Effective 2026-08-01
Ampbase, LLC (“Ampbase,” “we,” “our,” or “us”) values the privacy of individuals who use ampbase.io (the “Site”) and our hosted OpAMP control plane (the “Service,” and together with the Site, our “Services”). This Privacy Policy explains how we collect, use, and share information from users of our Services when you use them. For business customers, this Policy is supplemented by the Cloud Service Agreement and any executed Data Processing Agreement, which control in the event of conflict.
1.1 Information You Provide. When you sign up we collect your email address, name, and avatar URL from your OAuth provider (Google or GitHub). When you create or join an organization we collect organization names, channel names, member email addresses, and role assignments. When you enter into a paid subscription we collect billing contact details; payment card details are collected and processed by Stripe and we do not see or store full card numbers.
1.2 Information We Collect Automatically. We receive operational telemetry about your use of the Services, including IP address, browser type, request paths, response status, error rates, and timestamps. We use this data to operate, secure, and improve the Service.
1.3 OAuth Tokens. We store sealed (encrypted) OAuth tokens so we can verify your identity on subsequent logins. Tokens are sealed by SSOkenizer, an open-source OAuth proxy published by Fly.io that we deploy and operate ourselves. We do not see or store plaintext OAuth tokens.
1.4 Customer Content. Configurations, feature flag definitions, audit events, and any other content you submit through the Service are stored in your organization’s isolated bucket. We process Customer Content on your behalf as described in the Cloud Service Agreement.
1.5 Cookies. We use strictly necessary cookies to maintain your session (an HttpOnly access cookie and a long-lived refresh cookie) and a cookie to remember your CSRF state during login. We do not use advertising or cross-site tracking cookies. Disabling cookies will prevent you from signing in.
We intentionally avoid collecting sensitive personal information. Specifically, we do not ask for or collect government identification numbers, financial account numbers, health information, biometric data, precise geolocation, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, or other special categories of data as defined by GDPR.
We also do not access Customer Content stored on your behalf except as required for security incident response, infrastructure maintenance, or support requests you initiate, and only with appropriate authorization.
We use the information we collect to: (a) provide, maintain, and improve the Services, including authentication, billing, and customer support; (b) communicate with you about your account, including transactional email and security notices; (c) detect, prevent, and respond to fraud, abuse, and security incidents; (d) generate aggregated, non-identifying metrics to publish reports or improve the Service; and (e) comply with legal obligations and enforce our agreements.
Under GDPR, our lawful bases are: performance of contract (Art. 6(1)(b)) for account, billing, and Service delivery; legitimate interests (Art. 6(1)(f)) for security, fraud prevention, and product improvement; and legal obligation (Art. 6(1)(c)) where required by law.
4.1 Sub-processors. We share information with the following sub-processors who process data on our behalf under contractual confidentiality and data protection obligations:
A current and authoritative list of our sub-processors, including the categories of data each processes, is maintained at ampbase.io/subprocessors. We provide advance notice of changes to that list as described there.
4.2 As Required by Law. We may access, preserve, and disclose your information if we believe doing so is required or appropriate to comply with law enforcement requests, court orders, or legal process; to respond to your requests; or to protect the rights, property, or safety of Ampbase, our customers, or others. Where lawful, we will attempt to notify you before disclosing your information in response to a legal request.
4.3 Business Transfers. If Ampbase is involved in a merger, acquisition, or asset sale, your information may be transferred to the successor entity. We will notify you before your information becomes subject to a different privacy policy.
4.4 With Your Consent. We may share your information for any other purpose disclosed to you and with your consent.
4.5 No Sale. We do not sell, rent, or trade your information to third parties for their own commercial purposes, and we do not use Customer Content to train artificial intelligence or machine learning models.
Ampbase is based in the United States, and our sub-processors operate globally. When information originating from the European Economic Area, the United Kingdom, or Switzerland is transferred outside those regions, we rely on Standard Contractual Clauses or other lawful transfer mechanisms.
Security and audit events (for example, login events) record the source IP address and user agent for account-security and fraud-prevention purposes. These two fields are stored separately from the event and automatically deleted 90 days after they are recorded; the remaining, non-identifying event is retained for the audit trail.
We retain account data for as long as your account is active. When you delete your account, we delete your account record and remove you from all organizations within 30 days. Deleting an organization permanently deletes its Customer Content and infrastructure; deletion begins promptly and is not recoverable. Deleting an individual channel within an organization retains that channel’s stored data for 24 hours before it is purged, to prevent accidental loss. We maintain standard infrastructure backups to prevent data loss; backup retention is currently managed by our object storage provider (Tigris Data) under their standard retention policy, and we will update this section with specific retention windows once our own backup procedures are finalized. We retain billing records for the period required by tax and accounting law (typically 7 years).
Depending on where you live, you may have the right to: (a) access the personal information we hold about you; (b) rectify inaccurate personal information; (c) erase your personal information (right to be forgotten); (d) restrict or object to certain processing; (e) port your personal information to another service; and (f) withdraw consent where processing is based on consent.
You can exercise the right to erasure at any time by deleting your account from Account Settings. For all other rights, email privacy@ampbase.io; we will respond within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority.
We use commercially reasonable technical and organizational measures to protect personal information, including TLS in transit, at-rest encryption of object storage, application-layer encryption of secrets, per-organization isolation of Customer Content, and audit logging of administrative actions. No system is perfectly secure, and we cannot guarantee absolute security.
The Services are not directed to individuals under 16. We do not knowingly collect personal information from children. If you believe we have collected personal information from a child, contact us at privacy@ampbase.io and we will delete it.
We may update this Privacy Policy from time to time. Material changes will be notified by email to the primary contact on file at least 30 days before the change takes effect. The “Effective” date at the top of this page reflects the current version.
For privacy questions or to exercise your rights, contact us at privacy@ampbase.io.