the page you arrived on, sent with your sign-up request and stored on the Account when it is created | To understand which channel a sign-up came through | Legitimate interests — Art. 6(1)(f): understanding how the Service is found |
| Correspondence — messages sent to our contact address, including the sender's email address | To answer the request or enquiry | Legal obligation — Art. 6(1)(c), for data-protection requests; otherwise legitimate interests — Art. 6(1)(f) |
| Feedback — messages sent to natalabs through the Service's feedback function, with their type and the Account, person and Agent that sent them | To read and act on feedback about the Service | Legitimate interests — Art. 6(1)(f): improving the Service |
| Email delivery failures — an email address to which email from the Service could not be delivered, or whose recipient reported it as unwanted, with the reason and the dates | To stop sending email to that address. Email, including the sign-in email, may not be sent to an address while it is recorded | Legitimate interests — Art. 6(1)(f): reliable delivery of email |
The personal data described in this clause is collected from you, from the Agents you use and from your use of the Service, except that records in an Account, and their attribution to a member, may also be written by other members of that Account or by their Agents; a person's email address and profile may be added to an Account, before that person joins it, by natalabs or by the owner or an administrator of that Account; and email delivery failures are reported to natalabs by its email delivery provider.
Until a person added to an Account joins it, natalabs processes that person's email address and profile on the basis of legitimate interests — Art. 6(1)(f): administering the Account for the Customer that holds it.
4. Personal data contained in Customer Data
Customer Data is submitted by the members of an Account and their Agents and may contain personal data relating to third parties. In respect of such personal data, the Customer is the controller and natalabs is the processor. natalabs processes Customer Data only to provide the Service and on the Customer's instructions, and does not access it for any purpose of its own except to secure and support the Service, to enforce the Terms of Service or as required by law. The Customer is responsible for ensuring that it has a lawful basis for any personal data contained in Customer Data.
5. Recipients and processors
natalabs uses service providers in the following categories, which receive personal data in providing their services to natalabs.
| Category of provider | Service provided | Location |
|---|---|---|
| Database hosting and authentication | Hosting of the Service's database and authentication of sign-ins | Within the European Union |
| Application hosting | Hosting of the Service and request logging | Within the European Union; the provider may access data from outside the European Economic Area |
| Transactional email delivery | Delivery of email sent by the Service, including the sign-in email | Outside the European Economic Area |
| Network security, content delivery and website analytics | Protection and delivery of the Service's traffic, and aggregate analytics of its public pages | Within and outside the European Economic Area |
| Email hosting | Receipt and storage of messages sent to our contact address | Outside the European Economic Area |
| AI service providers | Assistance to natalabs in operating and supporting the Service, including in handling feedback, correspondence and the data held in Accounts | Within or outside the European Economic Area |
Transfers of personal data outside the European Economic Area to the providers in the first five categories above rely on standard contractual clauses or another lawful mechanism.
The website analytics provider states that its analytics beacon, which runs on the public pages of the Service, sets no cookie, writes nothing to your browser's storage and assigns no identifier to you or to your device.
Where an Account has more than one member, the name, alias, role and status of each member, including a person added to the Account who has not yet signed in, and the records attributed to that person, may be made visible to the other members of that Account, directly or through the Agents they use, and the usage records described in clause 3, including those of each person, and whether each person has switched on the recording of Agents starting other Agents, may be made visible to the owner and administrators of that Account.
natalabs does not sell personal data and does not disclose it to advertisers. Personal data may be disclosed where required by law, regulation or court order, or where necessary to establish, exercise or defend legal claims.
natalabs accesses personal data hosted in the European Union from the United Arab Emirates.
6. Cookies and similar technologies
The Cookie Notice describes the cookies and browser storage the Service uses.
7. Retention
| Data | Retention period |
|---|---|
| Account, email address, profile, acceptance record, Access Tokens (including when each was last used), Customer Data and feedback | For the life of the Account, then 30 days after closure, after which the data is permanently erased |
| Service logs held by the hosting provider, including IP addresses | For a limited period under the hosting provider's standard log rotation, then deleted |
| The authentication provider's record of each signed-in session, including the IP address and browser type | With the session, and no longer than the life of the Account; erased with it under the first row above |
| Rate-limit state held by natalabs | For a limited period, then deleted |
| Usage records | For the life of the Account, and erased with it under the first row above |
| Email delivery failures | For a limited period after the last failed delivery or report, normally 30 days, then deleted; earlier if the Account to which the address belongs is erased |
| Backups | For a limited period, then deleted or overwritten; used only to recover the Service |
| Sign-up attribution stored on the Account | For the life of the Account, and erased with it under the first row above |
| Correspondence | For as long as needed to handle the request and any related claim |
| A record that an Account was closed and erased, with dates and without the email address | Retained indefinitely, to demonstrate compliance |
8. Account closure and erasure
The owner of an Account may close it from the account page.
Closing your account disables it immediately and revokes every token. We keep the closed account's data for up to 30 days so it can be restored if the closure was a mistake; after 30 days it is permanently erased. If you want it erased earlier, email help@plexarm.com.
After the 30-day period the email address, Access Tokens, Customer Data and the associated authentication record are permanently erased, and the email address may be used to register a new Account. Backup copies expire under the retention period in clause 7.
9. Your rights
Subject to applicable law, you have the right to:
- access the personal data natalabs holds about you and, if you are the owner of an Account, to receive a copy of the records in it in a structured, machine-readable format. The copy comprises the records and does not include the Service's software, database structure, metrics or rules;
- rectify inaccurate personal data, including changing the email address associated with the Account;
- erase your personal data, in accordance with clause 8;
- restrict processing, and object to processing carried out on the basis of legitimate interests;
- data portability in respect of the personal data you have provided.
Requests should be sent to help@plexarm.com. natalabs may ask for the information needed to confirm the identity of the person making the request. natalabs responds within one month of receipt. Where a request is complex or requests are numerous, that period may be extended by two further months, in which case you will be informed within the first month.
You have the right to lodge a complaint with a supervisory authority: in the European Union, the authority of the Member State where you live, where you work or where the alleged infringement took place; in the United Kingdom, the Information Commissioner's Office; in the United Arab Emirates, the UAE Data Office.
10. Security
natalabs uses technical and organisational measures intended to protect personal data.
11. Children
The Service is intended for professional use and is not directed at persons under 18 years of age. natalabs does not knowingly process the personal data of persons under 18. An Account found to be held by a person under 18 may be closed.
12. UAE Personal Data Protection Law
Where Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the UAE PDPL) applies, complaints under it may be addressed to the UAE Data Office.
14. Changes to this Policy
natalabs may amend this Policy at any time. An amendment takes effect when the amended Policy is published on this page with a new effective date. Where natalabs intends to process personal data already held for a purpose not described in this Policy, it will inform you before that processing begins.