Privacy Policy
Updated October 2026
Amargi is a multi-tenant SaaS product family operated by Amargi Creative. This policy explains what personal data we collect when you use our website or products, why, who can access it, and what rights you have.
Quick summary
We collect the minimum, your account, your usage, and nothing unnecessary. We do not sell your data. Ever. Your data is self-service exportable via Amargi Workspace, and you can request its deletion there or by email. EU residency by default, with self-hosting available.
Who controls the data
The data controller is Amargi Creative. For privacy-related contact: contact@amargicreative.com
Authentication via Amargi Workspace (single sign-on)
Amargi is a product family (Reach, Mail, Agents, Meet, Escalate). All products share a single identity provider called Amargi Workspace. When you sign in to any product, your session goes through Workspace. Workspace stores ONLY: account credentials (email, password hash, 2FA secrets), active sessions, and organization membership and roles. It does NOT store any WhatsApp message content, contact lists, or any data governed by Meta's Business Solution Provider (BSP) terms, all of that is owned and processed exclusively by Reach. Workspace is an internal authentication service operated by Amargi Creative, same legal entity, same hosting, same compliance perimeter. It is NOT a sub-processor and NOT a third party. For the full operational data-separation detail, see our privacy posture (section 1).
What we collect, and why
Account data: Name, email, phone (optional), organization name. These are required to create your account and present an identity to your colleagues. Usage data: Login records, billing events, API calls, AI agent runs. Stored for 90 days for security retention and incident diagnosis, then automatically deleted. Product content (messaging data): Your data in each product, Reach messages (text and media) across connected channels, conversations on WhatsApp, Messenger, Instagram Direct, and email, Meet recordings, Agents you configure, Escalate tickets, Mail campaigns. This is yours. We do not read it, do not train our models on it, and do not share it with any third party beyond the channel providers you explicitly choose to connect (Meta for WhatsApp, Messenger, and Instagram; the email providers you select) and, only when you use an AI feature, the AI provider that processes that request (see AI features below). Technical data: For each request we log: IP address, User-Agent string, a minimal device fingerprint (browser and visible plugin layout, without cross-site tracking). Used for abuse detection, session tracking, and security investigations. Not linked to your operational data in the public surface, lives in the isolated audit log. Technical cookies: We use strictly necessary cookies only, language preference, theme preference, session token. No cross-site analytics tracking, no retargeting ads. Full breakdown in our cookie policy.
Where data is stored
Default is EU servers (Hostinger, Frankfurt). Customers requiring residency in a different region or self-hosting can use sovereign deployment options. Contact us.
Who can access it
You, all your data is visible in your account. Members of your organization, according to the team permissions you define. Amargi Creative staff, only for necessary operational cases (technical support you request, security investigations, legal obligations). All access is logged and audited. Law enforcement, only on a valid legal request (court order, subpoena, lawful disclosure order). We notify you when legally permitted.
AI features
Some features use a third-party AI model: AI replies and reply suggestions, translations, conversation and ticket summaries, the Escalate ticket copilot, automatic ticket triage and drafted or automatic replies in Escalate, and Amargi Agents. They run only when you or your organization use them. When you do, the content the feature needs is sent to the AI provider that processes it. For a reply, translation or summary that is the recent messages of that conversation or ticket, including customer names and message text. In the Amargi Workspace mobile app, AI replies and translations use Anthropic PBC (Claude, United States), and ticket summaries and suggested replies from the Escalate ticket copilot, and the automatic ticket triage and drafted or automatic replies a manager can turn on from the app's AI settings, use the AI provider configured for Escalate, which is Anthropic by default. The app asks for your permission before the first AI request on your device. Your organization can set Amargi Agents to use Anthropic, OpenAI or Google Gemini. Whichever it chooses, the text of files and web pages added to an Agent's knowledge, and the questions used to search that knowledge, are sent to OpenAI by default to compute search embeddings. Each provider acts as our sub-processor: it uses the content only to produce the result, under its commercial API terms, and does not train its models on it. A web page added to an Agent's knowledge by its address is fetched through the Reader service of Jina AI, which receives the page's address. Nothing is sent to an AI provider unless an AI feature is used.
Push notifications in the mobile app
If you allow notifications, the Amargi Workspace mobile app registers a push token for your device with us. We store it with your user and organization ids, and delete it when you sign out or when you no longer have an active session. Notifications are delivered through Expo (650 Industries, Inc., United States) and Apple Push Notification service (Google Firebase Cloud Messaging on Android). They carry no message content and no customer names: only a generic title, such as "New message", and internal identifiers, such as the ids of the organization and the conversation, that the app uses to open the right screen.
Sub-processors
Approved third parties to whom we may pass your data as part of operating the product. Each is bound by a Data Processing Agreement (DPA) or the provider's data-protection terms, and committed to a protection level equivalent to what is described in this policy. Hostinger International Ltd (hosting in Frankfurt, EU), compute, databases, storage, outbound SMTP relay and DNS. This is where your data lives. Meta Platforms (IE/US), channel provider for WhatsApp Business Platform, Messenger, and Instagram Direct, connected directly as a Meta Tech Provider. Engaged only when you connect your accounts. OpenAI, Anthropic, and Google / Gemini (US), AI model inference for the AI features described above (Anthropic for AI replies and translations in the Amargi Workspace mobile app, and by default for Escalate's AI features; OpenAI by default for the search embeddings of Agents knowledge). Engaged only when an AI feature is used, and not trained on your data. (Amargi is developing its own model for a future release.) Jina AI GmbH (Germany, part of Elastic; its Reader service runs in the US and Belgium), fetching of web pages added to Agents knowledge by their address. Engaged only when a web page is added that way. Expo (650 Industries, Inc., US) and Apple Push Notification service (US), with Google Firebase Cloud Messaging on Android, delivery of Amargi Workspace mobile app push notifications. Engaged only when you allow notifications in the app. The complete list (with purpose, location, and the DPA or terms for each) is published in the Customer Agreement. Material changes are notified 30 days before they take effect.
Your rights (GDPR, CCPA, and beyond)
Right to access, view all your data in your account. Right to portability, self-service export to JSON / CSV from account settings. Right to erasure, delete your account from Amargi Workspace settings on the web: it is deactivated at once, and we permanently delete or anonymize the account record when you ask us to by email. An organization owner can also request deletion of the organization's data there; our team carries it out after review. Some records, such as billing records, are kept: the steps and what we keep are on the Data Deletion page. Right to rectification, edit fields directly on the account page. Right to object to processing, contact contact@amargicreative.com. Right to restrict processing, available within the scope set out in GDPR Article 18. Right to complain, you may lodge a complaint with your local EU data protection authority or the equivalent regulator in your jurisdiction. California residents (CCPA / CPRA) have an additional explicit right to know which of their data is sold or shared (we do not sell or share, no transaction to disclose), and the right to non-discrimination when exercising these rights.
Data retention
Account data: a deleted account is deactivated straight away and can be restored for 30 days; the account record is permanently deleted or anonymized when you ask us to (see the Data Deletion page). Messaging data (Reach, Mail, Meet): 90 days after deletion by default; your plan may extend. Audit logs: kept to demonstrate compliance; when an organization is deleted, Reach's audit log entries for it are kept and the other products' audit logs are deleted with it. Invoices and billing records: Retained for at least the period required by the tax law of our jurisdiction of registration (typically 7 years). Backups: Rotated on a rolling schedule; deletion is applied to your data in the next backup on the schedule.
Cross-border transfers
Your data may be processed in the EU and US (backup hosting, AI inference, Stripe, Meta, web page fetching through Jina AI's Reader, mobile push notification delivery through Expo and Apple). For transfers outside the EEA we rely on the EU Standard Contractual Clauses (2021 issue) and equivalent transfer mechanisms (UK IDTA, etc.). Region pinning (EU-only) is available on enterprise plans.
Data breaches
In the event of a security incident affecting your personal data, we will notify you within 72 hours of discovery (GDPR requirement, we treat it as floor not ceiling). Notices include: what happened, what data was affected, what we are doing, what you should do.
Changes to this policy
We update this policy when our practices change. Material changes are notified via email. Minor changes (rewording, typo fixes) are logged by updating the 'last updated' date at the top.
Children
Amargi products are not directed at people under 16. We do not knowingly collect personal data from children. If we learn an account was created by an underage child, we suspend it and delete its data. A parent or guardian who believes their child has provided data by mistake should contact us at contact@amargicreative.com.
Contact
Questions, GDPR / CCPA rights requests, complaints: contact@amargicreative.com. We respond within 5 business days, 30 days maximum for formal rights requests. Disclaimer: this is a template suitable for early launch and Meta App Review. Before serving regulated sectors (healthcare, finance, telco) or operating at scale, a privacy lawyer in your jurisdiction must review and tailor it.