Agreements & privacy

SERVICE AGREEMENT — CLOSED TECHNICAL PILOT 1. Provider and notices The provider is ThreeControl, located in Riyadh, Saudi Arabia, Saudi Arabia. Service, contractual and privacy notices are received at info@threecontrol.com. This identifies the service and the location supplied by its operator; it does not represent incorporation, a registration number, a complete postal address or Saudi data residency. Tell us if another notice method is legally required. 2. Scope and acceptance This release covers a closed, free technical pilot, not an unrestricted commercial launch. Only expressly approved organizations and their authorized adult representatives may participate. An account alone does not create a subscription. The plan and period approved for the organization determine its seats and available functions. The representative must read the current documents and accept them personally with authority to bind the organization. We retain the accepted version; later settings changes do not rewrite that record. 3. Permitted pilot data Use synthetic projects, documents and test systems you are authorized to control. Do not submit sensitive personal information, customer production databases, payment-card information, children's data, regulated records or critical production workloads. Minimal real account/contact information needed to operate the pilot is covered by the privacy notice. Do not connect a production server or enable a new external integration merely because a control is visible. 4. Service and responsibilities The service provides the functions actually enabled for the approved organization. Planned, disabled or unverified functions are not promised. You control your members, permissions, instructions and customer-owned systems. Keep credentials private and report suspected compromise promptly. Administrative access does not by itself authorize ThreeControl to change an external system; operations must follow its authorization and approval controls. 5. Fees and duration This pilot has no charge, automatic debit or automatic paid renewal. Any later paid service requires a separately disclosed plan, price, currency, taxes where applicable and affirmative agreement before a charge. Expiry may suspend access under the approved subscription. Ask info@threecontrol.com for extension or closure; do not rely on continued access after expiry. 6. Availability and support Support and notices use info@threecontrol.com. The pilot can have maintenance, interruption or incomplete features. No uptime percentage, response-time guarantee, recovery deadline or zero-data-loss guarantee is offered. We use operational monitoring and backups, but a successful backup is not proof that every workload can be recovered. Keep an independent copy of important original material. 7. Content, confidentiality and security You retain rights in your content and grant only the access needed to provide the authorized service, security, support and recovery. Do not upload material you cannot lawfully provide. We do not claim ownership of your content or a general right to sell it or train external AI models on it. Both parties should limit access to authorized persons and protect confidential information. Disclosures required by law remain subject to lawful limitations. 8. Suspension and exit We may restrict access reasonably to address security, unlawful use, abuse, expiry or a serious breach. Where safe and lawful, we explain the reason and how to resolve it. You may request closure and available exports through info@threecontrol.com. Export and deletion are operator-reviewed procedures, not a guaranteed one-click full-system export or immediate erasure from all backups. The privacy notice explains retention and backup limits; mandatory rights are not waived. 9. Liability and mandatory rights Neither party is excused from obligations or liabilities that cannot lawfully be excluded. This pilot does not create a fixed contractual damages cap or an unrestricted indemnity. Loss, remedies and responsibility are assessed under applicable law and the facts; no statement here guarantees immunity for negligence or data-protection violations. 10. Changes and disputes We publish material changes as a new version and require current acceptance where the enrollment process requires it. Changes do not retroactively replace previously accepted content or authorize new data uses. Contact info@threecontrol.com first to resolve disputes. Saudi law applies to the extent valid, without excluding mandatory rights or the jurisdiction of a competent authority. Arabic is the reference language if these parallel texts conflict, subject to mandatory law.

PRIVACY NOTICE — CLOSED TECHNICAL PILOT 1. Responsibility and scope ThreeControl, located in Riyadh, Saudi Arabia, Saudi Arabia, operates this service. Contact info@threecontrol.com for privacy questions and rights requests. We determine the purposes of account administration, service security and our direct communications. An organization determines the purposes of content it instructs us to handle; the processing addendum explains that separate role. This notice covers the closed pilot described in the service agreement. 2. Information and sources We receive account names, email addresses, authentication records, organization membership, roles, application and subscription records, accepted document versions, and support messages from you or your authorized administrator. Use synthetic project and workload content in this pilot. Service requests can generate timestamps, operation results, audit events and technical connection information, including IP or browser information when received by the service infrastructure. Do not send passwords or sensitive records in support email. 3. Purposes and necessity We use necessary information to create and verify accounts, administer authorized access and subscriptions, carry out requested operations, send service notices, provide requested support, investigate abuse and recover service data. Necessary contractual processing, applicable legal duties and security interests where legally permitted are the relevant bases for those activities. If a distinct activity legally requires consent, we seek it separately and provide a withdrawal method. A service agreement is not blanket consent to unrelated marketing, analytics, AI training or international transfers. Without necessary account and security information, access may not be possible. 4. Recipients and location Hosting is currently with DigitalOcean in London, United Kingdom; the operator location is not the hosting location. Google Workspace/Gmail API handles service email. Encrypted operational backups are copied to Google Drive. Healthchecks and UptimeRobot receive limited monitoring events and the configured notification contact. Their processing may occur outside Saudi Arabia, and no Saudi-only or fixed Google storage region is promised. The subprocessors notice explains purposes and limits. We do not describe unverified provider terms, approvals or transfer safeguards as completed. Required lawful transfer safeguards must be established before admitting additional real participants. This includes account/contact details, service email and their backups, not only production content; synthetic project content does not exempt those personal records. Accepting this notice alone does not supply a transfer basis. 5. Cookies and integrations Essential authentication and anti-forgery cookies support sign-in, session security and safe navigation. The configured account session lifetime is currently up to 24 hours; browser expiry and revocation can end access sooner. HTTPS authentication cookies are host-scoped. This pilot notice does not authorize advertising cookies or third-party marketing trackers. Optional external connections must be disclosed and authorized separately; do not submit content to them merely because a button is visible. 6. Retention and deletion Active account and service records are kept while needed for the approved relationship, security and legal obligations. We review a verified closure or rights request by data category and lawful purpose, restrict unnecessary use, and delete information no longer needed unless a lawful exception applies. We explain a refusal or continuing legal need where permitted. There is no currently verified automatic whole-platform erasure scheduler or uniform expiry for every record. Operator-managed logs and application history can remain until their reviewed cleanup is performed; editable settings are not evidence that every category is automatically deleted. 7. Backups and recovery Current local backup selection uses daily, weekly and monthly groups; these groups are not a guaranteed maximum age. Automatic production pruning is disabled, and Drive backups are not automatically expired. Copies are encrypted before offsite storage, but are not represented as immutable or inaccessible to authorized operators holding recovery keys. Before returning recovered information to active use, the operator must review and apply verified deletion or restriction requests. No automatic cross-backup request tracker has currently been verified. Immediate selective removal from every physical snapshot is not promised. Backup retention and any required deletion must be reviewed by the operator; this pilot is not approved for production customer content pending those controls. 8. Rights and complaints You can ask to know the processing basis and purpose, access or obtain readable information, correct inaccurate information, and request deletion where applicable. You can withdraw consent for a distinct consent-based activity without invalidating earlier lawful processing. Send the minimum information needed to identify your account to info@threecontrol.com; we verify authority proportionately, protect other people's information and respond within applicable legal periods, explaining any permitted extension. An organization member may need the organization's controller to decide a content request. You may complain to the competent data-protection authority, including SDAIA where Saudi law applies; contacting us first is not a waiver. 9. Security, incidents and updates We use HTTPS, access restrictions, separate organization boundaries and encrypted backup repositories. No security method eliminates all risk. We investigate suspected incidents and notify affected parties or authorities when required by applicable law, without claiming an untested universal detection or recovery deadline. We publish material notice changes as a new version. New purposes, recipients or permissions are not authorized retroactively. The service is not directed at children and does not accept sensitive or regulated pilot content.

DATA PROCESSING ADDENDUM — CLOSED TECHNICAL PILOT 1. Parties and roles This addendum forms part of the approved pilot between the organization and ThreeControl at Riyadh, Saudi Arabia, Saudi Arabia; notices: info@threecontrol.com. The organization controls the purposes and lawful instructions for its content. ThreeControl processes that content only for authorized service operations. ThreeControl separately controls its necessary account, security and direct-support records under the privacy notice. 2. Subject, duration and data The subject is the enabled organization workspace, authorized test operations, support and recovery during the approved pilot and controlled exit. Use synthetic projects, configuration and documents; do not upload real production customer content, sensitive or regulated personal data or children's information. Minimal account data relates to authorized representatives and members. Storage, retrieval, permission-controlled display, requested modification, diagnostics and recovery are the relevant operations. 3. Instructions and confidentiality The accepted service scope, organization settings and properly authorized actions constitute documented instructions. A visible feature does not authorize production access or an undisclosed external provider. We may decline unlawful, insecure or out-of-scope instructions and explain the issue where lawful. Persons with authorized access must be limited to the task and bound to confidentiality obligations appropriate to their role. 4. Security and boundaries Use the platform's organization, role, subscription and approval controls. The operator uses access restrictions, HTTPS and encrypted backup repositories and reviews incidents. These measures are not a certification, guarantee of zero risk, verified recovery time or statement that every external workload is covered by the central backup. You remain responsible for lawful collection, accurate instructions, member access and the security of systems you administer. 5. Other providers and international processing The disclosed hosting, email, backup and monitoring providers are listed in the subprocessors notice. This pilot does not grant unrestricted approval for future providers or data uses. Before a material new provider handles organization content, disclose its purpose and relevant location and address any legally required agreement or transfer safeguard. You may raise a substantiated concern through info@threecontrol.com; if it cannot be resolved, stop the affected integration or pilot rather than silently authorize it. No unverified signed provider addendum or Saudi residency is represented. 6. Assistance and incidents We assist proportionately with access, correction, deletion and information requests that the service can support, after verifying the requester and organization authority. Forward an organization-controlled content request to the organization where appropriate. We investigate a suspected incident, preserve necessary evidence and provide available facts and updates without undue delay where the law or controller obligations require them. Nothing replaces a mandatory authority or individual notification deadline. 7. Return, deletion and recovery At closure, ask info@threecontrol.com for an agreed available export and reviewed deletion. We identify the affected data, lawful exceptions and backup scope before acting, and report the action and remaining restrictions rather than claiming a full-system erase without evidence. Current production backup pruning is disabled and Drive copies have no automatic expiry; immediate selective erasure of every snapshot is not promised. Before restored data returns to active use, the operator must review and apply verified deletion or restriction requests; this is a required manual check, not a claim of a verified automatic tracker. Important source material must also be retained by the organization independently. Do not introduce production customer content into this pilot pending completion of those operational controls. 8. Review and changes Reasonable security and processing information can be requested through info@threecontrol.com without exposing another organization's data, secrets or system access. A request for additional paid assistance requires separate agreement; mandatory rights cannot be charged away. Material changes use a new published document version and any acceptance required by the enrollment process; historical acceptance is preserved. Mandatory data-protection obligations take precedence over conflicting pilot wording.

ACCEPTABLE USE — CLOSED TECHNICAL PILOT Use ThreeControl only for the approved organization and authorized test systems. The organization's owner must keep membership and roles accurate. Sharing an account or bypassing another organization's access restrictions is not permitted. Do not use the service for unlawful activity, fraud, impersonation, harassment, malware, credential theft, unauthorized scanning, exploitation or access to third-party systems. Do not upload sensitive or regulated personal data, children's information, production customer content or payment-card details to this pilot. Respect intellectual-property and confidentiality rights. A command, generated suggestion, automation, Git change or support request is not authorization to deploy, delete, incur a charge or change security. Review the target, scope, current state and required approval before any consequential operation. Do not bypass approval, subscription, isolation, logging or rate controls. Never place secrets in a public repository, ticket or chat. Do not intentionally overload shared infrastructure or consume another organization's resources. Report an unexpected cross-organization result, exposure or security weakness promptly to info@threecontrol.com without probing further, downloading additional records or publishing private evidence. Share only the minimum safe information needed to investigate. We may restrict affected access proportionately to protect people and systems or comply with law. Where safe and lawful we explain the restriction, preserve relevant evidence and allow a reasoned review through info@threecontrol.com. These measures do not authorize destruction of unrelated data or remove mandatory legal rights. This notice does not authorize production penetration testing or changes to systems not expressly included in your approved pilot. Provider: ThreeControl, Riyadh, Saudi Arabia, Saudi Arabia.

AI AND EXTERNAL INTEGRATIONS — CLOSED TECHNICAL PILOT This pilot release does not authorize AI-provider processing or automatic operations on production customer systems. AI offers, configurable providers or integration controls may exist in the product; their presence does not prove that a provider is enabled, approved, funded, tested or suitable for your information. Before an optional connection is separately enabled, the organization must be shown the actual provider and purpose, information to be sent, relevant processing location, available retention or training controls, permissions, costs and limits. Its authorized representative must approve the particular scope. There is no blanket consent to all future providers, changed models, higher privileges or new uses. No claim is made that an unverified provider refuses training or retains no data. Use synthetic content in this pilot. Do not submit passwords, production secrets, sensitive personal information or regulated records to an AI model or external tool. A model can produce incorrect, unsafe or infringing suggestions; a competent person must verify material outputs. Do not use outputs as the sole basis for medical, legal, employment, lending or other high-impact decisions. A generated answer or user message is not approval to execute an operation. Existing resource, role, organization and action-approval controls still apply. No guaranteed autonomous development, deployment or recovery is promised by this notice. Ask info@threecontrol.com to clarify, suspend or revoke an optional integration. Revocation stops future authorized use where supported; it does not recall information already lawfully transmitted or prove deletion at a provider. We must explain any actual limits before promising them. Separate provider accounts and terms remain applicable; ThreeControl does not accept those terms on your behalf. Provider: ThreeControl, Riyadh, Saudi Arabia, Saudi Arabia. Any future material integration scope requires its own disclosure and approval, not silent expansion of this release.

SERVICE PROVIDERS AND LOCATIONS — CLOSED TECHNICAL PILOT Operator: ThreeControl, Riyadh, Saudi Arabia, Saudi Arabia. Contact for questions or objections: info@threecontrol.com. This register describes enabled operational purposes; it is not a certification of provider compliance or proof that every account-specific data-processing or transfer document has been accepted. DigitalOcean: hosts the platform virtual machine and its local operational storage in London, United Kingdom. Hosting involves platform account/service data and the content permitted by the pilot. The operator's Saudi location and domain name do not imply Saudi hosting. Provider terms and processing information: https://www.digitalocean.com/legal/data-processing-agreement Google Workspace / Gmail API: sends service messages from the platform mailbox. Recipient addresses and message content needed for the notification are sent to Google. The approved platform authorization is gmail.send, not general inbox reading. Mail can be delivered to the recipient's chosen provider. Provider processing information: https://cloud.google.com/terms/data-processing-addendum/ Google Drive: stores encrypted operational backup repositories created before upload. The connector is authorized with drive.file for its application-created or explicitly selected files, not unrestricted access to the user's entire Drive. Authorized recovery operators retain separate recovery keys. A fixed Google processing/storage country, immutable storage or automatic Drive expiry is not promised. Backup scope and deletion limits are described in the privacy notice. Healthchecks.io: receives backup completion/health signals and the configured alert contact to detect a missed schedule. The monitoring integration does not grant access to backup files, application databases or the Google account. No fixed processing country is represented in this release. Provider terms: https://healthchecks.io/privacy/ UptimeRobot: checks the public platform URL from an external monitoring region currently configured as Europe and sends availability alerts to the configured contact. That probe region is not a verified location for all provider account processing. It receives the public URL, response/availability information and alert contact, not customer database contents or backup access. Provider information: https://uptimerobot.com/privacy/ GitHub: is used for platform source and release delivery. It is not designated as a destination for customer databases, account exports, secrets or backups. Do not commit such information. Any separately authorized customer repository integration needs its own relevant disclosure and permission. Material provider changes must be disclosed before new organization-content processing and accompanied by required agreements and lawful transfer safeguards. Acceptance of this register is not acceptance of a provider's separate legal terms and is not, by itself, a lawful international transfer mechanism. This closed pilot excludes real production customer content until the relevant controls are completed.