Terms of Service

Eshal AI Limited · DIFC, Dubai, UAE · CRN: CL12214 · eshal.ai/legal/terms

1. About Us and These Terms

1.1 Who We Are

These Terms of Service ('Terms') are a legal agreement between you and Eshal AI Limited ('Eshal', 'we', 'us'), a company incorporated in the Dubai International Financial Centre (DIFC), Dubai, UAE (CRN: CL12214).

Field	Details
Legal Name	Eshal AI Limited
CRN	CL12214 (Dubai International Financial Centre)
Registered Address	DIFC, Dubai, United Arab Emirates
Operational Address	Maple 1, Villa 36, Dubai Hills Estate, Dubai, UAE
Email	legal@eshal.ai
Website	https://eshal.ai

1.2 Scope

These Terms apply to your use of the eshal.ai website and self-serve subscription access to the Eshal AI platform. Enterprise customers governed by a Master Service Agreement (MSA) should note that the MSA prevails over these Terms in all respects.

By creating an account, clicking 'I agree', or using the Services, you confirm you have read, understood, and agree to these Terms and our Privacy Policy.

2. The Services

2.1 What We Provide

• AI Agent Builder for designing and deploying conversational workflows
• Multi-channel integration (WhatsApp, web chat, voice, SMS, email)
• Knowledge base management and document ingestion
• Analytics and performance dashboards
• API access and enterprise integration connectors

2.2 Service Availability and SLA

We target 99.9% monthly platform uptime. Our full SLA is at eshal.ai/legal/sla.

2.3 Third-Party AI Models

The platform uses approved third-party AI model providers. Their availability is outside our direct control. Our SLA applies to the Eshal platform layer only. We will notify you of material changes with at least 30 days' advance notice.

3. Fees, Pricing, and Payment

3.1 Pricing and Currency

Our subscription plans are priced in UAE Dirhams (AED) and US Dollars (USD). The AED price on your invoice is the definitive amount payable. USD pricing at checkout is an indicative equivalent. All prices exclude UAE VAT (5%), which is applied where applicable.

3.2 Payment Terms

• Monthly subscriptions: invoiced and charged in advance at the start of each monthly period
• Annual subscriptions: invoiced and charged in advance for the full year
• Payment methods: credit/debit card, or bank transfer for annual plans over AED 10,000
• Taxes: fees are exclusive of VAT and all applicable taxes

3.3 Refunds

Fees are non-refundable except:

• Service credits if we miss the SLA uptime commitment
• Termination for cause: pro-rata refund of prepaid fees for the unused period if you terminate due to our uncured material breach (14-day cure period)
• 14-day cooling-off period: new subscribers who cancel within 14 days of first paid subscription, having made fewer than 500 AI interactions, are entitled to a full refund
• As required by applicable law including UAE consumer protection law

3.4 Late Payment

Overdue amounts (more than 7 days) may incur interest at 1.5% per month. We may suspend access after written notice.

4. Acceptable Use

4.1 Permitted Use

You may use the Services for lawful purposes per our full Acceptable Use Policy (AUP).

4.2 Prohibited Uses

You must not use the Services to:

• Violate any applicable law or regulation, or facilitate others to do so
• Infringe any intellectual property, privacy, or other third-party right
• Engage in fraud, deception, phishing, or social engineering
• Transmit malware, viruses, or disruptive code
• Reverse engineer or extract underlying AI models or algorithms
• Build a competing AI customer experience product
• Deploy AI Agents in high-risk regulated contexts without appropriate human oversight

4.3 AI Transparency Obligations

Because Eshal AI deploys conversational AI agents, you are responsible for ensuring your deployment meets applicable AI transparency and disclosure requirements:

• Disclosure requirement: You must inform end users they are interacting with an AI system wherever required by applicable law, including UAE Federal Law No. 15 of 2020, GDPR Article 22, and equivalent regulations in your jurisdiction
• No false human impersonation: AI Agents must answer truthfully when a user directly and sincerely asks whether they are speaking with a human or an AI
• Regulated sector disclosure: For financial services, healthcare, or government deployments - include an AI disclosure at the outset of each interaction and provide an accessible option to speak with a human agent
• Your own disclosures: Include AI usage disclosure in your end-user privacy policy and terms of service

5. Intellectual Property

5.1 Eshal AI Platform: All rights in the Eshal AI platform, software, algorithms, models, and documentation belong to Eshal AI Limited. These Terms grant you a limited, non-exclusive, non-transferable licence to use the Services during your subscription for your internal business purposes.

5.2 Your Data: You retain all rights to data, content, and materials you upload ('Customer Data'). We have a limited licence to use Customer Data solely to provide the Services. We claim no ownership of your data.

5.3 Feedback: Written feedback may be used by us to improve the platform without obligation to pay you. Feedback does not include Customer Data.

6. Data Protection

Our Privacy Policy governs how we collect and process personal data as a data controller. If you process personal data of your own customers through the platform, we act as a data processor. Self-serve customers processing personal data should contact legal@eshal.ai to request a Data Processing Agreement before commencing such processing.

7. Warranties and Disclaimers

We warrant that the Services will perform materially in accordance with our Documentation. We do not warrant that the Services will be uninterrupted or error-free.

8. Limitation of Liability

These limitations do not apply to: liability for fraud or wilful misconduct; our data protection obligations; death or personal injury caused by our negligence; or any other liability that cannot be excluded by applicable law.

9. Indemnification

9.1 Eshal Indemnification - IP

We will defend you against any third-party claim alleging that your authorised, unmodified use of the Services infringes a third party's intellectual property rights, and will pay damages finally awarded or agreed in settlement. This does not apply to claims from your modifications, Customer Data, or combination with non-Eshal products.

9.2 Your Indemnification

You will defend us against third-party claims arising from: your Customer Data or violation of third-party rights; your breach of AI transparency obligations (Section 4.3); your breach of these Terms or applicable law; or claims by your own end users.

10. Term and Termination

• Subscription Term: Begins on sign-up and continues until cancelled. Monthly subscriptions renew monthly; annual subscriptions renew annually.
• Cancellation: Cancel at any time via Account Settings or email billing@eshal.ai. Cancellation takes effect at the end of the current billing period.
• Termination for Breach: We may terminate immediately if you materially breach and fail to cure within 14 days of written notice.
• Data Export: You have 30 days from termination to export Customer Data. After 30 days, we will delete Customer Data per our Privacy Policy.

11. Disputes and Governing Law

Governing Law: These Terms are governed by the laws applicable in the DIFC, Dubai, UAE.

Informal Resolution: Contact legal@eshal.ai and allow 30 days to resolve the matter informally before starting formal proceedings.

Small Claims Carve-Out: Nothing prevents you from filing a claim in a small claims court in your jurisdiction, seeking emergency injunctive relief from any court of competent jurisdiction, or filing a complaint with a consumer protection or data protection authority.

Arbitration (B2B): B2B disputes that cannot be resolved informally shall be resolved by binding arbitration under DIAC Rules in English in Dubai.

12. General

• Changes to Terms: We will notify you by email at least 14 days before material changes take effect. Annual subscribers who disagree may cancel before the new Terms take effect and receive a pro-rata refund.
• Entire Agreement: These Terms, the Privacy Policy, SLA, and AUP form the entire agreement for self-serve use. Enterprise customers are governed by their negotiated Master Service Agreement - contact legal@eshal.ai to request one.
• Severability: If any provision is found invalid, it will be modified to the minimum necessary. Remaining Terms continue in full force.
• Assignment: You may not assign your rights without our written consent. We may assign in connection with a merger or acquisition.
• Contact: Legal notices: legal@eshal.ai. General: contact@eshal.ai. Post: Eshal AI Limited, Maple 1, Villa 36, Dubai Hills Estate, Dubai, UAE (CRN: CL12214).

Appendix: SLA Summary - Self-Serve Plans

Full SLA: eshal.ai/legal/sla. Enterprise SLA governed by your MSA (Exhibit A).

Metric	Commitment	Notes
Monthly Uptime Target	99.9%	Measured as (total minutes minus downtime) / total minutes × 100
Downtime Definition	Platform unavailable >5 consecutive minutes	Excludes scheduled maintenance, Customer infrastructure, Third-Party AI Model outages, force majeure
Credit: 99.0%–99.9%	10% of monthly fees	Capped at 1× monthly fee
Credit: 95.0%–98.9%	25% of monthly fees	Capped at 1× monthly fee
Credit: Below 95.0%	50% of monthly fees	Capped at 1× monthly fee
How to Request Credits	Email billing@eshal.ai within 30 days of month end	Credits applied to next invoice within 14 days

Terms of Service v1.1 · 29 June 2026 · © 2026 Eshal AI Limited (CL12214)

Service Level Agreement

Eshal AI Limited · DIFC, Dubai, UAE · CRN: CL12214 · eshal.ai/legal/sla

1. Introduction and Scope

This Service Level Agreement (‘SLA’) sets out Eshal AI Limited’s uptime commitments, service credit entitlements, business continuity targets, and support response obligations. This SLA forms part of the Terms of Service and the Master Service Agreement (for Enterprise customers).

This SLA applies to SaaS and Sovereign Cloud deployments only. For VPC and On-Premise deployments, SLA commitments apply to the software layer only and are subject to Customer’s infrastructure performance.

2. Platform Uptime Commitment

2.1 Uptime Target

Eshal commits to maintaining 99.9% monthly uptime for the Platform for all SaaS and Sovereign Cloud deployments.

2.2 Uptime Calculation

2.3 Downtime Definition

‘Downtime’ means any period during which the Platform is unavailable and inaccessible to all Authorised Users for more than five (5) consecutive minutes.

2.4 Exclusions from Uptime Calculation

• Scheduled Maintenance: planned maintenance windows notified at least 48 hours in advance (normally 02:00–06:00 Gulf Standard Time on weekends)
• Emergency Maintenance: unplanned maintenance required to prevent or limit a security incident where advance notice is not reasonably practicable
• Customer Infrastructure: downtime caused by Customer’s own network, systems, hardware, or configuration
• Third-Party AI Model Outages: unavailability of approved third-party AI model providers outside Eshal’s direct control
• Force Majeure: events beyond Eshal’s reasonable control including natural disasters, war, pandemic, government action, or major Internet infrastructure failures
• Customer Breach: downtime resulting from Customer’s misuse of the platform or breach of the Terms of Service or MSA

3. Service Credits

3.1 Credit Entitlements

Monthly Uptime Percentage	Service Credit	Maximum Credit Per Month
99.0% to 99.9%	10% of that month’s subscription fee	Capped at 1× monthly fee
95.0% to 98.9%	25% of that month’s subscription fee	Capped at 1× monthly fee
Below 95.0%	50% of that month’s subscription fee	Capped at 1× monthly fee

3.2 Sole Remedy

Service credits are Customer’s sole and exclusive remedy for Eshal’s failure to meet the uptime commitment, except where downtime results from Eshal’s gross negligence or wilful misconduct, or cumulative downtime in any calendar quarter exceeds 5% of available minutes.

3.3 How to Request Credits

• Submit a credit request to billing@eshal.ai within 30 days of the end of the calendar month in which the downtime occurred
• Include: the date(s) and time(s) of the incident(s); the duration; a brief description of the impact
• Eshal will review and respond within 14 business days. Approved credits will be applied to the next invoice.

3.4 Scheduled Maintenance Notifications

Eshal will provide at least 48 hours’ advance notice via email to the account administrator and via status.eshal.ai. Eshal targets no more than 8 hours of scheduled maintenance per calendar month.

4. Business Continuity and Disaster Recovery

Objective	Target	Description
Recovery Time Objective (RTO)	< 4 hours	Maximum time from declared disaster to restoration of core platform services
Recovery Point Objective (RPO)	< 1 hour	Maximum data loss window
Backup Frequency	Daily incremental; Weekly full	All production Customer Data backed up with AES-256 encryption
Backup Retention	90 days rolling	Encrypted, geographically redundant backup storage
Geographic Redundancy	Multi-AZ	Production deployments span multiple availability zones within the selected region
DR Test Frequency	Annual	Full failover simulation with documented results; available to Enterprise customers on request

5. Support Response SLA

The following summary applies to SaaS self-serve plans. Enterprise customers have accelerated response times per their MSA.

P	Level	Definition	Self-Serve Response
P1	Critical	Complete platform outage; major data loss; critical security breach	Within 24 hours
P2	High	Significant degradation; key feature unavailable; production impact	Within 48 hours
P3	Medium	Partial degradation; workaround available; non-critical feature issue	Within 5 business days
P4	Low	General enquiry; documentation request; feature suggestion	Within 5 business days

6. Status and Monitoring

• Platform status and incident history: status.eshal.ai
• Report an incident: support@eshal.ai or support.eshal.ai
• Credit requests: billing@eshal.ai
• Security incidents: security@eshal.ai

7. Changes to This SLA

Eshal may update this SLA from time to time. Material changes will be communicated by email to account administrators at least 30 days before they take effect.

SLA v1.0 · 29 June 2026 · © 2026 Eshal AI Limited (CL12214)

Acceptable Use Policy

Eshal AI Limited · DIFC, Dubai, UAE · CRN: CL12214 · eshal.ai/legal/aup

1. Introduction

This Acceptable Use Policy (‘AUP’) governs your use of the Eshal AI platform, website, and all associated services (‘Services’) provided by Eshal AI Limited (‘Eshal’, ‘we’, CRN: CL12214). This AUP is incorporated into and forms part of the Terms of Service for self-serve customers, and the Master Service Agreement (Exhibit D) for Enterprise customers.

By accessing or using the Services, you agree to comply with this AUP. If you are using the Services on behalf of an organisation, you represent that you have the authority to bind that organisation to this AUP.

2. Permitted Uses

• Deploying AI-powered conversational agents to support your own customer service, sales, support, and engagement workflows
• Building and testing AI Agent workflows using the Agent Builder and workflow orchestration tools
• Integrating the Platform with your own enterprise systems via the published API and supported integration connectors
• Uploading lawfully obtained business content (knowledge base materials, FAQs, product documentation) for AI retrieval and grounding
• Configuring AI Agents with your own branding, persona, and communication style in accordance with applicable AI transparency requirements
• Generating analytics and performance reports on your AI Agent deployments
• Evaluating the Services during a free trial or proof-of-concept period, within the scope of the trial agreement

3. Prohibited Uses

3.1 Illegal and Harmful Activity

• Violate any applicable law, regulation, court order, or governmental directive in any jurisdiction in which you operate
• Engage in or facilitate fraud, identity theft, phishing, social engineering, or financial crime
• Produce, distribute, or process content that is defamatory, obscene, hateful, discriminatory, or threatening
• Generate or distribute child sexual abuse material (CSAM) or any content that sexualises minors
• Facilitate human trafficking, forced labour, or exploitation
• Produce content designed to radicalise, incite violence, or promote terrorism
• Violate sanctions regimes or export control laws including those of the UAE, UN, US, or EU

3.2 Intellectual Property and Data Rights

• Upload, process, or transmit content that infringes any third party’s intellectual property rights without proper authorisation or licence
• Upload personal data of third parties without a lawful basis for processing and appropriate privacy notices in place
• Scrape, harvest, or collect data from the Platform or third-party systems in violation of their terms of service

3.3 Security and Platform Integrity

• Attempt to gain unauthorised access to any part of the Platform or another customer’s account
• Introduce or transmit malware, ransomware, viruses, trojans, worms, or any other malicious code
• Conduct or facilitate denial-of-service (DoS) or distributed denial-of-service (DDoS) attacks
• Probe, scan, or test the vulnerability of any Eshal system or network without prior written authorisation from security@eshal.ai
• Circumvent, bypass, or disable any security control, authentication mechanism, or rate limit
• Attempt to reverse engineer, decompile, or extract the source code or underlying AI models of the Platform

3.4 Competitive and Commercial Restrictions

• Use the Services to build, develop, train, or benchmark a competing AI customer experience platform without prior written consent from Eshal
• Resell, sublicence, or provide access to the Services to third parties as a standalone commercial offering, without a formal reseller or partner agreement
• Use the Services to evaluate them on behalf of a direct competitor of Eshal for competitive intelligence purposes

3.5 AI-Specific Restrictions

• Deploy AI Agents configured to affirmatively claim to be human when directly and sincerely asked by an end user
• Use AI Agents to make fully automated decisions with legal or similarly significant effects on individuals without appropriate human oversight
• Deliberately engineer prompts or inputs designed to manipulate, deceive, harm, or exploit end users
• Use prompt injection techniques to extract system instructions, bypass safety guardrails, or manipulate AI outputs
• Generate synthetic media (deepfakes, fabricated audio, or manipulated video) of real identifiable individuals without their explicit consent
• Deploy AI Agents in safety-critical contexts (medical devices, autonomous vehicles, nuclear systems) without appropriate regulatory approval and human oversight
• Use the Services to create, test, or deploy malicious bots designed to spam, manipulate, or defraud end users

4. Content Standards

Content Type	Requirement	Examples of Non-Compliance
Knowledge Base Materials	Must be lawfully obtained; you must hold appropriate rights or licence	Uploading copyrighted documents without licence; scraped competitor content
AI Agent Prompts	Must not instruct the AI to deceive, harm, or manipulate users	Instructions to deny being an AI; instructions to extract personal data
End-User Data	Must be processed with appropriate legal basis; personal data minimised	Collecting sensitive data without consent; retaining data beyond purpose
Integration Data	Must be sourced from systems you are authorised to access	Connecting to a third-party system using stolen credentials

5. Your Responsibilities for AI Deployments

• Ensuring your AI deployment complies with all applicable laws in the jurisdictions where it operates
• Implementing appropriate disclosures that end users are interacting with an AI system, where required by law (see our AI Transparency Guidelines)
• Configuring human escalation paths for scenarios where AI handling is inappropriate or where end users request to speak with a human
• Reviewing and validating all AI-generated outputs before relying on them in regulated or high-risk contexts
• Maintaining accurate and up-to-date knowledge base materials to minimise the risk of inaccurate AI outputs
• Ensuring your own end users’ privacy rights are respected, including through an appropriate privacy policy that discloses your use of AI technology

6. Data Handling Obligations

In addition to your obligations under the Data Processing Agreement, you must:

• Only upload or process personal data for which you have a documented lawful basis under applicable data protection law
• Not upload special categories of personal data (health, biometric, financial, racial or ethnic origin, religious beliefs, etc.) to the Platform without appropriate additional safeguards and Eshal’s prior written consent
• Ensure that personal data uploaded to the Platform is accurate, relevant, and not excessive for the stated processing purpose
• Not use the Platform to circumvent data subject rights or to process personal data in a manner inconsistent with your own privacy policy

7. Reporting Violations

Report Type	Contact
AUP Violations	legal@eshal.ai - subject: ‘AUP Violation Report’
Security Vulnerabilities	security@eshal.ai - subject: ‘Security Vulnerability Report’
Child Safety Concerns	security@eshal.ai - highest priority; escalated to relevant authorities
Data Breaches	security@eshal.ai - response within 24 hours

8. Enforcement

Upon discovering or receiving a credible report of a violation, Eshal may - at its sole discretion and without liability to you - issue a written warning, temporarily suspend your access pending investigation, permanently terminate your account, remove or disable non-compliant content, report violations to law enforcement or regulatory authorities, or pursue civil remedies for damages caused by your violation.

Eshal is not liable for any damages, losses, or costs you incur as a result of enforcement actions taken in good faith. If you believe your account has been suspended or terminated in error, you may appeal by contacting legal@eshal.ai within 14 days of the enforcement action.

9. Changes to This AUP

Eshal may update this AUP from time to time. Material changes will be communicated by email to account administrators at least 14 days before they take effect. The current version is always published at eshal.ai/legal/aup.

AUP v1.0 · 29 June 2026 · © 2026 Eshal AI Limited (CL12214)

Sub-processor List

Eshal AI Limited · DIFC, Dubai, UAE · CRN: CL12214 · eshal.ai/legal/sub-processors

1. Introduction

Eshal AI Limited (‘Eshal’, CRN: CL12214) uses third-party service providers (‘sub-processors’) to deliver its AI-powered customer experience platform. As a data processor for our customers, we are committed to transparency about which sub-processors may process personal data on our behalf.

2. How We Select Sub-processors

• Security posture: SOC 2 Type II, ISO 27001, or equivalent independently verified security controls
• Data protection: review of the sub-processor’s privacy practices, DPA willingness, and applicable transfer mechanisms
• Contractual obligations: execution of a Data Processing Agreement imposing obligations at least equivalent to those Eshal accepts under its own DPA
• Ongoing monitoring: annual security review or review of certification renewal

3. Current Sub-processor List

Last Updated: 29 June 2026.

Sub-processor	Category	Purpose	HQ / Processing Location	Personal Data Processed	Transfer Mechanism
Amazon Web Services (AWS)	Infrastructure	Cloud hosting, storage, compute, networking	USA / UAE region (per deployment)	Customer Data, platform logs, backups	SCCs / DPA
Microsoft Azure	Infrastructure & Productivity	Cloud infrastructure; Microsoft 365 for email, Teams, Intune MDM	USA / UAE region	Identity data, email content, device management data	SCCs / DPA
Google Cloud Platform (GCP)	Infrastructure	Cloud infrastructure and compute (selected deployments)	USA / region per Order Form	Customer Data (where selected)	SCCs / DPA
Groq Cloud	Sovereign AI Infrastructure	Sovereign cloud compute for Saudi Arabia deployments	Kingdom of Saudi Arabia	KSA Customer Data; AI inference inputs	DPA / PDPL
Core42 / G42 Cloud	Sovereign Infrastructure	Sovereign cloud for UAE deployments	United Arab Emirates	UAE Customer Data	DPA / UAE PDPL
GitHub (Microsoft)	Development	Source code repository and CI/CD	USA	Code only - no customer personal data	SCCs / DPA
Atlassian (Jira / Confluence)	Project Management	Project tracking, internal documentation	Australia / USA	Operational data - no customer personal data	SCCs / DPA
OpenAI	AI Model Provider	Third-party LLM inference (where configured)	USA (API; no persistent storage)	Prompt data per session - zero-retention agreement	SCCs / DPA
Anthropic	AI Model Provider	Third-party LLM inference (where configured)	USA (API; no persistent storage)	Prompt data per session - zero-retention agreement	SCCs / DPA
Google DeepMind / Vertex AI	AI Model Provider	Third-party LLM inference (where configured)	USA / EU (API; no persistent storage)	Prompt data per session - zero-retention agreement	SCCs / DPA
Microsoft Azure OpenAI	AI Model Provider	Third-party LLM inference (where configured)	USA / region per config (API)	Prompt data per session - zero-retention agreement	SCCs / DPA
Stripe	Payment Processing	Payment card processing and subscription management	USA	Billing name, email, billing address; card data handled by Stripe (not Eshal)	SCCs / DPA
Clerk	Authentication	User authentication and session management	USA	Email address, login events, session tokens	SCCs / DPA

4. Transfer Mechanism Legend

Code	Meaning
SCCs / DPA	EU Standard Contractual Clauses (Commission Decision 2021/914) and a Data Processing Agreement
DPA / PDPL	Data Processing Agreement compliant with Saudi Arabia PDPL; processing on sovereign infrastructure within KSA
DPA / UAE PDPL	Data Processing Agreement compliant with UAE Federal Decree-Law No. 45 of 2021; processing within UAE

5. AI Model Provider Notes

• Zero Data Retention: We configure API calls to all Third-Party AI Model providers under zero-data-retention (ZDR) agreements or API terms that prohibit the provider from retaining, logging, or using prompt data for model training
• No Training on Customer Data: No customer personal data or Customer Data is used by any approved AI model provider to train or fine-tune their foundation models
• Session-Only Processing: Prompt data sent to AI model provider APIs is processed for inference only and is not persistently stored by the provider beyond the duration of the API call
• Failover: Eshal maintains the ability to route traffic between model providers for resilience; Customers will be notified of material changes per the notification process below

6. Sub-processor Change Notification

Eshal will provide at least 30 days’ advance written notice to affected customers before adding a new sub-processor, replacing an existing sub-processor, or materially changing the purpose or scope of processing by an existing sub-processor.

Enterprise customers with a signed Data Processing Agreement may object in writing to a new or replacement sub-processor within 30 days of receiving notice. If a reasonable objection cannot be resolved, either party may terminate the affected service on 30 days’ notice with a pro-rata refund of prepaid fees.

7. Contact and Requests

Enquiry Type	Contact
Privacy / DPA Enquiries	legal@eshal.ai - subject: ‘Sub-processor Enquiry’
DPA Requests (Self-Serve)	legal@eshal.ai - subject: ‘DPA Request’
Security Questions	security@eshal.ai

Sub-processor List v1.0 · 29 June 2026 · © 2026 Eshal AI Limited (CL12214)

Data Processing Agreement

Self-Serve Customers · Eshal AI Limited (Processor) · CRN: CL12214 · eshal.ai/legal/dpa

Preamble

This Data Processing Agreement (‘DPA’) is entered into between Eshal AI Limited, incorporated in the Dubai International Financial Centre (DIFC), Dubai, UAE (CRN: CL12214) (‘Eshal’, ‘Processor’) and the customer entity identified in the Order Form or account registration (‘Customer’, ‘Controller’).

This DPA governs the processing of Personal Data by Eshal on Customer’s behalf in connection with Customer’s use of the Eshal AI self-serve platform, and forms part of the Terms of Service. For Enterprise customers governed by a Master Service Agreement (MSA), the DPA in Exhibit C of the MSA governs instead.

This DPA takes effect on the date Customer accepts the Terms of Service or, if later, the date both parties sign the DPA signature page below.

1. Definitions

• “Controller” means the party that determines the purposes and means of processing Personal Data - in this DPA, the Customer.
• “Processor” means the party that processes Personal Data on behalf of the Controller - in this DPA, Eshal.
• “Data Protection Laws” means all applicable privacy and data protection legislation, including DIFC Law No. 5 of 2020, UAE Federal Decree-Law No. 45 of 2021 (where applicable), the EU General Data Protection Regulation (GDPR, where applicable to EU data subjects), Saudi Arabia PDPL (where applicable to KSA data subjects), and all associated regulations and guidance.
• “Personal Data”, “Processing”, “Data Subject”, “Supervisory Authority”, and “Personal Data Breach” have the meanings given in the applicable Data Protection Laws.
• “Sub-processor” means any third party engaged by Eshal to process Personal Data in connection with the Services.
• “Services” means the Eshal AI platform and associated services as described in the Terms of Service.

2. Roles and Scope of Processing

The parties acknowledge that, in relation to the processing of Personal Data described in Schedule 1:

• Customer is the Controller - it determines why and how Personal Data is processed
• Eshal is the Processor - it processes Personal Data only to provide the Services to Customer

Customer acknowledges that Schedule 1 represents its instructions to Eshal regarding the processing of Personal Data.

3. Controller Obligations

Customer, as Controller, represents and warrants that:

• It has a documented lawful basis under applicable Data Protection Laws for each category of Personal Data it uploads or processes through the Services
• It has provided appropriate privacy notices to Data Subjects explaining that their data may be processed by AI technology and shared with Eshal as a Processor
• It will not instruct Eshal to process Personal Data in a manner that would cause Eshal to violate applicable Data Protection Laws
• It will comply with all applicable Data Protection Laws in its role as Controller
• It will ensure that Personal Data uploaded to the Platform is accurate, relevant, and not excessive for the stated purpose

4. Processor Obligations

4.1 Instructions

Eshal shall process Personal Data only on Customer’s documented instructions (as set out in this DPA, the Terms of Service, and any written instructions provided by Customer), unless required to do otherwise by applicable law. If Eshal is required by law to process Personal Data otherwise than per Customer’s instructions, Eshal will inform Customer before doing so (unless prohibited by law).

4.2 Confidentiality

Eshal shall ensure that all personnel authorised to process Personal Data under this DPA are bound by appropriate confidentiality obligations, whether by contract or statutory duty.

4.3 Security

Eshal shall implement and maintain technical and organisational security measures to protect Personal Data, including: AES-256 encryption at rest; TLS 1.2+ encryption in transit; multi-factor authentication (MFA) for all administrative access; role-based access controls (RBAC) enforcing least privilege; periodic independent penetration testing; and continuous security monitoring and alerting.

4.4 No AI Model Training on Customer Data

4.5 Data Subject Rights

Eshal shall provide reasonable assistance to Customer in responding to Data Subject rights requests. If Eshal receives a Data Subject request directly relating to Customer’s data processing, Eshal will promptly forward it to Customer without acting on it, as Customer is the Controller responsible for responding.

4.6 Privacy Impact Assessments

Eshal shall, upon Customer’s written request, provide information reasonably necessary to assist Customer in conducting Data Protection Impact Assessments (DPIAs) and prior consultations with Supervisory Authorities where required by applicable Data Protection Laws.

4.7 Deletion or Return of Data

Upon termination of the Terms of Service, or upon Customer’s written request, Eshal shall, at Customer’s election: (a) delete all Personal Data from its systems within 30 days; or (b) return all Personal Data in a machine-readable format within 30 days, following which Eshal shall delete its copies. Eshal may retain Personal Data beyond this period only to the extent required by applicable law or regulatory obligation (including a minimum 7-year retention period for audit logs). Eshal will notify Customer of any such mandatory retention.

5. Sub-processors

Customer grants Eshal general authorisation to engage the Sub-processors listed at eshal.ai/legal/sub-processors. Eshal will provide at least 30 days’ advance written notice before adding or replacing any Sub-processor. Customer may object within 30 days; if the objection cannot be resolved within a further 30 days, either party may terminate the Services on 30 days’ notice with a pro-rata refund. Eshal shall impose data protection obligations on each Sub-processor equivalent to those in this DPA and remains fully liable for each Sub-processor’s performance.

6. International Data Transfers

Transfer Route	Safeguard	Details
DIFC to third countries	DIFC DP Law Chapter 6 safeguards	Transfer mechanisms approved by DIFC Commissioner of Data Protection
EU/EEA to third countries	Standard Contractual Clauses (SCCs)	EU Commission Decision 2021/914 Module 2 (Controller to Processor)
UK to third countries	UK International Data Transfer Agreements (IDTAs)	UK equivalent of SCCs post-Brexit
KSA data subjects	Saudi Arabia PDPL / NDMO	Data processed on Groq Cloud sovereign infrastructure within KSA
UAE data subjects	UAE Federal Decree-Law No. 45 of 2021	Data processed on Core42/G42 sovereign infrastructure within UAE

7. Personal Data Breach Notification

Eshal will provide reasonable assistance to Customer in complying with its regulatory breach notification obligations, including notification to the DIFC Commissioner of Data Protection within 72 hours where required under DIFC DP Law Article 36. A post-incident review report will be provided to Customer within 30 days of containment.

8. Audit Rights

• Eshal may satisfy audit requests by providing relevant security documentation, third-party certification reports, or equivalent controls evidence in lieu of or in addition to a direct audit
• Customer may conduct, or appoint a third-party auditor to conduct, an on-site audit with at least 30 days’ prior written notice
• Audits are limited to once per calendar year, except where a Personal Data Breach has occurred affecting Customer’s data
• Customer will bear the cost of any third-party auditor it appoints; Eshal may charge reasonable costs for internal time spent supporting the audit

9. Duration and Termination

This DPA remains in effect for the duration of the Terms of Service and for as long as Eshal processes Personal Data on Customer’s behalf. Upon termination, Eshal’s obligations continue until all Personal Data has been deleted or returned per Section 4.7. Sections 4.4, 6, 7, and 8 survive termination for so long as they remain relevant.

10. Governing Law

This DPA is governed by the laws applicable in the Dubai International Financial Centre (DIFC), consistent with the governing law of the Terms of Service. Data protection matters relating to EU/EEA data subjects are subject to the additional requirements of the GDPR and applicable EU law.

11. Order of Precedence

In the event of any conflict between this DPA and the Terms of Service with respect to data protection matters, this DPA prevails. For Enterprise customers, the DPA in Exhibit C of the Master Service Agreement prevails over this self-serve DPA.

Schedule 1: Processing Details

Field	Details
Subject matter	Provision of AI-powered customer experience automation services via the Eshal AI platform
Duration	For the duration of the Terms of Service and any post-termination retention required by law
Nature of processing	Collection, storage, use, analysis, retrieval, transfer, and deletion of Personal Data in connection with AI Agent operation, knowledge base retrieval, and platform analytics
Purpose of processing	Enabling Customer to operate AI conversational agents for its end users; providing platform analytics and reporting; facilitating integrations with Customer’s enterprise systems
Types of Personal Data	Customer-defined. May include: contact details (name, email, phone); conversational data (chat transcripts, voice interactions); customer identifiers; business transaction data. Special categories of data must not be uploaded without Eshal’s prior written consent.
Categories of Data Subjects	Customer’s end users; Customer’s employees or agents (where accessing the platform); other individuals whose data Customer includes in the knowledge base or AI inputs
Retention period	Active subscription: duration of the subscription plus 30 days post-termination for export. Audit logs: minimum 7 years. Customer-specific retention periods may be set in the platform settings.

Signature Page

Both parties agree to be bound by the terms of this Data Processing Agreement. This DPA may be executed electronically, and electronic signatures have the same legal effect as original signatures under applicable UAE law.

To request a countersigned copy, email legal@eshal.ai with subject line ‘DPA Signature Request’.

DPA v1.0 · 29 June 2026 · © 2026 Eshal AI Limited (CL12214)

Security Overview

Eshal AI Limited · DIFC, Dubai, UAE · CRN: CL12214 · security@eshal.ai

1. Certifications

Certification / Standard	Scope	Status
ISO/IEC 27001:2022	Information Security Management System (ISMS) - covers design, development, deployment, operation, and support of the Eshal AI Concierge platform across SaaS, on-premises, and customer VPC deployment models	Active
SOC 2 Type II	Trust Services Criteria: Security, Availability, and Confidentiality	In progress
HIPAA	Healthcare data handling and safeguards for US healthcare customers	Roadmap

The certified scope covers the people, processes, technologies, and information assets used to deliver Eshal’s AI conversational and workflow automation services, including software development, cloud infrastructure (production and staging), deployment operations, data processing, security operations, and incident management. Full audit documentation is shared with enterprise customers during procurement - contact security@eshal.ai.

2. Infrastructure and hosting

Region	Infrastructure	Notes
UAE (default)	Amazon Web Services, Microsoft Azure, Google Cloud Platform - UAE regions	Default SaaS deployment; data stays within the UAE
Saudi Arabia (sovereign)	Groq Cloud - Kingdom of Saudi Arabia	KSA-resident data for Saudi deployments; PDPL-compliant
UAE (sovereign)	Core42 / G42 Cloud - United Arab Emirates	UAE sovereign cloud option for government and regulated sectors
VPC / On-premise	Customer’s own cloud account or data centre	Available for enterprise; Eshal deploys into your environment

• Multi-AZ redundancy: all production deployments span multiple availability zones within the selected region
• No cross-border transfers without consent: customer data is processed in the region selected at onboarding; cross-region transfers require written agreement
• No shared tenancy for sovereign deployments: VPC and sovereign cloud customers receive isolated compute and storage

3. Encryption

Layer	Standard	Details
Data at rest	AES-256	All customer data, backups, and platform databases encrypted at rest
Data in transit	TLS 1.2 minimum (TLS 1.3 preferred)	All API traffic, web traffic, and internal service communication encrypted in transit
Backups	AES-256	All backup snapshots encrypted before storage
Key management	Cloud-native KMS	Encryption keys managed via the cloud provider’s Key Management Service; customer-managed keys available for enterprise deployments

4. Authentication and access control

4.1 Customer-facing authentication

• Authentication managed by Clerk (a dedicated identity provider) - no passwords stored by Eshal directly
• Multi-factor authentication (MFA) available and encouraged for all accounts; required for accounts with admin-level permissions
• Session tokens rotated on authentication events; session timeout enforced
• Single Sign-On (SSO) via SAML 2.0 available for enterprise customers

4.2 Internal access controls

• All Eshal personnel access to production systems governed by role-based access control (RBAC) enforcing least privilege
• MFA required for all internal administrative access to production infrastructure
• Access to customer data by Eshal personnel is restricted, logged, and subject to approval workflows
• Privileged access reviews conducted quarterly
• All access events recorded in immutable audit logs retained for a minimum of 7 years

5. Monitoring and alerting

• Continuous 24/7 security monitoring of platform infrastructure, API traffic, and application logs
• Automated alerting on anomalous access patterns, authentication failures, and potential intrusion indicators
• Platform availability monitored continuously; public status published at status.eshal.ai
• Security events correlated and reviewed by the Eshal security team in real time
• Dependency and container image scanning integrated into the deployment pipeline

6. Incident response

Eshal maintains a documented Incident Response Plan (IRP) covering detection, containment, investigation, notification, and post-incident review.

Milestone	Commitment
Initial response	Security incidents acknowledged within 24 hours of detection
Customer notification (breach)	Within 48 hours of Eshal becoming aware of a Personal Data Breach (per DPA Section 7)
Regulatory notification assistance	Eshal assists Customer in notifying DIFC Commissioner within 72 hours where required
Post-incident report	Root-cause analysis and remediation summary delivered to affected customers within 30 days of containment

To report a security incident: security@eshal.ai. Emergency contact is available 24/7 for confirmed P1 incidents.

7. Backups and recovery

Parameter	Commitment
Backup frequency	Daily incremental; weekly full snapshot
Backup retention	90 days rolling
Backup encryption	AES-256; geographically redundant storage
Recovery Time Objective (RTO)	< 4 hours (SaaS and Sovereign Cloud)
Recovery Point Objective (RPO)	< 1 hour (SaaS and Sovereign Cloud)
DR testing	Annual full failover simulation; results available to enterprise customers on request
Audit log retention	Minimum 7 years (regulatory requirement)

Full SLA commitments including credit entitlements: eshal.ai/legal/sla.

8. Penetration testing

• Independent penetration testing conducted periodically against the Eshal AI platform and supporting infrastructure
• Findings remediated according to severity: critical within 24 hours, high within 7 days, medium within 30 days
• Executive summary of the most recent penetration test (where completed) available to enterprise customers under NDA - contact security@eshal.ai
• Customers may request to conduct their own security assessment with 30 days’ prior written notice; see DPA Section 8 for audit rights

9. AI model security

• No training on customer data: customer data is never used to train, fine-tune, or improve any AI model without express written consent
• Zero-data-retention agreements: all approved AI model providers operate under zero-data-retention API terms - prompt data is not persistently stored or used for model training by the provider
• Prompt injection protection: platform-level controls detect and mitigate prompt injection attacks and adversarial inputs designed to bypass AI Agent guardrails
• Content filtering: configurable guardrails prevent out-of-policy AI outputs; all AI interactions are logged for review
• Human escalation: AI Agents are configured with accessible human handoff paths; automated decisions with significant effects require human oversight per the Acceptable Use Policy
• AI governance documentation: docs.eshal.ai/ai-governance

10. Responsible disclosure

Eshal AI Limited operates a responsible disclosure programme. If you discover a security vulnerability in our platform, we ask that you report it to us privately before public disclosure so we can investigate and remediate.

Field	Details
Report to	security@eshal.ai - subject: ‘Vulnerability Report’
What to include	Affected system or endpoint; description of the vulnerability; steps to reproduce; potential impact assessment
Acknowledgement	We will acknowledge receipt within 2 business days
Response commitment	Initial assessment within 5 business days; remediation timeline communicated within 14 days
Safe harbour	Researchers acting in good faith, not accessing customer data beyond what is necessary to demonstrate the vulnerability, and reporting promptly will not face legal action from Eshal
Recognition	We will acknowledge researchers by name in our security advisories (with their consent)
Out of scope	Social engineering attacks against Eshal staff; physical attacks against Eshal premises; denial-of-service attacks; attacks against customer-controlled deployments

Security Overview · Last reviewed 29 June 2026 · ISO/IEC 27001:2022 certified (Active) · SOC 2 in progress · © 2026 Eshal AI Limited (CL12214)