Privacy Notice for Personal Accounts

Code Chain Creations – FZCO Version 1.2 · Effective date: 13 November 2026 · Last updated: 12 November 2026

This Notice explains how Code Chain Creations – FZCO ("CCC", "we", "us"), a free zone company licensed by the International Free Zone Authority (IFZA), licence no. 42369, Dubai Silicon Oasis, Dubai, United Arab Emirates, handles personal data when you use a personal account with your own AI agent on our website or in our Telegram bot (the "Service"). We are the controller of this data. We process it in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL") and other laws that apply.

In short. We need only a log-in name, a password and an e-mail address. In our Telegram bot, your Telegram account replaces the log-in name and password. We do not ask for your real name, phone number, address, identity documents or card details. Your messages are sent to AI providers to generate replies. We do not sell your data.

Details on request. The current names of our providers, the countries they work in, the periods we keep data for and our security measures are available free of charge on request through the Contact form. We answer within 3 working days.

1. What we collect and why

• Account. Your log-in name, password (we store the password only in protected, hashed form) and e-mail address, the date you registered, your settings and your time zone. We use your time zone to show times and send reminders at the right hour. We use your e-mail address to confirm your registration, restore your access, confirm requests about your data and send you important notices.
• Telegram. If you use our bot, Telegram gives us your Telegram user ID and username, and the name and language set in your Telegram profile. We use them to link the bot to your account and to reply to you.
• Invitations. The invitation code you registered with, who invited you, the codes you share, and who registered with them.
• Your messages and files. Your conversations with your Agent, files you send, the Output, and the information your Agent saves to remember your tasks and preferences. Voice messages are turned into text on our own server.
• Subscription. When payment is switched on: your plan, payment status, dates, amounts and invoices. Card payments are processed by a licensed payment provider. We do not see or store your full card details.
• Referral programme. The number of paid months counted for your invitation code.
• Technical and usage data. IP address, device and browser type, log and security records, and usage records such as the time and number of messages. We use them to keep the Service secure, to prevent abuse and to apply usage limits.
• Records of acceptance. The versions of the documents you accepted, with the date and time.

Information you choose to send

We do not ask for, and do not need, identity numbers, card or bank details, passwords, one-time codes, health information or information about other people. Please do not send them unless you really need to. If you do, it is your choice: we store and process them only to answer you and as described in this Notice, including by sending them to our AI providers. You can ask us to delete them through the Contact form.

Legal bases

2. How we use AI

• AI providers. Your messages and the files and context needed for a reply are sent to third-party AI models to generate the reply. We may add, replace or remove models and providers. The current list is available on request.
• No reading of your conversations. We do not read your conversations, except when you ask us for help, when we need to investigate a security problem or abuse, or when the law requires it. Only authorised staff bound by confidentiality do this, and only as far as needed.
• Automatic checks. Our software automatically checks how agents work, to keep them accurate and safe, and learns from anonymised reports. People do not read your conversations for this.
• Training. We do not ourselves train AI models on your data. We may create anonymised and aggregated information from the use of the Service, which does not identify you or any other person, and use it to improve and train our own agents and software. We do not use it to train third-party AI models.
• Provider terms. AI providers handle data under their own terms. They may keep inputs and outputs for safety, abuse monitoring or legal reasons. If a function would send your data to a provider that may use it to train its models, we ask for your separate consent first.
• No automated decisions. Your Agent makes suggestions. It does not take decisions with legal or similarly significant effects on you.

3. Who receives your data

• providers of AI models and similar AI services;
• hosting, database, authentication and file storage providers;
• Telegram, if you use our bot;
• web search and other services connected to your Agent, when it uses them for your task. Your Agent asks you before it passes your personal data to a connected service;
• a licensed payment provider, when payment is switched on;
• the Referral Partner that runs our referral programme: only your invitation code and the number of paid months counted for it. It never receives your messages, your files or the log-in names of the people you invited;
• professional advisers under confidentiality, a buyer or successor of our business, and authorities where the law requires.

The person who invited you sees how many people registered with their code and the rewards earned, but not your log-in name, messages or files. The same applies to people you invite. We do not sell personal data. Current provider names are available on request.

4. Transfers outside the UAE

Your data may be stored and processed outside the UAE, including in Singapore, the United States, the European Union and other countries where our providers operate. We transfer it on a basis permitted by Articles 22 and 23 of the PDPL: where the transfer is necessary to perform our contract with you, with your consent, or under contracts with the recipient. The current countries and safeguards are available on request.

5. How long we keep data

• Account, messages, files and Agent memory: while your account exists. You can ask us to delete individual messages, files or your Agent's memory at any time. After your account is deleted, we delete this data from our systems without undue delay.
• Invitation records: while the accounts concerned exist, and longer only as needed for the referral programme's accounting or a dispute.
• Payments, invoices and records of acceptance: for as long as tax and accounting law requires, or as needed to establish or defend legal claims.
• Backups and logs: for the period set by our providers.

Copies held by AI providers under their own policies are outside our control. The current periods are available on request.

6. Your rights

Under the PDPL you may, subject to its conditions and exceptions:

• receive information about the processing of your data (Article 13);
• ask for your data to be transferred to you or to another controller (Article 14);
• ask us to correct or erase your data (Article 15);
• ask us to restrict processing (Article 16);
• object to processing and ask us to stop it, including for direct marketing (Article 17);
• object to decisions based on automated processing and ask for review by a person (Article 18);
• withdraw your consent at any time, without affecting earlier processing.

To delete messages, files, your Agent's memory or your whole account, or for any other request, use the Contact form on our website and write "Privacy" in the subject. We confirm that the request comes from the account holder: it must be sent from the e-mail address linked to your account, or confirmed by a message from your account. We answer within 3 working days. If you are not satisfied with our answer, you may complain to the UAE Data Office.

7. Security

We use technical and organisational measures appropriate to the data and the Service, and our staff have access only where needed. No system is completely secure. If a breach is likely to affect you, we will tell you and the competent authority as the law requires.

8. Cookies

We use necessary cookies and similar browser storage for sign-in, security and your preferences, such as language. Optional analytics is off unless you allow it, and it never includes your messages or files.

9. Age

The Service is only for people aged 18 or over. If we learn that an account belongs to someone under 18, we close it and delete its data.

10. Changes

We may update this Notice and will publish the new version with its date. For material changes, such as a new purpose of processing, we also tell you in your account or in the Telegram bot before they apply.

11. Contact

Questions or requests about your data: use the Contact form on our website and write "Privacy" in the subject.

This Notice is published in English, with Russian and Ukrainian translations. An Arabic version is available on request. If the versions differ, the English version prevails, unless the law requires otherwise.