New SaaS privacy policy

This Privacy Policy is incorporated by reference into, and forms a part of, our Terms of Service.By using our Services, you agree to be bound by this Privacy Policy and our Terms of Service. In the event of any conflict between this Privacy Policy and the Terms of Service, the Terms of Service shall prevail to the extent permitted by applicable law.

This Privacy Policy is incorporated by reference into, and forms a part of, our Terms of Service.

Who We Are

Who We Are

Cognit Consulting AB

Cognit Consulting AB

Swedish corporation ID: 559010-4021

Swedish corporation ID: 559010-4021

Varholmsgatan 2a, 414 74 Göteborg, Sweden

Varholmsgatan 2a, 414 74 Göteborg, Sweden

info@ampliflow.com

info@ampliflow.com

-

We are the controller for AmpliFlow SaaS accounts and service operation. For customer content processed on your organisation's behalf, we act as processor under your instructions and the applicable data-processing agreement.

-

Website visits and marketing inquiries are covered by our website privacy policy.

What Data We Collect

What Data We Collect

We collect business-related information that you or your company provide to us when using AmpliFlow, including:

We collect business-related information that you or your company provide to us when using AmpliFlow, including:

- Name, email, company name, and job title

- Name, email, company name, and job title

- Login/account credentials

- Login/account credentials

- Usage data (e.g., logs, activity and actions within the platform)

- Usage data (e.g., logs, activity and actions within the platform)

- Communications with us (e.g., support requests)

- Communications with us (e.g., support requests)

- Marketing preferences

We also collect data automatically via analytics tools (see the "Cookies and Tracking Technologies" section below).

We may also collect data automatically via analytics tools (see the "Cookies and Tracking Technologies" section below).

We collect information when you:

Additional data collection may occur when you:

- Create or use an AmpliFlow account

- Register online or place an order for our products or services

- Provide feedback or contact support about the Service

- Complete surveys or provide feedback (including via message boards or email)

-

- Enter or upload data into your AmpliFlow account

- Enter or upload data into your AmpliFlow account

- Use or view our website or the SaaS application, which may result in information being gathered through cookies or log data

- Use the SaaS application, which collects information through cookies or log data

- Use optional AI features, where AmpliFlow sends task-specific context to the approved AI provider

- Use optional AI features, where AmpliFlow sends task-specific context to the approved AI provider

Cognit Consulting AB will process personal data only as documented in the Terms of Service, this Privacy Policy, and as otherwise required by law. Cognit Consulting AB is not obliged to accept or act on individual instructions from customers outside of the scope of these documents.

Required account fields are identified when collected; without them we cannot provide the requested account access.

Log Data

Log Data

When you use our Service, we automatically collect certain technical and usage information ("Log Data"). This may include:

When you use our Service, we automatically collect certain technical and usage information ("Log Data"). This includes:

- Your computer's IP address

- Your computer's IP address

- Browser type and version

- Browser type and version

- Pages visited on our Service

- Pages visited on our Service

- Time and date of your visit

- Time and date of your visit

- Time spent on those pages

- Time spent on those pages

- Other usage statistics

- Other usage statistics

We log platform usage with Microsoft Azure Application Insights, Sentry (self-hosted), and Pendo .

-

Cookies and Tracking Technologies

Cookies and Tracking Technologies

Cookies are small data files stored on your device. We use cookies and similar technologies to:

Cookies are strictly necessary for the core platform to function (for example, for authentication and essential security).

- Remember your preferences

Usage analytics and technical logs help us resolve failures and improve the Service.

- Analyze usage patterns

-

- Support authentication and security

-

- Improve our website and platform experience

-

On www.ampliflow.com (our website):

-

The website does not use cookies. Website analytics are handled by Rybbit, a self-hosted, cookieless analytics tool running on our own servers. Rybbit collects anonymous visitor statistics: page views, navigation patterns, outbound link clicks, and campaign parameters such as UTM tags from ads. We use this to see which content and campaigns visitors find relevant. No personal data is collected and no data is shared with third parties.

-

On the AmpliFlow SaaS application:

-

Cookies are strictly necessary for the core platform to function (for example, for authentication and essential security). You cannot refuse these necessary cookies in the SaaS application. If you do not wish to accept these cookies, please discontinue use of the SaaS application.

-

Types of cookies and tracking used:

-

- Essential cookies: Required for authentication, security, and core platform functionality

-

- Analytics (app): Microsoft Azure Application Insights, Pendo

-

- Analytics (website): Rybbit (self-hosted on our own servers and cookieless, collects anonymous page views, navigation, outbound clicks, campaign parameters such as UTM tags, and JavaScript errors)

-

How to manage cookies:

-

The website does not use cookies. For the SaaS application, cookies are necessary for authentication and security and cannot be refused.

-

How We Use Your Data

How We Use Your Data

We use your personal data to:

We use your personal data to:

- Provide, manage, and improve the AmpliFlow Service

- Provide, manage, and improve the AmpliFlow Service

- Communicate with you about your account, billing, and support

- Communicate with you about your account, billing, and support

- Send marketing communications about our products and services (you can opt out at any time)

-

- Comply with legal obligations

- Comply with legal obligations

- Provide optional AI features when a tenant administrator has enabled AI and approved the selected provider

- Establish, exercise or defend legal claims

-

- Provide optional AI features

We do not sell your personal data.

We do not sell your personal data.

Legal Basis for Processing (GDPR)

Legal Basis for Processing (GDPR)

We process your data based on:

We process your data based on:

- Contract (providing our service to you or your company)

- Contract (providing our service to you or your company)

- Legitimate interest (improving and securing our service, marketing to business contacts)

- Legitimate interest (improving and securing our service, handling legal claims)

- Legal obligations

- Legal obligations

-

For business users who are not personally party to the service contract, we rely on our legitimate interest in providing the service to their organisation.

Data Storage and Transfers

Data Storage and Transfers

Your data is stored on cloud and data center infrastructure within the EU/EEA:

We use cloud and data center infrastructure within the EU/EEA:

- Microsoft Azure: West Europe (Netherlands) and Sweden Central (Gävle, Sweden).We rely on Microsoft Azure's compliance program (ISO 27001, SOC 1/2/3, GDPR).

- Microsoft Azure: West Europe (Netherlands) and Sweden Central (Gävle, Sweden).

- Hetzner Online GmbH: Data centers in Germany and Finland (EU).Used for internal business systems such as CRM and customer support tools. We use Hetzner under GDPR Article 28 processor terms.

- Hetzner Online GmbH: Data centers in Germany and Finland (EU).

Core AmpliFlow service data is not transferred outside the EU/EEA in normal operation. Optional AI features are separate: if a tenant administrator approves an AI provider outside the EU/EEA, task-specific AI request data may be transferred to that provider. Appropriate safeguards such as Standard Contractual Clauses, adequacy decisions, or another valid transfer mechanism are applied in line with GDPR requirements.

AI request data is processed at the locations used by the selected provider. Transfers outside the EU/EEA require a valid mechanism, such as an adequacy decision or Standard Contractual Clauses. Contact info@ampliflow.com for the recipients and safeguards applicable to your information.

Data Sharing

Data Sharing

We only share potentially sensitive data with service providers who support our platform.

We use service providers who support our platform:

For the website www.ampliflow.com:

- Microsoft Azure: Hosting, security, and log data

- Rybbit: Self-hosted cookieless analytics running on our own servers (collects anonymous visitor statistics including campaign parameters, no personal data collected)

- Mailgun: Email delivery service, including recipient addresses and message content

- MailerLite: Newsletter delivery

- Hetzner Online GmbH: Hosting infrastructure

For the SaaS product AmpliFlow:

-

- Microsoft Azure: Hosting, security, and log data (via Application Insights)

-

- Pendo: Usage analytics to help us improve the service

-

- Mailgun: Email delivery service

-

For internal business systems (CRM, customer support):

-

- Hetzner Online GmbH: Data center infrastructure in Germany and Finland (EU), hosts our CRM and customer support systems where we store business contact information such as names, email addresses, and communication history

-

Optional AI providers:

Optional AI providers:

If your tenant administrator enables AI and approves a provider, task-specific content may be processed by the selected AI provider solely to provide the AI response. Approved provider options may include Berget AI AB, OpenAI, LLC, Google LLC, Mistral AI, Anthropic PBC, or additional AI or cloud vendors specified at the time of opt-in. No AI provider is enabled by default.

When you use an enabled AI feature, AmpliFlow sends only the context needed for that specific task to the selected AI provider, solely to provide the AI response. The providers are Berget AI AB and OpenAI, LLC.

AI request data may include prompts, selected context from your AmpliFlow account, referenced business content, user identifiers, tenant metadata, technical request metadata, and generated responses. We send only the context needed for the specific AI task, not the entire database.

AI request data includes prompts, selected context from your AmpliFlow account, referenced business content, user identifiers, tenant metadata, technical request metadata, and generated responses. The information processed depends on the task. Provider retention and processing location depend on the selected provider and account configuration.

Provider retention and training posture depends on the selected provider and project settings. OpenAI states that API data is not used to train or improve models by default unless the customer opts in, and that abuse-monitoring logs may retain prompts and responses for up to 30 days by default unless a different approved control applies or longer retention is legally required. Berget states in its terms that it does not store actual prompt content or output from hosted LLMs.

-

Authorities:

Authorities:

We may share information with authorities if required by law.

We share information with authorities when required by law.

Third-Party Links

-

Our Service may contain links to third-party websites. We are not responsible for the content or privacy practices of these sites. Please review their privacy policies before providing any personal information.

-

Security

Security

We use commercially acceptable means to protect your personal information, but no internet or electronic storage method is 100% secure. We cannot guarantee absolute security.

We use commercially acceptable means to protect your personal information.

Children's Privacy

-

Our Services are not directed at children under 13. We do not knowingly collect personal information from children under 13. If we learn a child has provided us with personal data, we will delete it promptly. If you are a parent or guardian and believe your child has provided us with personal data, please contact us.

-

Your Rights

Your Rights

You or your business representatives have the right to:

You or your business representatives have the right to:

- Access your personal data

- Access your personal data

- Correct your personal data

- Correct your personal data

- Request deletion of personal data (subject to legal requirements)

- Request deletion of personal data (subject to legal requirements)

- Restrict or object to processing of your personal data (in certain cases)

- Restrict or object to processing of your personal data (in certain cases)

- Request transfer of your personal data (data portability)

- Request transfer of your personal data (data portability)

- Opt out of marketing at any time

You can withdraw consent at any time without affecting earlier processing.

To exercise any of these rights, email us at info@ampliflow.com. We will respond within one month.

To exercise any of these rights, email us at info@ampliflow.com. We will respond within one month.

Advertising Attribution (Campaign Parameters and Click Identifiers)

You can complain to a supervisory authority, including Integritetsskyddsmyndigheten (IMY) in Sweden.

When you land on our website from an ad or other tagged campaign URL, we may capture allowlisted attribution parameters from that URL. These parameters are limited to campaign tags such as utm_source , utm_medium , utm_campaign , utm_term , utm_content , and advertising click identifiers such as gclid , gbraid , wbraid , and msclkid .

-

To preserve the original landing context if you move to another page before submitting a website form, we store that allowlisted attribution snapshot in session-scoped browser storage for the duration of your browsing session. If you submit a form during that session, the stored attribution snapshot is included with the form submission. Relevant click identifiers and related form metadata may then be retained in our systems for up to 90 days so we can understand which campaigns lead to genuine business inquiries and allocate our advertising budget responsibly.

-

We do not share attribution data with third parties beyond uploading matched conversions and related click identifiers to Google Ads via their offline conversion import API where applicable.

-

Legal basis: Legitimate interests (measuring advertising effectiveness and ensuring responsible use of advertising budget).

-

This processing does not involve cookies or third-party site tags. It does use session-scoped browser storage so the original landing context can follow you between pages during the same session.

-

Data Retention

Data Retention

We retain your data as long as you use our Service or as required by law. If you request deletion, we will remove your data within 90 days unless otherwise required.

We retain account data as long as you use our Service or as required by law. Customer content is handled under the applicable data-processing agreement when the service ends.

-

Billing records are kept through the seventh year after the calendar year in which the financial year ended, as Swedish bookkeeping law requires. We keep records documenting our business relationship for as long as needed to handle legal claims, up to ten years.

-

Support and security records are kept while needed to resolve incidents and prevent abuse. Other records are kept only while their purpose requires. You can request deletion at info@ampliflow.com.

Changes

Changes

We may update this policy. When we make changes to this Privacy Policy or our Terms of Service, the revised version will state its effective date. Changes take effect on that stated effective date, which will be at least 30 days after publication. The date of the latest update is shown at the top of this page.It is your responsibility to periodically review this Privacy Policy for changes. We will not separately notify you of updates.

When we make changes to this Privacy Policy, the revised version will state its effective date. Changes take effect on that stated effective date, which will be at least 30 days after publication. The date of the latest update is shown at the top of this page.

Contact

-

Email: info@ampliflow.com

-

If you have questions or concerns about this policy or your data, please contact us at the details above.

-