Privacy Policy
This Privacy Policy is effective from 2026-09-07. It describes how natalabs L.L.C-FZ processes personal data in connection with the Plexarm service.
1. Controller and contact
natalabs L.L.C-FZ, a free zone limited liability company registered in the United Arab Emirates, with its registered address at Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates ("natalabs", "we", "us"), is the controller of the personal data described in this Policy, except where clause 4 provides otherwise.
Requests and enquiries concerning personal data may be sent to hi@natalabs.com.
natalabs is established outside the European Union and the United Kingdom and has not appointed a representative in either jurisdiction. Requests should be addressed directly to natalabs at the contact details above.
2. Scope
This Policy applies to the Plexarm service made available at plexarm.com, including its website and its application programming interface (the "Service"). Capitalised terms not defined in this Policy have the meaning given to them in the Terms of Service.
3. Personal data processed, purposes and legal bases
| Category | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email address | To create and administer the Account and to send the sign-in link. No name and no password are collected | Performance of a contract — Art. 6(1)(b) |
| Access Tokens, stored in hashed form | To authenticate requests made to the Service. The token value is displayed once on issue and is not retained in readable form | Performance of a contract |
| Customer Data — the records submitted to the Account, including titles, bodies, notes, statuses, timestamps and the name of the Agent that submitted them | To provide the Service | Performance of a contract |
| Service logs — sign-in attempts and API requests, including time, endpoint, outcome and rate-limit state | To operate and secure the Service and to enforce the fair-use limit | Legitimate interests — Art. 6(1)(f): security and abuse prevention |
| IP address, in the hosting provider's request logs | To operate and secure the Service. The IP address is not stored against the Account | Legitimate interests |
| Interface preferences (theme and language), stored in your browser | To display the Service according to your settings. Not transmitted to natalabs | Strictly necessary; consent not required |
4. Personal data contained in Customer Data
Customer Data is submitted by you and your Agents and may contain personal data relating to third parties. In respect of such personal data, you are the controller and natalabs is the processor. natalabs processes Customer Data only to provide the Service and on your instructions, and does not access it for any purpose of its own except to secure and support the Service or as required by law. You are responsible for ensuring that you have a lawful basis for any personal data contained in Customer Data.
5. Recipients and processors
natalabs uses the following service providers, each of which processes personal data on natalabs' behalf under data-processing terms that restrict use of the data to the provision of its service.
| Provider | Service provided | Location and transfer safeguard |
|---|---|---|
| Supabase | Database hosting and authentication | European Union (Ireland) |
| Render | Application hosting and request logging | European Union (Germany). Render, Inc. is a United States company; access for support purposes is covered by standard contractual clauses |
| Resend | Delivery of transactional email, including the sign-in email | United States; standard contractual clauses |
| Cloudflare | Network security, content delivery and aggregate website analytics | Global network; certified under the EU-US Data Privacy Framework |
Cloudflare, Inc. also provides aggregate website analytics for the public pages of the Service. It records the page address, the referring address, the browser type and the country. It sets no cookie, writes nothing to your browser's storage and assigns no identifier to you or to your device, and it does not run on the signed-in pages of the Service.
natalabs does not sell personal data and does not disclose it to advertisers. Personal data may be disclosed where required by law, regulation or court order, or where necessary to establish, exercise or defend legal claims.
natalabs accesses data hosted in the European Union from the United Arab Emirates. Such access is subject to the transfer safeguards contained in the providers' terms referred to above.
6. Cookies and similar technologies
The Cookie Notice sets out the cookies and browser storage used by the Service. In summary:
- an authentication cookie, which maintains your signed-in session;
- browser storage of your theme, language and cached interface text.
7. Retention
| Data | Retention period |
|---|---|
| Account, email address, Access Tokens and Customer Data | For the life of the Account, then 30 days after closure, after which the data is permanently erased |
| Service logs, including IP addresses | For a limited period under the hosting provider's standard log rotation, then deleted |
| Database backups | For a limited period under the database provider's standard backup cycle; used only for disaster recovery and never to restore a closed Account |
| A record that an Account was closed and erased, with dates and without the email address | Retained indefinitely, to demonstrate compliance |
8. Account closure and erasure
You may close your Account from the account page.
Closing your account disables it immediately and revokes every token. We keep the closed account's data for up to 30 days so it can be restored if the closure was a mistake; after 30 days it is permanently erased. If you want it erased immediately, email hi@natalabs.com.
Restoration within the 30-day period is made only on request from the registered email address. After the 30-day period the email address, Access Tokens, Customer Data and the associated authentication record are permanently erased, and the email address may be used to register a new Account. Backup copies expire under the retention period in clause 7 and are not used to restore a closed Account.
9. Your rights
Subject to applicable law, you have the right to:
- access the personal data natalabs holds about you and to receive a copy of the records in your Account in a structured, machine-readable format. The copy comprises your records and does not include the Service's software, database structure, metrics or rules;
- rectify inaccurate personal data, including changing the email address associated with the Account;
- erase your personal data, in accordance with clause 8;
- restrict or object to processing carried out on the basis of legitimate interests;
- data portability in respect of the personal data you have provided.
Requests should be sent to hi@natalabs.com from the email address registered to the Account. natalabs responds within one month of receipt. Where a request is complex or requests are numerous, that period may be extended by two further months, in which case you will be informed within the first month.
You have the right to lodge a complaint with a supervisory authority: in the European Union, the authority of your country of residence; in the United Kingdom, the Information Commissioner's Office; in the United Arab Emirates, the UAE Data Office.
10. Security
natalabs implements appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction, including hashed storage of credentials, access controls that limit each Account to its own data, and passwordless authentication by single-use email link. In the event of a personal data breach affecting you, natalabs will notify you and the competent supervisory authority as required by applicable law.
11. Children
The Service is intended for professional use and is not directed at persons under 18 years of age. natalabs does not knowingly process the personal data of persons under 18. An Account found to be held by a person under 18 will be closed.
12. UAE Personal Data Protection Law
natalabs L.L.C-FZ is subject to Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the UAE PDPL). This Policy is drafted to satisfy the requirements of the GDPR and of the UAE PDPL. Complaints under the UAE PDPL may be addressed to the UAE Data Office.
14. Changes to this Policy
natalabs may amend this Policy at any time. An amendment takes effect when the amended Policy is published on this page with a new effective date. Where natalabs intends to process personal data already held for a purpose not described in this Policy, it will inform you before that processing begins. Previous versions of this Policy are available on request.