Integritetspolicy SaaS

Who We Are

Cognit Consulting AB

Swedish corporation ID: 559010-4021

Varholmsgatan 2a, 414 74 Göteborg, Sweden

info@ampliflow.com

What Data We Collect

We collect business-related information that you or your company provide to us when using AmpliFlow, including:

• Name, email, company name, and job title
• Login/account credentials
• Usage data (e.g., logs, activity and actions within the platform)
• Communications with us (e.g., support requests)
• Marketing preferences

We may also collect data automatically via analytics tools (see the "Cookies and Tracking Technologies" section below).

Additional data collection may occur when you:

• Register online or place an order for our products or services
• Complete surveys or provide feedback (including via message boards or email)
• Enter or upload data into your AmpliFlow account
• Use or view our website or the SaaS application, which may result in information being gathered through cookies or log data
• Use optional AI features, where AmpliFlow sends task-specific context to the approved AI provider

Cognit Consulting AB will process personal data only as documented in the Terms of Service, this Privacy Policy, and as otherwise required by law. Cognit Consulting AB is not obliged to accept or act on individual instructions from customers outside of the scope of these documents.

Log Data

When you use our Service, we automatically collect certain technical and usage information ("Log Data"). This may include:

• Your computer's IP address
• Browser type and version
• Pages visited on our Service
• Time and date of your visit
• Time spent on those pages
• Other usage statistics

We log platform usage with Microsoft Azure Application Insights, Sentry (self-hosted), and Pendo.

Cookies and Tracking Technologies

Cookies are small data files stored on your device. We use cookies and similar technologies to:

• Remember your preferences
• Analyze usage patterns
• Support authentication and security
• Improve our website and platform experience

On www.ampliflow.se (our website):

The website does not use cookies. Website analytics are handled by Rybbit, a self-hosted, cookieless analytics tool running on our own servers. Rybbit collects anonymous visitor statistics: page views, navigation patterns, outbound link clicks, and campaign parameters such as UTM tags from ads. We use this to see which content and campaigns visitors find relevant. No personal data is collected and no data is shared with third parties.

On the AmpliFlow SaaS application:

Cookies are strictly necessary for the core platform to function (for example, for authentication and essential security). You cannot refuse these necessary cookies in the SaaS application. If you do not wish to accept these cookies, please discontinue use of the SaaS application.

Types of cookies and tracking used:

• Essential cookies: Required for authentication, security, and core platform functionality
• Analytics (app): Microsoft Azure Application Insights, Pendo
• Analytics (website): Rybbit (self-hosted on our own servers and cookieless, collects anonymous page views, navigation, outbound clicks, campaign parameters such as UTM tags, and JavaScript errors)

How to manage cookies:

The website does not use cookies. For the SaaS application, cookies are necessary for authentication and security and cannot be refused.

How We Use Your Data

We use your personal data to:

• Provide, manage, and improve the AmpliFlow Service
• Communicate with you about your account, billing, and support
• Send marketing communications about our products and services (you can opt out at any time)
• Comply with legal obligations
• Provide optional AI features when a tenant administrator has enabled AI and approved the selected provider

We do not sell your personal data.

Legal Basis for Processing (GDPR)

We process your data based on:

• Contract (providing our service to you or your company)
• Legitimate interest (improving and securing our service, marketing to business contacts)
• Legal obligations

Data Storage and Transfers

Your data is stored on cloud and data center infrastructure within the EU/EEA:

• Microsoft Azure: West Europe (Netherlands) and Sweden Central (Gävle, Sweden). We rely on Microsoft Azure's compliance program (ISO 27001, SOC 1/2/3, GDPR).
• Hetzner Online GmbH: Data centers in Germany and Finland (EU). Used for internal business systems such as CRM and customer support tools. We use Hetzner under GDPR Article 28 processor terms.

Core AmpliFlow service data is not transferred outside the EU/EEA in normal operation. Optional AI features are separate: if a tenant administrator approves an AI provider outside the EU/EEA, task-specific AI request data may be transferred to that provider. Appropriate safeguards such as Standard Contractual Clauses, adequacy decisions, or another valid transfer mechanism are applied in line with GDPR requirements.

Data Sharing

We only share potentially sensitive data with service providers who support our platform.

For the website www.ampliflow.se:

• Rybbit: Self-hosted cookieless analytics running on our own servers (collects anonymous visitor statistics including campaign parameters, no personal data collected)
• MailerLite: Newsletter delivery

For the SaaS product AmpliFlow:

• Microsoft Azure: Hosting, security, and log data (via Application Insights)
• Pendo: Usage analytics to help us improve the service
• Mailgun: Email delivery service

For internal business systems (CRM, customer support):

• Hetzner Online GmbH: Data center infrastructure in Germany and Finland (EU), hosts our CRM and customer support systems where we store business contact information such as names, email addresses, and communication history

Optional AI providers:

If your tenant administrator enables AI and approves a provider, task-specific content may be processed by the selected AI provider solely to provide the AI response. Approved provider options may include Berget AI AB, OpenAI, LLC, Google LLC, Mistral AI, Anthropic PBC, or additional AI or cloud vendors specified at the time of opt-in. No AI provider is enabled by default.

AI request data may include prompts, selected context from your AmpliFlow account, referenced business content, user identifiers, tenant metadata, technical request metadata, and generated responses. We send only the context needed for the specific AI task, not the entire database.

Provider retention and training posture depends on the selected provider and project settings. OpenAI states that API data is not used to train or improve models by default unless the customer opts in, and that abuse-monitoring logs may retain prompts and responses for up to 30 days by default unless a different approved control applies or longer retention is legally required. Berget states in its terms that it does not store actual prompt content or output from hosted LLMs.

Authorities:

We may share information with authorities if required by law.

Third-Party Links

Our Service may contain links to third-party websites. We are not responsible for the content or privacy practices of these sites. Please review their privacy policies before providing any personal information.

Security

We use commercially acceptable means to protect your personal information, but no internet or electronic storage method is 100% secure. We cannot guarantee absolute security.

Children's Privacy

Our Services are not directed at children under 13. We do not knowingly collect personal information from children under 13. If we learn a child has provided us with personal data, we will delete it promptly. If you are a parent or guardian and believe your child has provided us with personal data, please contact us.

Your Rights

You or your business representatives have the right to:

• Access your personal data
• Correct your personal data
• Request deletion of personal data (subject to legal requirements)
• Restrict or object to processing of your personal data (in certain cases)
• Request transfer of your personal data (data portability)
• Opt out of marketing at any time

To exercise any of these rights, email us at info@ampliflow.com. We will respond within one month.

Advertising Attribution (Campaign Parameters and Click Identifiers)

When you land on our website from an ad or other tagged campaign URL, we may capture allowlisted attribution parameters from that URL. These parameters are limited to campaign tags such as utm_source, utm_medium, utm_campaign, utm_term, utm_content, and advertising click identifiers such as gclid, gbraid, wbraid, and msclkid.

To preserve the original landing context if you move to another page before submitting a website form, we store that allowlisted attribution snapshot in session-scoped browser storage for the duration of your browsing session. If you submit a form during that session, the stored attribution snapshot is included with the form submission. Relevant click identifiers and related form metadata may then be retained in our systems for up to 90 days so we can understand which campaigns lead to genuine business inquiries and allocate our advertising budget responsibly.

We do not share attribution data with third parties beyond uploading matched conversions and related click identifiers to Google Ads via their offline conversion import API where applicable.

Legal basis: Legitimate interests (measuring advertising effectiveness and ensuring responsible use of advertising budget).

This processing does not involve cookies or third-party site tags. It does use session-scoped browser storage so the original landing context can follow you between pages during the same session.

Data Retention

We retain your data as long as you use our Service or as required by law. If you request deletion, we will remove your data within 90 days unless otherwise required.

Changes

We may update this policy. When we make changes to this Privacy Policy or our Terms of Service, the revised version will state its effective date. Changes take effect on that stated effective date, which will be at least 30 days after publication. The date of the latest update is shown at the top of this page. It is your responsibility to periodically review this Privacy Policy for changes. We will not separately notify you of updates.

Contact

Email: info@ampliflow.com

If you have questions or concerns about this policy or your data, please contact us at the details above.