Privacy policy

1. Quick summary

Amargi is a multi-tenant SaaS product family operated by Amargi Creative. This policy explains what personal data we collect when you use our website or products, why, who can access it, and what rights you have.

• We collect the minimum, your account, your usage, nothing unnecessary.
• We do not sell your data. Ever.
• Your data is self-service exportable and deletable via Hub.
• EU residency by default, with self-hosting available.

2. Who controls the data

The data controller is Amargi Creative. For privacy-related contact:

contact@amargicreative.com

2.1 Authentication via Amargi Hub (single sign-on)

Amargi is a product family (Reach, Mail, Agents, Meet, Escalate). All products share a single identity provider called Amargi Hub. When you sign in to any product, your session goes through Hub.

Hub stores ONLY: account credentials (email, password hash, 2FA secrets), active sessions, and organization membership + roles. It does NOT store any WhatsApp message content, contact lists, or any data governed by Meta's Business Solution Provider (BSP) terms — all of that is owned and processed exclusively by Reach.

Hub is an internal authentication service operated by Amargi Creative — same legal entity, same hosting, same compliance perimeter. It is NOT a sub-processor and NOT a third party. For the full operational data-separation detail, see our privacy posture §1.

3. What we collect, and why

3.1 Account data

Name, email, phone (optional), organization name. Required to create your account and present an identity to your colleagues.

3.2 Usage data

Login records, billing events, API calls, AI agent runs. Stored for 90 days for security retention and incident diagnosis, then automatically deleted.

3.3 Product content (messaging data)

Your data inside each product, Reach messages (text + media) across connected channels, conversations on WhatsApp, Messenger, Instagram Direct, and email, Meet recordings, Agents you configure, Escalate tickets, Mail campaigns. This is yours. We do not read it, do not train our models on it, do not share it with any third party beyond the channel providers you explicitly choose to connect (Meta for WhatsApp + Messenger + Instagram; the email providers you select).

3.4 Technical data

For each request we log: IP address, User-Agent string, a minimal device fingerprint (browser + visible plugin layout, never cross-site tracking). Used for abuse detection, session tracking, and security investigations. Not linked to your operational data in the public surface, lives in the isolated audit log.

3.5 Technical cookies

We use strictly necessary cookies only, language preference, theme preference, session token. No cross-site analytics tracking, no retargeting ads. Full breakdown in our cookie policy.

4. Where data is stored

Default is EU servers (Hetzner, Frankfurt). Customers requiring residency in a different region or self-hosting can use sovereign deployment options. Contact us.

5. Who can access it

• You, all your data is visible in your account.
• Members of your organization, according to the team permissions you define.
• Amargi Creative staff, only for necessary operational cases (technical support you request, security investigations, legal obligations). All access is logged and audited.
• Law enforcement, only on a valid legal request (court order, subpoena, lawful disclosure order). We notify you when legally permitted.

5.1 Sub-processors

Approved third parties to whom we may pass your data as part of operating the product. Each is bound by a Data Processing Agreement (DPA) and committed to a protection level equivalent to what is described in this policy.

• Hetzner Online GmbH (DE), primary compute + storage hosting. Default residency Frankfurt, EU.
• AWS / Google Cloud (US), backup hosting + secrets management + cross-region backups. Per-tenant region selection.
• Cloudflare, Inc. (US), CDN + DDoS mitigation. Does not see encrypted message content.
• Anthropic PBC (US), AI inference for Agents, invoked only when you trigger them. Anthropic contractually does not use your data for training.
• Stripe, Inc. (US), payment processing + invoice issuance. Card details never touch our servers.
• Meta Platforms (IE/US), channel provider for WhatsApp Business Platform + Messenger + Instagram Direct. Engaged only when you connect your Pages.
• Email providers (SendGrid / Mailgun / your chosen provider), transactional email delivery. Engaged only when you configure them.
• 360dialog GmbH (DE), WhatsApp Business Platform solution partner for phone-number provisioning + message billing.

The complete list (with purpose, location, DPA link for each) is published in the Customer Agreement. Material changes are notified 30 days before they take effect.

6. Your rights (GDPR, CCPA, and beyond)

• Right to access, view all your data in your account.
• Right to portability, self-service export to JSON / CSV from account settings.
• Right to erasure, request deletion from settings. A 7-day grace period begins during which you can cancel; afterward background workers automatically wipe your data and anonymize records we are legally required to keep (transactions, audit logs). Deletion details.
• Right to rectification, edit fields directly on the account page.
• Right to object to processing, contact contact@amargicreative.com.
• Right to restrict processing, available within the scope set out in GDPR Art. 18.
• Right to complain, you may lodge a complaint with your local EU data protection authority or the equivalent regulator in your jurisdiction.

California residents (CCPA / CPRA) have an additional explicit right to know which of their data is sold or shared (we do not sell or share, no transaction to disclose), and the right to non-discrimination when exercising these rights.

6.1 Data retention

• Account data, 30 days after deletion, then anonymized.
• Messaging data (Reach + Mail + Meet), 90 days after deletion by default; your plan may extend.
• Audit logs, 12 months after deletion to demonstrate compliance.
• Invoices + billing records, retained for the period required by the tax law of our jurisdiction of registration (typically 7 years).
• Encrypted backups, rotated on a rolling schedule; deletion is applied to your data in the next backup on the schedule.

6.2 Cross-border transfers

Your data may be processed in the EU and US (backup hosting, AI inference, Stripe, Meta). For transfers outside the EEA we rely on the EU Standard Contractual Clauses (2021 issue) and equivalent transfer mechanisms (UK IDTA, etc.). Region pinning (EU-only) is available on enterprise plans.

7. Data breaches

In the event of a security incident affecting your personal data, we will notify you within 72 hours of discovery (GDPR requirement, we treat it as floor not ceiling). Notices include: what happened, what data was affected, what we are doing, what you should do.

8. Changes to this policy

We update this policy when our practices change. Material changes are notified via email. Minor changes (rewording, typo fixes) are logged by updating the "last updated" date at the top.

9. Children

Amargi products are not directed at people under 16. We do not knowingly collect personal data from children. If we learn an account was created by an underage child, we suspend it and delete its data. A parent or guardian who believes their child has provided data by mistake should contact us at contact@amargicreative.com.

10. Contact

Questions, GDPR / CCPA rights requests, complaints: contact@amargicreative.com. We respond within 5 business days, 30 days maximum for formal rights requests.

Disclaimer: this is a template suitable for early launch and Meta App Review. Before serving regulated sectors (healthcare, finance, telco) or operating at scale, a privacy lawyer in your jurisdiction must review and tailor it.