Public information required by EU law

Data Act and DSA disclosures

Last updated: 2 November 2026 · Version 1.0

AffiliateManagersAI Ltd is being incorporated in Cyprus. Until incorporation and opening of its bank account AMAI does not take any payments.

This document is written in English. The English version is the binding version.

Part A: Switching, data export and data location (EU Data Act)

A.1 About this part

A.1.1 This part gives the information that AffiliateManagersAI Ltd ("AMAI") provides as a provider of data processing services under Regulation (EU) 2023/2854 (the "Data Act"). It applies to customers with a paid subscription or a Paid Pilot of the AMAI Service. The binding terms are in Schedule C of our Terms of Service and in the Order Form; if this page and the contract differ, the contract applies.

A.1.2 Free evaluations. The trial day and invited evaluations are free, time-limited, non-production versions of the Service provided for testing and evaluation. Under Article 31 of the Data Act, the switching obligations of Chapter VI do not apply to them. The Evaluation Terms provided with an invitation explain how evaluation data can be exported and when it is deleted.

A.2 How to switch to another provider or to your own systems

A.2.1 Start. You can request switching or a full export at any time by email to amai@amai.team (subject: Data Act switching request) or in the Account settings. You choose the notice period, which is at most two months.

A.2.2 Transition period. After the notice period, a transition period of up to 30 calendar days begins. During it we keep the Service running for you with the same level of security, give reasonable assistance (including the exports listed below) and tell you about any known risks to the continuity of the service or of your data. If a 30-day transition is technically not feasible, we tell you within 14 working days of your request, give reasons and propose an alternative period of no more than 7 months. You may extend the transition period once.

A.2.3 Retrieval period. After the transition period, or after your subscription ends without a switching request, you have at least 30 calendar days to retrieve your data. The archived workspace is kept for 90 days, with export-only access.

A.2.4 Erasure. At the end of that period we delete the archived workspace with your exportable data and digital assets. Backup copies expire within 14 days. If you ask for erasure earlier, correspondence stays available for up to 30 days where it may lawfully be kept, and is then deleted. We confirm erasure on request.

A.2.5 End of contract. Your contract ends when the switching process is completed and we have told you so, or at the end of the notice period if you only want to terminate and erase.

A.2.6 Charges. AMAI does not charge switching or data egress fees. Fees agreed for a fixed term in an Order Form remain governed by clause 7.5 of the Terms and your Order Form; they are service fees, not switching charges.

A.2.7 Exit support. On request we provide an exit call, documentation of the export formats and reasonable help to your new provider.

A.3 Exports and formats

A.4 Data not included in exports

The following are not exportable data within the meaning of the Data Act, or are protected by AMAI's or third parties' intellectual property rights or trade secrets:

• the AMAI Partner Catalog database as such; your own copies of admitted Catalog records and everything you added about them are exported with your CRM data;
• AMAI's source code, prompts, prompt configurations, guardrail rules, scoring and ranking rules, and models;
• session credentials of connected Telegram accounts and encryption keys;
• aggregated statistics that do not identify you or any person;
• AMAI's security and diagnostic logs.

A.5 Where our infrastructure is located

A.5.1 Platform hosting. The hosting provider of the platform and the location of production hosting, backups and file storage will be stated in Annex 3 of the DPA before the paid launch. This information is available now on request at amai@amai.team.

A.5.2 AI provider. AI processing uses models provided by OpenAI. OpenAI and its affiliates may process data outside the EEA, including in the United States.

A.5.3 Company. AMAI is based in Limassol, Republic of Cyprus.

A.6 Measures against unlawful governmental access

A.6.1 AMAI takes the following measures to prevent international governmental access to, and transfer of, non-personal data held in the EU where this would conflict with Union or Member State law (Article 32 of the Data Act):

• encryption: data is encrypted in transit; Telegram session credentials and Deal Room files are encrypted with separate keys;
• access control: least-privilege access for AMAI personnel;
• request handling: any request from a non-EU authority is reviewed before any disclosure; we disclose data only if the request is based on an international agreement (such as a mutual legal assistance treaty) or otherwise meets the conditions of Article 32 of the Data Act; we challenge requests we consider unlawful, disclose only the minimum necessary, and inform the customer before disclosure unless the request is lawfully confidential;
• no voluntary disclosure: we do not disclose customer data to authorities on a voluntary basis.

A.6.2 Personal data is additionally protected under the GDPR rules on international transfers (see our Privacy Policy and DPA).

Part B: Digital Services Act information

B.1 Our service

B.1.1 AMAI stores information provided by its users (customers in the web app and Partners in Deal Rooms in the Partner Hub) at their request. For the purposes of Regulation (EU) 2022/2065 (the "Digital Services Act" or "DSA"), AMAI is a provider of a hosting service. AMAI is not an online platform: information in the Service is not disseminated to the public. AMAI is a micro enterprise.

B.1.2 Rules on what content is allowed, and how we moderate it, are set out in our Terms of Service (clause 13), our Acceptable Use Policy and the Partner Hub Terms (Article 14 DSA).

B.2 Single point of contact for authorities (Article 11)

• Email: amai@amai.team (subject: DSA authority contact)
• Languages: English and Greek
• Postal address: the registered office of AffiliateManagersAI Ltd, which will be added to this page on incorporation

Member State authorities, the European Commission and the European Board for Digital Services may use this contact for direct communication. Orders to act against illegal content or to provide information (Articles 9 and 10 DSA) are processed without undue delay, and we inform the issuing authority of the effect given to the order.

B.3 Single point of contact for users (Article 12)

• Email: amai@amai.team; for reports of illegal content or abuse, use the subject "Abuse report"
• Languages: English and Russian
• Your message is handled by a person, not only by automated tools.

B.4 Legal representative

Not required: AMAI is established in the European Union (Cyprus).

B.5 How to report illegal content (notice and action, Article 16)

B.5.1 Anyone may report information in the Service that they consider illegal, for example promotion of unlicensed gambling, gambling advertising aimed at minors, fraud or scams, intellectual property infringement, or unlawful use of personal data, by email to amai@amai.team with the subject "Abuse report".

B.5.2 Please include:

• an explanation of why you consider the information illegal, with sufficient detail;
• the exact location: Deal Room link or ID, message or time, file name, or a screenshot that identifies it, and any additional information needed to identify the content;
• your name and email, except for reports concerning offences referred to in Articles 3 to 7 of Directive 2011/93/EU (child sexual abuse), which may be anonymous;
• a statement that you confirm in good faith that the information and allegations in your report are accurate and complete;
• optionally, the legal provision you rely on, your relationship to the content (for example rights holder or recipient of a message) and attachments.

B.5.3 What happens next:

• we confirm receipt without undue delay, by email;
• we review the report in a timely, diligent, non-arbitrary and objective manner; a report that meets the requirements above is treated as giving us actual knowledge of the information concerned;
• we tell you our decision without undue delay and explain how you can seek redress;
• we tell you if automated means were used to process or decide on the report.

B.6 Statement of reasons (Article 17)

B.6.1 If we restrict information provided by a user (by removing it, disabling access to it, restricting its visibility, or suspending or terminating the user's access to the Service or a Deal Room) on the ground that it is illegal or incompatible with our terms, we give the affected user a clear and specific statement of reasons, at the latest when the restriction takes effect, unless we do not have the user's electronic contact details or the information is deceptive high-volume commercial content.

B.6.2 The statement includes:

• the restriction imposed, its territorial scope and its duration;
• the facts and circumstances relied on, including whether the decision was taken following a report;
• whether automated means were used in detecting the content or taking the decision;
• where the information is considered illegal, the legal ground and why the information is considered illegal on that ground;
• where the decision is based on our terms, the contractual ground and why the information is incompatible with it;
• how to seek redress: you can ask AMAI to review the decision by replying to the statement, and a person not involved in the original decision reviews it; you can also bring proceedings before the competent courts.

B.7 Reporting of criminal offences (Article 18)

If we become aware of information giving rise to a suspicion that a criminal offence involving a threat to the life or safety of a person has taken place, is taking place or is likely to take place, we promptly inform the law enforcement or judicial authorities of the Member State concerned (or, if unclear, of Cyprus or Europol) and provide all relevant information available.

B.8 Supervisory authority

The competent authority for AMAI under the DSA is the Digital Services Coordinator of the Republic of Cyprus.

B.9 Transparency reporting

As a micro enterprise that is not a very large online platform, AMAI is not required to publish annual transparency reports under Article 15 DSA (Article 15(2)). We keep internal records of reports and decisions.

Part C: AI in the Service

C.1 What the AI does. The AI Features of AMAI draft first messages to new partners, write replies to partners within the customer's policy, translate messages and keep a structured record of facts agreed in a partner room.

C.2 Models. AI processing uses models provided by OpenAI.

C.3 Customer control. The customer sets the autonomy level and the policy, and the AI assistant replies to partners only within that policy. Approval of the first message to each new partner is switched on by default. An emergency stop for all automation is available on all plans.

C.4 Partner consent and disclosure. The AI assistant works in a partner room only after the partner's consent to the service. The partner is told that replies may be written by an AI assistant.

C.5 No training. Customer data is not used to train AI models. The ordinary Telegram correspondence of connected accounts is not used as AI input or for training.

C.6 Roles under the AI Act. AMAI is the provider of the AI system integrated in the Service; the customer is a deployer when it uses that system under its authority (clause 11.4 of the Terms).

Contact

Switching, exports, DSA and AI questions: amai@amai.team. This page is written in English. The English version is the binding version.