AI Regulation, Governance & Responsible Use

Last updated: 5 October 2026

Artificial intelligence is not governed by one single global law. The legal obligations that apply depend on where an AI system is offered or used, what the system does, the type of data it processes, whether it affects people in a significant way, and whether the organisation is acting as a provider, deployer, controller, processor or other regulated operator.

MyOpsAgent is designed around a controlled-use model: language AI can help understand questions, organise approved context and explain results, while access permissions, business rules, constraints, deterministic decision logic, connected tools and approval requirements remain under the control of the platform and the organisation using it.

This page provides a high-level overview of the principal UK and European Union requirements relevant to MyOpsAgent as at the date above. It is not legal advice and does not replace a customer-specific or sector-specific legal assessment.

1. The Current UK Position

The United Kingdom does not currently operate a single horizontal "AI Act" that applies the same rules to every AI product. AI systems are instead regulated through existing laws and sector regulators according to how the technology is used and the risks it creates.

Relevant UK requirements can include data protection law, consumer protection, equality and anti-discrimination law, product and workplace safety, competition law, intellectual property law, contractual obligations and sector-specific regulation. The UK Government's stated approach remains context-based and risk-based, with existing regulators applying legal requirements within their own areas of responsibility.

• Safety, security and robustness: AI systems should be appropriate for their intended use and risks should be identified and controlled.
• Transparency and explainability: people should receive appropriate information about AI use and important outcomes.
• Fairness: AI must not be used in ways that unlawfully discriminate or process personal data unfairly.
• Accountability and governance: organisations remain responsible for how AI is selected, configured and used.
• Contestability and redress: people affected by significant decisions should have appropriate routes to challenge or seek review where the law requires it.

2. UK GDPR, Data Protection Act 2018 and the Data (Use and Access) Act 2025

Where personal data is processed, AI does not remove or reduce an organisation's data-protection obligations. The UK GDPR and Data Protection Act 2018 continue to require lawful, fair and transparent processing, purpose limitation, data minimisation, accuracy, storage limitation, appropriate security and accountability.

• An appropriate lawful basis must be identified for personal-data processing.
• People must be given appropriate privacy information about how their data is used.
• Only data that is necessary for the defined purpose should be used.
• Personal data should be accurate, protected and retained only for as long as necessary.
• Special-category data, including health data, biometric identification data and certain other sensitive information, requires additional legal conditions and safeguards.
• A Data Protection Impact Assessment (DPIA) is required where processing is likely to result in a high risk to individuals' rights and freedoms.

The Data (Use and Access) Act 2025 amended the UK rules on automated decision-making. The new provisions distinguish decisions with meaningful human involvement from decisions made solely through automated processing and impose safeguards where solely automated processing is used to make a significant decision about an individual.

3. Significant Automated Decisions and Human Review

Under the current UK rules, a decision is treated as solely automated where there is no meaningful human involvement. A significant decision is one that produces a legal effect for a person or has a similarly significant effect.

Where a significant decision about a person is based solely on automated processing of personal data, the controller must provide appropriate safeguards. These include measures that enable the individual to receive information about the decision, make representations, obtain human intervention and contest the decision. Additional restrictions apply where special-category personal data is involved.

How MyOpsAgent addresses this: MyOpsAgent separates conversational AI from controlled decision logic and supports workflows in which a recommendation can stop at an approval point before execution. Decision, approval, rejection, execution and verification states can be recorded separately. Where a use case could make a legally or similarly significant decision about a person, the deployment should be configured to provide meaningful human review and any additional safeguards required by law.

4. UK AI and Automated Decision-Making Code of Practice

Regulations that came into force in May 2026 require the Information Commissioner to prepare a statutory code of practice covering good practice in the processing of personal data when developing or using artificial intelligence and automated decision-making, including children's data.

As at 5 October 2026, the ICO is still developing this statutory code and related updated guidance. MyOpsAgent will review the final code when published and update its governance, documentation and platform controls where necessary.

5. Fairness, Equality and Discrimination

AI systems remain subject to equality and anti-discrimination law. In Great Britain, the Equality Act 2010 applies in areas including employment and the provision of services. Using software or AI does not remove the responsibility of an employer, service provider or other organisation to avoid unlawful discrimination.

How MyOpsAgent addresses this: MyOpsAgent is designed to make controlled operational decisions from defined business state, permissions, rules, constraints and capabilities rather than allowing a language model to invent decision criteria. Customers must not configure rules, datasets or workflows that unlawfully discriminate, and deployments involving employment, access to services or other decisions about individuals require a specific fairness and legal review.

6. UK Consumer Protection

The Digital Markets, Competition and Consumers Act 2024 contains the UK's current unfair-commercial-practices regime for conduct taking place from 6 April 2025. Businesses must not mislead consumers, omit material information, use aggressive practices or otherwise act unfairly in ways prohibited by the Act.

AI-generated wording, recommendations, sales information, product descriptions and customer conversations are not exempt. A business remains responsible for claims made through an AI-enabled customer channel.

How MyOpsAgent addresses this: public-facing MyOpsAgent deployments can be restricted to approved business knowledge and deliberately enabled customer actions. Internal operational information does not become public merely because the organisation also uses a public agent. Customers remain responsible for the accuracy, legality and completeness of the information they provide for customer-facing use.

7. The EU Artificial Intelligence Act

The EU Artificial Intelligence Act (Regulation (EU) 2024/1689), as amended in 2026, applies according to the role of the organisation and the use of the AI system. It can apply to providers established outside the European Union where an AI system is placed on the EU market, put into service in the EU, or where output produced by the system is used in the EU.

A UK company can therefore fall within the EU AI Act even though it is not established in an EU Member State.

• Provider: an organisation that develops, or has developed, an AI system and supplies or puts it into service under its own name or trademark.
• Deployer: an organisation using an AI system under its authority for professional purposes.
• Other roles: importers, distributors, authorised representatives and product manufacturers may have separate duties.

MyOpsAgent may be a provider of a downstream AI system when it supplies MyOpsAgent under its own name. A customer operating MyOpsAgent within its organisation may also have responsibilities as a deployer. The exact legal role must be assessed for the particular deployment.

8. EU AI Act: Rules Already in Application

The AI Act applies in stages. As at 5 October 2026, important requirements already in application include the AI-system definition, AI-literacy requirements, prohibited AI practices, general-purpose AI model obligations for relevant model providers, enforcement provisions and the transparency rules for certain interactive and generative AI systems.

Following Regulation (EU) 2026/1744 (the Digital Omnibus on AI), the main high-risk requirements for systems listed in Annex III are scheduled to apply from 2 December 2027, while relevant high-risk requirements for AI embedded in regulated products under Annex I are scheduled to apply from 2 August 2028.

9. Prohibited AI Practices

The EU AI Act prohibits certain uses considered to create unacceptable risks. The detailed legal categories should always be checked against the current legislation, but they include specified forms of manipulative or exploitative AI, unlawful social-scoring practices and other practices identified in Article 5.

How MyOpsAgent addresses this: MyOpsAgent is intended for legitimate business knowledge, workflow, operational analysis, controlled decisions and approved actions. It is not designed as a social-scoring, covert manipulation, unlawful biometric-classification or predictive-policing platform. Customers must not configure or use MyOpsAgent for prohibited purposes.

10. AI Literacy

Article 4 of the EU AI Act requires providers and deployers to take measures supporting an appropriate level of AI literacy for staff and other people operating AI systems on their behalf, taking account of their knowledge, experience and the context in which the AI is used.

MyOpsAgent compliance standard: personnel responsible for developing, configuring, administering or approving MyOpsAgent AI functionality should receive appropriate training on the system's purpose, limitations, human-oversight model, data-handling requirements and escalation routes. Customers using MyOpsAgent in the EU should provide appropriate training to staff who operate or rely on the system within their own organisation.

11. Transparency: People Should Know When They Are Interacting With AI

Article 50 of the EU AI Act applies from 2 August 2026. Providers of AI systems that interact directly with natural persons must design them so that people are informed that they are interacting with an AI system, unless that fact is obvious from the circumstances or a specific legal exception applies.

The AI Act also contains technical transparency requirements for certain AI-generated or manipulated audio, image, video and text content, including machine-readable marking requirements where Article 50 applies.

MyOpsAgent compliance standard: public and internal conversational deployments should clearly identify the interaction as AI-assisted. Where machine-readable marking or other technical transparency requirements apply to content generated by a MyOpsAgent deployment, those requirements must be implemented before the relevant system is placed on the EU market or put into service.

12. High-Risk AI Uses

MyOpsAgent is a general business platform and is not automatically a high-risk AI system merely because it uses AI. Classification under the EU AI Act depends on the intended purpose and the way a particular deployment is used.

Some uses can fall into high-risk categories, including certain uses involving employment and worker management, education, essential services, critical infrastructure, biometrics, law enforcement, migration and other areas listed by the AI Act. AI used as a safety component of certain regulated products can also be subject to high-risk requirements.

MyOpsAgent compliance standard: each deployment should be classified according to its intended purpose before high-impact functionality is enabled. A customer must not assume that a low-risk customer-service deployment and a workforce, healthcare, safety-critical or regulated-sector deployment have the same legal requirements.

13. General-Purpose AI Models

The EU AI Act imposes specific obligations on providers that place general-purpose AI (GPAI) models on the EU market. These obligations include technical documentation, information for downstream providers, copyright-compliance measures and publication of information about training content. Additional requirements apply to GPAI models with systemic risk.

MyOpsAgent's use of a third-party language model does not automatically make MyOpsAgent the provider of that underlying general-purpose model. Where MyOpsAgent uses a model supplied by another provider without developing or placing that model on the market under the MyOpsAgent name, the model provider remains responsible for the GPAI-provider obligations that apply to that model. MyOpsAgent can nevertheless have separate obligations as the provider of the downstream AI system.

14. The MyOpsAgent Separation of Responsibilities

MyOpsAgent is deliberately designed so that a natural-language model is not given unrestricted authority over the organisation's business systems or governed decisions.

• Language layer: can understand requests, organise permitted context and explain outcomes in natural language.
• Access layer: determines which organisation, user, role, module and tool context is available.
• Decision layer: can evaluate operational state, defined rules, capabilities, constraints and permitted outcomes independently of unrestricted language-model output.
• Action layer: connected actions are exposed through defined server-side tools rather than unrestricted access to external systems.
• Human layer: approval can be required before a recommendation becomes an executed operational change.
• Audit layer: events, recommendations, approval states, execution states and verification results can be recorded for later review.

This architecture is intended to support accountability, explainability, traceability and meaningful human control. It does not by itself guarantee compliance for every possible use case; the organisation deploying the system remains responsible for configuring and using it lawfully.

15. Business Data and AI Access

MyOpsAgent does not treat a language model as an unrestricted window into a customer's company. The platform is designed to control which context is retrieved, which tools are available, which organisation the request belongs to and which actions are permitted.

• Public-facing users can be restricted to approved public knowledge and deliberately enabled customer actions.
• Authenticated users operate within organisation and permission context.
• The language layer is not provided with database credentials or unrestricted system credentials as part of normal operation.
• Only context required for the permitted task should be supplied to an external AI service.
• Rules, constraints, permissions and governed decision logic remain within the controlled application layer.

Customers should review the data they connect to MyOpsAgent, the lawful basis for processing it, whether any special-category information is involved, and the contractual and data-protection terms applying to any subprocessors or external AI services used for their deployment.

16. Accountability, Documentation and Impact Assessments

Responsible AI compliance is not achieved through a single disclaimer. Organisations should be able to demonstrate why an AI system is being used, what it is permitted to do, what data it uses, what risks were identified, which controls apply and who remains accountable.

Depending on the use case, appropriate documentation may include a DPIA, AI risk or impact assessment, intended-purpose statement, data-flow record, lawful-basis assessment, access-control record, model or supplier information, testing evidence, human-oversight procedure, incident process, retention rules and decision/audit records.

MyOpsAgent's structured event, decision, approval and verification records are designed to support this wider accountability process, but customers remain responsible for any assessments and records required for their own legal role and sector.

17. Sector-Specific and Safety-Critical Uses

Additional law and professional standards can apply when AI is used in healthcare, financial services, employment, critical infrastructure, education, transport, product safety, health and safety, or other regulated activities.

MyOpsAgent can support operational reasoning, workflow, evidence, rules and escalation in these environments, but it does not replace a legally required competent person, regulated professional, statutory duty holder or safety authority. Customers must identify and satisfy the laws, standards, approvals and professional responsibilities that apply to their sector.

18. Customer Responsibilities

• Use MyOpsAgent only for lawful and authorised purposes.
• Identify the organisation's legal role and the jurisdictions in which the system is offered or used.
• Determine whether the deployment processes personal or special-category data and establish the required lawful basis and safeguards.
• Carry out DPIAs, AI risk assessments or other impact assessments where required.
• Ensure public and staff users receive appropriate transparency information.
• Do not configure discriminatory, prohibited, deceptive or unlawful decision criteria.
• Ensure meaningful human review is available where law, risk or organisational policy requires it.
• Classify any EU use case to determine whether it is subject to high-risk AI requirements.
• Train staff to use and supervise AI appropriately.
• Maintain sector-specific approvals, professional oversight and statutory responsibilities.

19. What MyOpsAgent Does Not Claim

MyOpsAgent does not claim that the use of deterministic logic, human approval or a conversational interface automatically makes every deployment legally compliant. Compliance depends on the customer's use case, data, jurisdiction, configuration, sector and operational controls.

MyOpsAgent also does not claim that business information can never be processed by an external AI service. Where language AI is used, controlled context may be supplied to the relevant service in accordance with the configured task and applicable contractual and data-protection arrangements. The platform's security model is intended to minimise unnecessary exposure and prevent unrestricted model access to the customer's systems.

20. Regulatory Monitoring

AI law is developing quickly. MyOpsAgent will review material changes to applicable UK and EU law, regulatory guidance and recognised standards and will update platform controls, documentation and this notice where reasonably necessary.

In particular, MyOpsAgent will continue to monitor the ICO's forthcoming statutory Code of Practice on Artificial Intelligence and Automated Decision-Making, future UK AI legislation, EU AI Act guidance and standards, and the phased implementation of the EU high-risk AI requirements.

21. Official Regulatory Sources

The following official sources provide further information and should be consulted for the current legal position:

• UK Information Commissioner's Office (ICO): Artificial Intelligence and data-protection resources.
• UK legislation: Data (Use and Access) Act 2025 and Data Protection Act 2018.
• UK AI regulatory approach: UK Government AI regulation framework.
• UK consumer law: CMA guidance on unfair commercial practices.
• EU AI Act: Regulation (EU) 2024/1689, consolidated text.
• EU Digital Omnibus on AI: Regulation (EU) 2026/1744.
• European Commission AI Act guidance: Shaping Europe's Digital Future - AI regulatory framework.

22. Questions About AI Governance

For questions about MyOpsAgent's AI governance, security or compliance approach, contact:
Email: support@myopsagent.com
Address: Brighouse, West Yorkshire, United Kingdom
Company: Part of Plexity Limited, Company Number: 17161842

This overview is intended to explain the regulatory framework and MyOpsAgent's platform approach at a high level. Specific contractual, data-protection, sector, employment, safety or regulated-use requirements should be confirmed as part of the applicable customer assessment and, where appropriate, independent legal advice.

Terms and Conditions

These Terms and Conditions (“Terms”) govern your access to and use of the MyOpsAgent website, platform, APIs, and related services (“Services”). By accessing or using MyOpsAgent, you agree to be bound by these Terms. If you do not agree, you must discontinue use of the Services.

MyOpsAgent Ltd (“we”, “our”, “the Company”) provides a deterministic decision engine, operational console, AI‑assisted tooling, and integrations designed to support operational decision‑making. These Terms apply to all visitors, users, organisations, and authorised personnel who access or use the Services.

1. Definitions

“Platform” — The MyOpsAgent SaaS application, including the deterministic decision engine, console, APIs, and AI‑assisted features.

“User” — Any individual accessing the Services, including employees, contractors, or representatives of an organisation.

“Organisation” — The legal entity that owns the MyOpsAgent account and controls operational data.

“Operational Data” — Work items, resources, rules, constraints, capabilities, and other data uploaded to the Platform.

“Personal Data” — Information relating to an identifiable individual, as defined under GDPR and UK GDPR.

“AI‑Assisted Features” — Tools that interpret unstructured input or assist with scenario exploration. These features do not make final decisions.

2. Eligibility

You must be at least 18 years old and authorised by your organisation to use the Platform. By using MyOpsAgent, you confirm that you have the legal authority to accept these Terms.

3. Use of the Platform

You agree to use the Platform only for lawful purposes and in accordance with these Terms. You must not:

• Reverse engineer, decompile, or attempt to extract source code
• Bypass security, authentication, or access controls
• Upload harmful, malicious, or illegal content
• Use the Platform to violate laws, regulations, or third‑party rights
• Interfere with system integrity, performance, or availability
• Use the Platform for competitive analysis or to build a competing product

4. Deterministic Decision Engine

MyOpsAgent’s deterministic engine produces consistent, rule‑driven decisions based solely on the data provided. You acknowledge that:

• The engine does not use AI or probabilistic models to generate decisions
• All decisions are based on your organisation’s rules, constraints, and data
• You are responsible for the accuracy and completeness of the data you provide
• Decisions are immutable once generated and stored for audit purposes

5. AI‑Assisted Features

MyOpsAgent includes optional AI‑assisted tools that help interpret unstructured input or generate scenarios. These tools:

• Do not make final decisions
• Do not override your organisation’s rules or constraints
• Are provided “as‑is” and may occasionally produce inaccurate suggestions

6. Multi‑Tenant Architecture

MyOpsAgent operates on a secure, shared‑schema, multi‑tenant infrastructure. Each organisation’s data is isolated using strict access controls and database‑level separation. You agree not to attempt to access data belonging to another organisation.

7. Account Security

You are responsible for maintaining the confidentiality of your login credentials. You must notify us immediately if you suspect unauthorised access to your account.

8. Data Protection & Privacy

MyOpsAgent Ltd complies with GDPR, UK GDPR, the Data Protection Act 2018, and PECR. Our processing of personal data is governed by our Privacy Policy and, where applicable, our Data Processing Agreement (DPA).

Useful regulatory links:

• Information Commissioner’s Office (ICO)
• EU GDPR Portal
• European Data Protection Board

9. Intellectual Property

MyOpsAgent Ltd owns all intellectual property rights to the Platform, including the deterministic engine, console, AI‑assisted tooling, branding, design, and documentation. You may not copy, modify, distribute, or create derivative works without written permission.

10. Subscription & Billing

Access to the Platform is provided on a subscription basis. Billing, renewals, cancellations, and refunds are governed by our Subscription & Billing Terms.

11. Service Availability

We aim to provide high availability and reliable performance. However, we do not guarantee uninterrupted access. Planned maintenance, upgrades, or unforeseen outages may occur.

12. Acceptable Use

You must not use the Platform to:

• Upload unlawful, harmful, or offensive content
• Perform security testing without written permission
• Automate access in ways that degrade performance
• Violate data protection laws or third‑party rights

Full details are provided in our Acceptable Use Policy (AUP).

13. Limitations of Liability

To the fullest extent permitted by law, MyOpsAgent Ltd is not liable for:

• Indirect, incidental, or consequential damages
• Loss of revenue, profits, or business opportunities
• Operational delays or disruptions
• Decisions made based on inaccurate or incomplete data provided by you

Nothing in these Terms excludes liability where prohibited by law.

14. Termination

We may suspend or terminate access if you violate these Terms, misuse the Platform, or fail to pay subscription fees. You may terminate your account at any time.

15. Changes to These Terms

We may update these Terms to reflect changes in our services, technology, or legal obligations. Continued use of the Platform constitutes acceptance of the updated Terms.

16. Contact Us

Email: support@myopsagent.com
Address: Brighouse, West Yorkshire, United Kingdom
Company: Part of Plexity Limited, Company Number: 17161842

Effective Date: 3rd February 2026

MyOpsAgent Cookie Policy

This Cookie Policy explains how MyOpsAgent Ltd (“we”, “our”, “the Company”) uses cookies and similar tracking technologies on our website and platform. We are committed to transparency and compliance with the UK GDPR, EU GDPR, and the Privacy and Electronic Communications Regulations (PECR).

1. What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help us deliver a secure, reliable, and personalised experience. Cookies may be set by MyOpsAgent (first‑party cookies) or by trusted third‑party providers (third‑party cookies).

2. Why We Use Cookies

We use cookies to:

• Ensure smooth navigation and platform functionality
• Maintain session integrity and secure authentication
• Remember your preferences and settings
• Analyse usage patterns to improve performance
• Support integrations with analytics, monitoring, and security tools
• Provide a consistent experience across devices and browsers

3. Types of Cookies We Use

Strictly Necessary Cookies

• Required for core functionality, security, and access control
• Enable login sessions, multi‑tenant isolation, and platform navigation
• Cannot be disabled, as the platform will not function without them

Performance & Analytics Cookies

• Help us understand how users interact with the website and platform
• Improve speed, reliability, and user experience
• May include anonymised or aggregated usage data

Preference Cookies

• Store your language, theme, and interface preferences
• Enhance usability and reduce repetitive actions

Security Cookies

• Support authentication, fraud prevention, and access control
• Help detect unusual or malicious activity

Third‑Party Cookies

• Used by trusted providers such as analytics, monitoring, or support tools
• May track aggregated usage across sessions
• Never used for advertising or profiling without explicit consent

4. Cookie Consent

In accordance with GDPR and PECR, we request your consent for non‑essential cookies when you first visit MyOpsAgent. Our cookie banner allows you to:

• Accept all cookies
• Reject non‑essential cookies
• Customise your preferences

You may update or withdraw your consent at any time using the cookie settings link in our footer.

5. Managing Cookies

You can manage cookies through our preference centre or via your browser settings. Disabling certain cookies may impact functionality, including login, navigation, or access to interactive features.

6. Other Tracking Technologies

We may also use web beacons, pixels, scripts, and log files to:

• Monitor platform performance
• Detect errors or security issues
• Measure engagement and usage
• Support AI‑assisted features (never for advertising)

7. Third‑Party Services

Some cookies are set by trusted third‑party providers that support our platform, such as:

• Analytics and monitoring tools
• Cloud hosting and infrastructure providers
• Customer support and communication tools

All third parties must comply with GDPR and PECR. We do not permit third‑party advertising cookies.

8. Links to External Resources

For more information about cookies and your rights:

• ICO: Cookies and similar technologies
• ICO: PECR Cookie Guidance
• GDPR.eu: Cookies and GDPR
• All About Cookies
• Your Online Choices

9. Contact Us

For questions about our use of cookies or tracking technologies, contact us at:
Email: support@myopsagent.com
Address: Brighouse, West Yorkshire, United Kingdom
Company: Part of Plexity Limited, Company Number: 17161842

Effective Date: 3rd February 2026

Data Processing Agreement (DPA)

This Data Processing Agreement (“DPA”) forms part of the Terms and Conditions and governs the processing of personal data by MyOpsAgent Ltd (“Processor”, “we”, “our”) on behalf of the customer (“Controller”, “you”, “your organisation”) in accordance with the UK GDPR, EU GDPR, and the Data Protection Act 2018.

This DPA applies whenever MyOpsAgent Ltd processes personal data uploaded, submitted, or generated by your organisation through the MyOpsAgent platform, APIs, console, or related services (“Services”).

1. Definitions

“Personal Data” — Any information relating to an identified or identifiable natural person.

“Processing” — Any operation performed on personal data, including storage, access, transmission, or deletion.

“Controller” — The organisation that determines the purpose and means of processing personal data.

“Processor” — MyOpsAgent Ltd, when processing data on behalf of the Controller.

“Sub‑Processor” — A third party engaged by MyOpsAgent Ltd to process personal data.

“Operational Data” — Work items, resources, rules, constraints, capabilities, and other data uploaded to the platform.

2. Subject Matter

The Processor provides a deterministic decision engine, operational console, AI‑assisted tools, and related Services. This DPA governs how personal data is processed within those Services.

3. Duration

This DPA remains in effect for the duration of the Controller’s subscription and until all personal data has been deleted or returned in accordance with Section 12.

4. Nature and Purpose of Processing

The Processor processes personal data solely for the following purposes:

• Operating the deterministic decision engine
• Generating audit logs and decision records
• Supporting AI‑assisted interpretation of inputs
• Providing customer support and troubleshooting
• Maintaining platform security and integrity
• Improving performance, reliability, and user experience
• Complying with legal and regulatory obligations

5. Types of Personal Data Processed

• Identifiers (name, email address, phone number)
• Operational data containing personal identifiers (e.g., resource names)
• Usage logs, audit trails, and access records
• Technical data (IP address, device type, browser type)
• Support communications and metadata

6. Categories of Data Subjects

• Employees and contractors of the Controller
• End‑users interacting with the Controller’s systems
• Individuals referenced in operational data

7. Controller Responsibilities

The Controller is responsible for:

• Ensuring all personal data is collected lawfully
• Providing accurate and complete operational data
• Configuring rules, constraints, and access permissions
• Informing data subjects about processing activities
• Maintaining lawful basis for all data uploaded to the platform

8. Processor Obligations

MyOpsAgent Ltd agrees to:

• Process personal data only on documented instructions from the Controller
• Maintain confidentiality and ensure authorised personnel are bound by NDAs
• Implement appropriate technical and organisational security measures
• Assist the Controller with data subject requests
• Notify the Controller of personal data breaches without undue delay
• Provide audit logs and evidence of compliance upon request

9. Security Measures

Security measures include, but are not limited to:

• Encryption of data in transit and at rest
• Strict multi‑tenant isolation
• Role‑based access control (RBAC)
• Firewalls and intrusion detection systems
• Regular vulnerability scanning and penetration testing
• Comprehensive audit logging

10. Sub‑Processors

The Controller authorises MyOpsAgent Ltd to use GDPR‑compliant Sub‑Processors for hosting, analytics, infrastructure, and support services. A current list is available upon request.

The Processor will:

• Ensure Sub‑Processors meet GDPR requirements
• Remain fully liable for their actions
• Notify the Controller of any intended changes to Sub‑Processors

11. International Data Transfers

If personal data is transferred outside the UK/EU, the Processor will implement appropriate safeguards, including:

• Standard Contractual Clauses (SCCs)
• UK International Data Transfer Addendum
• GDPR‑compliant hosting regions

12. Data Deletion or Return

Upon termination of the Services, the Controller may request deletion or return of personal data. Unless legally required to retain data, the Processor will:

• Delete personal data within 90 days
• Provide confirmation of deletion upon request

13. Data Breach Notification

In the event of a personal data breach, the Processor will notify the Controller without undue delay, providing:

• The nature of the breach
• Categories and volume of affected data
• Likely consequences
• Mitigation steps taken or proposed

14. Audits and Compliance

The Controller may request audit reports or compliance documentation. On‑site audits may be permitted with reasonable notice and subject to confidentiality agreements.

15. Liability

Each party’s liability under this DPA is subject to the limitations set out in the main Terms and Conditions.

16. Governing Law

This DPA is governed by the laws of England and Wales.

17. Contact Information

Email: support@myopsagent.com
Address: Brighouse, West Yorkshire, United Kingdom
Company: Part of Plexity Limited, Company Number: 17161842

For GDPR data‑subject requests (access, correction, deletion), please email support@myopsagent.com.

Effective Date: 3rd February 2026

Data Retention Policy

This Data Retention Policy explains how MyOpsAgent Ltd (“we”, “our”, “the Company”) stores, retains, archives, and deletes personal and operational data processed through the MyOpsAgent platform. This policy is designed to comply with the UK GDPR, EU GDPR, the Data Protection Act 2018, and industry best practices for SaaS and enterprise systems.

1. Purpose of This Policy

The purpose of this policy is to ensure that:

• Data is retained only for as long as necessary
• Retention periods are clearly defined and justified
• Data is securely deleted or anonymised when no longer needed
• We comply with legal, regulatory, and contractual obligations
• Customers understand how long their data is stored

2. Scope

This policy applies to all data processed by MyOpsAgent Ltd, including:

• Personal data
• Operational data (work items, resources, rules, constraints)
• Audit logs and decision records
• Support communications
• System logs and analytics data

3. Categories of Data and Retention Periods

Different types of data are retained for different periods based on operational needs, legal requirements, and industry standards.

3.1 Account & Profile Data

• Retained for the duration of the customer’s subscription
• Deleted within 90 days after account closure

3.2 Operational Data

Includes work items, resources, capabilities, constraints, and rules.

• Retained for the duration of the subscription
• Deleted or anonymised within 90 days after termination

3.3 Decision Records

Decisions generated by the deterministic engine are immutable and stored for auditability.

• Retained for 7 years unless otherwise agreed
• May be anonymised upon request if legally permissible

3.4 Audit Logs

• Security logs: retained for 12 months
• Access logs: retained for 24 months
• System logs: retained for 12–36 months depending on purpose

3.5 Support Communications

• Retained for 24 months for quality and training
• May be retained longer if required for legal reasons

3.6 Billing & Financial Data

• Retained for 7 years to comply with tax and accounting laws

3.7 Backups

• Encrypted backups retained for 30–90 days
• Automatically purged on a rolling schedule

4. Data Minimisation

We only retain the minimum amount of data necessary to:

• Provide the Services
• Maintain auditability and operational integrity
• Meet legal and regulatory obligations

5. Secure Deletion

When data reaches the end of its retention period, it is securely deleted or anonymised using industry‑standard methods. This includes:

• Cryptographic erasure
• Secure deletion from active systems
• Automatic removal from backups after their retention window

6. Customer Requests

Customers may request:

• Deletion of personal data
• Export of operational data
• Anonymisation of historical records (where legally permissible)

Requests are processed in accordance with GDPR and our Data Processing Agreement (DPA).

7. Legal & Regulatory Requirements

Some data must be retained longer to comply with:

• Tax and financial regulations
• Audit and compliance obligations
• Security and fraud prevention requirements
• Contractual commitments

8. Exceptions

Retention periods may be extended if:

• A legal dispute is ongoing
• Data is required for regulatory investigations
• Retention is mandated by law

9. Compliance & Oversight

MyOpsAgent Ltd regularly reviews retention schedules to ensure compliance with:

• UK GDPR
• EU GDPR
• Data Protection Act 2018
• PECR

Useful regulatory links:

• Information Commissioner’s Office (ICO)
• EU GDPR Portal
• European Data Protection Board

10. Contact Information

For questions about this Data Retention Policy, contact:
Email: support@myopsagent.com
Address: Brighouse, West Yorkshire, United Kingdom
Company: Part of Plexity Limited, Company Number: 17161842

Effective Date: 3rd February 2026

Security Overview

MyOpsAgent is designed to give customers, staff and authorised decision-makers useful access to the business without giving every user, conversation or AI service unrestricted access to company systems or data.

The security model is based on separation: public information is kept separate from authenticated company access; users operate within organisation and role context; connected actions are exposed through controlled server-side tools; and language AI is separated from the logic used for governed operational decisions.

1. Public and Internal Access Are Different

A public-facing MyOpsAgent does not need the same access as an employee or manager. The platform is designed so different users can be given different views of the same organisation according to identity, permissions and the capabilities deliberately enabled for that context.

• Public visitors: can be limited to approved public knowledge and specifically exposed customer-facing actions.
• Authenticated staff: can access only the information and capabilities made available to their organisation and role.
• Managers and authorised users: can be given wider operational context where the organisation requires it.
• Internal operational detail: is not made public simply because the organisation also uses a website agent.

2. Organisation Separation

MyOpsAgent is a multi-organisation platform. Organisation context is carried through conversations, data access, enabled modules and server-side tools so one organisation's configuration is not treated as another organisation's context.

• Organisation identifiers are used to scope data and platform actions.
• Server-side validation is used rather than relying on a language model to determine tenant isolation.
• Enabled modules and tools are resolved in the context of the organisation using them.
• Connections and permitted actions can be restricted to the organisation for which they were configured.

3. Authentication, Sessions and Request Protection

MyOpsAgent uses application-level controls to protect authenticated access and browser requests. The exact controls used can depend on the feature or integration involved.

• HTTPS is required for production access and secure session cookies are used.
• Session and authentication checks are performed server-side.
• CSRF protection is used for applicable form and account actions.
• Origin and domain checks are used for public widget and cross-domain access.
• Rate limiting and request validation are used on relevant public and AI-facing endpoints.

4. Connected Systems and Credentials

MyOpsAgent is designed to connect to existing business systems without giving the conversational layer direct, unrestricted access to those systems.

• External actions are exposed through defined tools and application logic.
• Tools can be enabled or disabled by organisation and module entitlement.
• Sensitive integration credentials can be stored encrypted and used server-side.
• The language layer is not given database credentials or unrestricted system credentials as part of normal operation.

5. AI Is Not the Decision Authority

MyOpsAgent uses language AI where it is useful for understanding natural language, organising relevant context and explaining results in a human way. Governed business decisions can be handled separately by the platform's controlled application and decision logic.

• AI can interpret a question and help present the result.
• Operational state, permissions, rules and constraints can be evaluated inside MyOpsAgent rather than delegated to unrestricted model output.
• Connected actions are performed through approved server-side tools, not by giving a model open access to company systems.
• Where a workflow requires human approval, the platform can stop at the approval point before execution.

This separation is important: a natural-language answer can feel human while the business logic behind a controlled decision remains traceable and governed by the organisation's own configuration.

6. Decision Records and Auditability

Operational decision workflows are designed to retain structured records of what was evaluated and what happened next. Depending on the workflow, this can include the originating event, calculated impact, recommended plan, approval state, execution state and verification result.

• Decision and event records can be retained for later review.
• Approval and rejection states can be recorded separately from the recommendation itself.
• Execution and verification can be distinguished from the decision that authorised them.
• Rules and operational context remain part of the controlled platform rather than being represented only by a conversational answer.

7. Data Protection

MyOpsAgent is designed to minimise unnecessary exposure of company information by controlling which context is retrieved, which users can access it and which systems can be called. Network communication is protected using HTTPS/TLS, and sensitive application secrets or integration credentials can be encrypted before storage.

Personal and business data should be retained and deleted in accordance with the applicable MyOpsAgent privacy, retention and contractual terms. Customers remain responsible for ensuring that information they upload or connect is lawful and appropriate for the intended use.

8. Customer Responsibilities

• Restrict accounts and connected systems to authorised personnel.
• Use strong authentication practices and protect organisation credentials.
• Configure public knowledge separately from internal operational information.
• Review which tools, modules and actions are enabled for each use case.
• Ensure uploaded and connected data complies with applicable privacy, contractual and regulatory obligations.
• Report suspected security issues promptly.

9. Security Questions and Vulnerability Reports

For security enquiries or to report a suspected vulnerability, contact:
Email: support@myopsagent.com
Address: Brighouse, West Yorkshire, United Kingdom
Company: Part of Plexity Limited, Company Number: 17161842

This overview describes the security architecture and controls of the platform at a high level. Specific customer, hosting, retention or contractual requirements should be confirmed as part of the applicable agreement or security review.

Service Level Agreement (SLA)

This Service Level Agreement (“SLA”) forms part of the agreement between the Customer (“you”, “your organisation”) and MyOpsAgent Ltd (“we”, “our”, “the Company”). This SLA defines the service levels, uptime commitments, support response times, and responsibilities relating to the use of the MyOpsAgent platform (“Services”).

1. Scope of the SLA

This SLA applies to all paid subscription plans unless otherwise stated in a separate enterprise contract. Free or trial accounts are excluded from uptime guarantees and priority support.

2. Uptime Commitment

MyOpsAgent Ltd commits to a monthly uptime percentage of:

• 99.9% uptime for all paid plans

Uptime is calculated monthly and excludes:

• Scheduled maintenance (with at least 24 hours’ notice)
• Emergency maintenance required to protect security or stability
• Downtime caused by third‑party providers outside our control
• Issues caused by Customer systems, integrations, or misuse
• Force majeure events (natural disasters, outages, etc.)

3. Scheduled Maintenance

We may perform scheduled maintenance to improve performance, security, or reliability. When possible, maintenance will occur during low‑traffic periods and will be announced in advance.

4. Incident Response & Support

MyOpsAgent Ltd provides support through email and ticketing channels. Response times depend on the severity of the issue:

5. Customer Responsibilities

To ensure service quality, the Customer agrees to:

• Provide accurate and complete operational data
• Maintain secure access credentials
• Ensure integrations and third‑party systems are functioning correctly
• Report issues promptly with sufficient detail
• Use the platform in accordance with the Acceptable Use Policy

6. Service Credits

If uptime falls below the guaranteed level, you may be eligible for service credits.

Service credits:

• Must be requested within 30 days of the incident
• Are applied to future invoices (not refunded)
• Do not apply to free or trial accounts

7. Exclusions

This SLA does not apply to downtime or issues caused by:

• Customer misuse or configuration errors
• Third‑party integrations or external systems
• Internet or network failures outside our control
• Force majeure events
• Beta features or experimental tools

8. Security & Data Protection

MyOpsAgent Ltd maintains strict security controls, including encryption, multi‑tenant isolation, access controls, and continuous monitoring. Data protection is governed by our Privacy Policy and Data Processing Agreement (DPA).

9. Support Availability

Standard support hours:

• Monday–Friday
• 09:00–17:00 (UK time)
• Excluding UK public holidays

Enterprise plans may include extended support hours or dedicated support channels.

10. Changes to This SLA

We may update this SLA to reflect improvements, service changes, or legal requirements. Updates will be communicated in advance where possible.

11. Contact Information

Email: support@myopsagent.com
Address: Brighouse, West Yorkshire, United Kingdom
Company: Part of Plexity Limited, Company Number: 17161842

Effective Date: 3rd February 2026

Subscription & Billing Terms

These Subscription & Billing Terms (“Terms”) govern paid access to the MyOpsAgent platform and form part of the agreement between you (“Customer”, “Organisation”) and MyOpsAgent Ltd (“we”, “our”, “the Company”). By subscribing to or using any paid features of MyOpsAgent, you agree to these Terms.

1. Subscription Plans

MyOpsAgent is offered on a subscription basis. Plan features, usage limits, and pricing are displayed at the point of purchase or on our pricing page. We reserve the right to update or modify plans at any time, with reasonable notice provided to active subscribers.

• Plans may include usage limits (e.g., number of decisions, users, or API calls)
• Exceeding limits may result in additional charges or service restrictions
• Enterprise plans may include custom terms agreed in writing

2. Billing Cycle

Subscriptions are billed either monthly or annually, depending on the plan selected. Billing begins on the date you subscribe and renews automatically unless cancelled.

• Monthly subscriptions renew every 30 days
• Annual subscriptions renew every 12 months
• Invoices are issued electronically

3. Payment Methods

Payments must be made using approved payment methods (e.g., credit/debit card, bank transfer, or other supported processors). You authorise us to charge your payment method for recurring subscription fees.

If a payment fails:

• We may retry the charge multiple times
• We may suspend access until payment is successful
• We may terminate the subscription if payment remains outstanding

4. Taxes

Prices may be subject to VAT, sales tax, or other applicable taxes based on your location. You are responsible for paying all required taxes unless otherwise stated.

5. Price Changes

We may update subscription pricing from time to time. Any changes will apply at the start of your next billing cycle. You will be notified in advance and may cancel before renewal if you do not agree to the updated pricing.

6. Upgrades & Downgrades

You may upgrade or downgrade your subscription at any time.

• Upgrades: Charged immediately at a prorated rate
• Downgrades: Take effect at the next renewal date

Downgrading may result in loss of features, reduced limits, or restricted access.

7. Cancellations

You may cancel your subscription at any time through your account settings or by contacting support. Cancellation stops future billing but does not provide refunds for the current billing period.

• Access continues until the end of the paid period
• After expiration, your account may be downgraded to a free tier (if available)
• Data retention rules apply as described in our Privacy Policy

8. Refunds

MyOpsAgent Ltd does not offer refunds for partial billing periods, unused time, or unused features. Refunds are only issued where required by law or under exceptional circumstances at our discretion.

9. Free Trials

We may offer free trials for certain plans. Trial duration and eligibility are displayed at signup. When the trial ends:

• Your subscription will automatically convert to a paid plan unless cancelled
• You authorise us to charge your payment method at the listed rate

10. Account Suspension

We may suspend or restrict access if:

• Payments are overdue
• You violate our Terms & Conditions or Acceptable Use Policy
• Your usage poses a security or operational risk

We will make reasonable efforts to notify you before suspension unless immediate action is required.

11. Termination

We may terminate your subscription for:

• Repeated non‑payment
• Serious or repeated violations of our policies
• Fraudulent or abusive activity

Upon termination, access to the Platform will cease, and data may be deleted in accordance with our Data Retention Policy.

12. Data Ownership

You retain ownership of all operational and personal data uploaded to the Platform. MyOpsAgent Ltd acts as a Processor under GDPR when handling your data.

Data processing is governed by our Data Processing Agreement (DPA).

13. Service Modifications

We may update, enhance, or modify the Platform at any time. Significant changes will be communicated in advance where possible.

14. Limitation of Liability

To the fullest extent permitted by law, MyOpsAgent Ltd is not liable for:

• Indirect, incidental, or consequential damages
• Loss of revenue, profits, or business opportunities
• Operational delays or disruptions
• Decisions made based on inaccurate or incomplete data provided by you

15. Contact Us

Email: support@myopsagent.com
Address: Brighouse, West Yorkshire, United Kingdom
Company: Part of Plexity Limited, Company Number: 17161842

Effective Date: 3rd February 2026

Acceptable Use Policy (AUP)

This Acceptable Use Policy (“AUP”) governs how users (“you”, “your organisation”) may access and use the MyOpsAgent platform, website, APIs, and related services (“Services”). This AUP forms part of the Terms and Conditions between you and MyOpsAgent Ltd (“we”, “our”, “the Company”).

By using the Services, you agree to comply with this AUP. If you violate this policy, we may suspend or terminate your access to the Services.

1. General Principles

You must use the Services responsibly, lawfully, and in a manner that does not harm the platform, other users, or the integrity of MyOpsAgent’s deterministic decision engine and multi‑tenant infrastructure.

2. Prohibited Activities

You must not use the Services to engage in any of the following activities:

• Illegal activities: Uploading, transmitting, or processing data that violates any law or regulation.
• Security violations: Attempting to bypass authentication, access controls, or multi‑tenant boundaries.
• Reverse engineering: Attempting to extract source code, algorithms, or internal logic of the deterministic engine.
• Malicious behaviour: Uploading malware, viruses, or harmful scripts.
• Interference: Actions that degrade performance, disrupt service availability, or overload infrastructure.
• Data misuse: Uploading personal data without a lawful basis under GDPR or UK GDPR.
• Impersonation: Misrepresenting your identity or affiliation.
• Automated abuse: Using bots or scripts to excessively call APIs or generate load.
• Competitive misuse: Using the platform to build, train, or benchmark competing products.
• Harassment or abuse: Using the Services to harass, threaten, or harm others.

3. Operational Data Requirements

You are responsible for ensuring that all operational data uploaded to the platform:

• Is accurate, lawful, and relevant to your operations
• Does not infringe third‑party rights
• Does not contain sensitive personal data unless strictly necessary
• Is processed in compliance with GDPR and UK GDPR

MyOpsAgent’s deterministic engine relies on the accuracy of your data. Incorrect or incomplete data may lead to incorrect decisions, for which you are solely responsible.

4. AI‑Assisted Features

MyOpsAgent includes optional AI‑assisted tools that help interpret unstructured input. You must not:

• Use AI features to generate harmful, illegal, or misleading content
• Rely on AI outputs as final decisions (the deterministic engine is the only decision source)
• Upload sensitive personal data for AI processing unless legally justified

5. Security Responsibilities

You must take reasonable steps to secure your account and data, including:

• Using strong, unique passwords
• Restricting access to authorised personnel only
• Not sharing login credentials
• Not attempting to access other organisations’ data

You must notify us immediately if you suspect unauthorised access or a security breach.

6. API Usage

When using MyOpsAgent APIs, you must:

• Authenticate using approved methods
• Respect rate limits and usage thresholds
• Not attempt to scrape, harvest, or extract data outside your organisation
• Not automate excessive or abusive traffic

7. Prohibited Content

You must not upload or transmit content that:

• Is unlawful, defamatory, or discriminatory
• Contains hate speech or harassment
• Contains explicit or harmful material
• Violates intellectual property rights
• Contains sensitive personal data without lawful basis

8. Monitoring & Enforcement

MyOpsAgent Ltd may monitor usage for security, compliance, and performance purposes. We may take action if this AUP is violated, including:

• Warning notices
• Temporary suspension
• Permanent account termination
• Legal action where required

9. Reporting Violations

If you believe this AUP has been violated, please contact us immediately at:

Email: abuse@myopsagent.com

10. Changes to This Policy

We may update this AUP to reflect changes in our services, technology, or legal obligations. Continued use of the Services constitutes acceptance of the updated policy.

11. Contact Information

Email: support@myopsagent.com
Address: Brighouse, West Yorkshire, United Kingdom
Company: Part of Plexity Limited, Company Number: 17161842

Effective Date: 3rd February 2026