Privacy Policy

1. Data We Collect

1.1 Account and Registration Data

• Name and email address.
• Password (stored in hashed form — we never store plain-text passwords).
• Business name and other profile information you choose to provide.

1.2 Brand Kit and Website Data

• The URL(s) of the website(s) you provide in your Brand Kit.
• Publicly available content from your website that our system accesses and analyses to learn your voice, tone, and terminology. This data is used solely to generate content drafts that match your style.
• Any brand guidelines, style notes, or additional instructions you enter into your Brand Kit.

1.3 Content Data

• AI-generated draft articles and your edits to those drafts.
• Content you have approved and published via the Service.
• Content version history and approval records.

1.4 Usage and Technical Data

• Log data: IP address, browser type and version, operating system, referring URL, pages visited, and timestamps.
• Feature usage: which features you use, how often, and when.
• Device type, screen resolution, and related technical identifiers.

1.5 Payment and Billing Data

• Subscription plan, status, and billing history.
• We do not store your payment card details. All payment processing is handled by our Merchant of Record, Paddle.com Market Limited, which applies its own data protection practices.

1.6 Communications Data

• Messages you send us via the contact form or email, including support requests.
• Transactional emails (account confirmation, notifications, billing receipts).

1.7 Cookies and Tracking Data

Please see our Cookie Policy for full details on how we use cookies and similar technologies.

2. Legal Basis for Processing (GDPR)

For users in the EU/EEA, we process personal data on the following legal bases under GDPR Article 6:

• Performance of a contract (Art. 6(1)(b)): Account data, Brand Kit data, content data, and service delivery data are processed to provide the Service under our Terms of Service.
• Legitimate interests (Art. 6(1)(f)): Usage and log data are processed to maintain security, prevent fraud, troubleshoot technical issues, and improve the Service. Our legitimate interests are balanced against your rights and do not override them.
• Legal obligation (Art. 6(1)(c)): Billing records may be retained to comply with applicable tax and accounting laws.
• Consent (Art. 6(1)(a)): Marketing communications and non-essential cookies are only used with your consent, which you may withdraw at any time.

3. How We Use Your Data

We use your personal data to:

• Create and manage your account.
• Provide the Service, including scanning your Brand Kit website to generate content drafts that match your voice.
• Publish approved content to your domain via the Cloudflare integration.
• Process subscription payments through Paddle.
• Send transactional emails (account verification, billing receipts, notifications).
• Respond to support requests and enquiries.
• Monitor, maintain, and improve the security and performance of the Service.
• Comply with legal obligations and enforce our Terms of Service.
• Send product updates and marketing communications where you have consented.

We do not sell your personal data to third parties for their own marketing or commercial purposes.

We do not use your content to train general-purpose AI models. Your Brand Kit content and generated drafts are used solely to provide the Service to you.

4. Data Sharing and Third-Party Processors

We share your data with the following third-party service providers solely to deliver and operate the Service:

• Supabase, Inc. (United States): Database hosting and user authentication.
• Paddle.com Market Limited (United Kingdom): Subscription billing and payment processing as our Merchant of Record.
• Cloudflare, Inc. (United States): Content delivery and website integration for publishing approved content to your domain.
• AI processing providers: Third-party AI models process your Brand Kit content and generate drafts. We use providers that have entered into appropriate data processing agreements and process your data only to generate content for you.
• Email delivery providers: Transactional email services for account notifications and billing receipts.

We require all processors to sign data processing agreements consistent with GDPR and applicable privacy laws, and to process personal data only as instructed by us.

We may also disclose personal data where required by law, court order, or regulatory authority, or to protect the rights, property, or safety of Ampifex, our users, or others.

5. International Data Transfers

We are an Estonian company and our primary data infrastructure is within the EEA. However, some of our third-party processors are located outside the EEA, including in the United States. When we transfer your personal data outside the EEA, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Adequacy decisions where applicable.

For users in other countries, we apply equivalent safeguards appropriate to your jurisdiction. You may request information about the specific transfer mechanisms applicable to your data by contacting us at privacy@ampifex.com.

6. Data Retention

• Account data: Retained for the duration of your subscription, plus up to 30 days after account deletion to allow for recovery.
• Content data: Retained for the duration of your subscription. You may export all approved content at any time. Content is deleted within 30 days of account deletion.
• Billing records: Retained for up to 7 years as required by Estonian accounting law.
• Log and usage data: Retained for up to 12 months.
• Support communications: Retained for up to 2 years.

When data is no longer required, we securely delete or anonymise it.

8. Your Rights — California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioural advertising. You do not need to opt out.
• Right to Limit Use of Sensitive Personal Information: We do not use or disclose sensitive personal information for purposes other than those permitted by the CPRA.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise your California rights, contact us at privacy@ampifex.com or submit a request via our contact form. We will respond within 45 days, with a possible extension of a further 45 days where necessary. We will verify your identity before fulfilling your request.

Categories of personal information collected (CCPA categories): Identifiers (name, email, IP address); Commercial information (subscription and billing records); Internet or other electronic network activity (usage logs, feature interactions); Professional or employment-related information (business name, website URL); Content generated and managed through the Service.

9. Your Rights — Other Jurisdictions

Depending on where you live, you may have additional rights under applicable local privacy law:

• Canada (PIPEDA/provincial laws): Rights to access and correct your personal information held by us, and to withdraw consent for non-essential processing.
• United Kingdom (UK GDPR): The same rights as described in the EU/EEA section above, enforceable with the UK Information Commissioner's Office (ICO).
• Other countries: We aim to respect applicable privacy law wherever you are located. Contact us at privacy@ampifex.com to exercise any rights you may have.

10. Data Security

We implement appropriate technical and organisational security measures to protect your personal data, including:

• Encryption of data in transit (TLS/HTTPS).
• Encryption of data at rest.
• Access controls restricting data access to authorised personnel only.
• Regular security reviews and assessments.
• Hashed password storage — we never store plain-text passwords.

Despite these measures, no electronic transmission or storage system is completely secure. We will notify you and relevant supervisory authorities of any data breach as required by applicable law.

11. Children's Privacy

The Service is not directed to individuals under the age of 18 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us at privacy@ampifex.com and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a prominent notice within the Service before the changes take effect. The "Last updated" date at the top of this page will always reflect the most recent revision.

13. Contact Us

For any privacy-related questions, requests, or concerns, please contact us:

We aim to respond to all privacy enquiries within 30 days of receipt.