Privacy Policy

1. Data Controller

The data controller for personal data we process about you as an account holder is AmplySales OÜ, Estonian registry code 17261650, registered office Lahepea tn 7-110, 10617 Tallinn, Estonia. Contact: info@amplysales.com.

For personal data about your prospects, contacts, leads, and other third-party individuals you enter into the Service, you are the controller and we are the processor acting on your instructions.

2. What We Collect

Account data

Name, email address, authentication identifiers or OAuth provider identity for Google / Microsoft sign-in, and, if provided, phone number, job title, company name, and IBAN.

CRM data

Data you enter into the Service: prospects, contacts, accounts, deals, tasks, notes, documents, and related records. This may include personal data about third parties; you are the controller for that data.

Email content when you connect an email account

If you connect a Google Workspace, Gmail, Microsoft 365, or Outlook mailbox, or any other standard mailbox over IMAP/SMTP (the "Other" connector), we retrieve messages within a rolling sync window for synchronization. Retrieved messages are stored in our database in association with the prospects or contacts they relate to. Messages you compose and send through the Service are also stored.

When you connect a mailbox through the generic IMAP/SMTP ("Other") connector, you provide your mail-server host, port, username, and password instead of using OAuth. These credentials are stored encrypted and used only to read your inbox for synchronization and to send messages you compose in the Service. We access email metadata and message bodies (text and HTML) within the rolling sync window; we do not store attachments. Disconnecting the mailbox in Settings > Email deletes the stored credentials. As with Google and Microsoft, synchronized email content may be analyzed by our AI sub-processor for sentiment on inbound messages unless your organization disables AI processing.

AI interaction data

Conversations with the AI assistant, prompts you submit, and responses generated, stored to provide conversation history and improve response quality.

Usage, logs, and security data

Aggregated usage analytics, performance metrics, server access logs, error reports, IP addresses, and authentication events used for security monitoring, debugging, and abuse prevention. We do not use third-party advertising trackers.

3. Google User Data

When you connect a Google Workspace or Gmail account to send and sync email, you grant Amplysales the following OAuth scopes:

• https://www.googleapis.com/auth/gmail.send - to send email composed in the Service through your Gmail account.
• https://www.googleapis.com/auth/gmail.readonly - to read messages from your inbox so they can be linked to prospects and surfaced in the CRM timeline.
• https://www.googleapis.com/auth/userinfo.email - to identify the connected mailbox.

What data we access

We retrieve email metadata such as sender, recipients, subject, date, labels, thread IDs, and message bodies in HTML and plain text for messages within the rolling sync window. We do not currently access attachments. We do not access other Google services such as Drive, Calendar, or Contacts.

Why we access it

• Display sent and received messages in prospect, contact, account, and deal timelines.
• Link messages to prospect and contact records based on participating email addresses.
• Send email composed in the Service, including manually written or AI-drafted messages, on your behalf.
• Detect replies that indicate prospect interest, to prioritize follow-up.
• Prevent duplicate sends and track delivery.

How we store it

Email subject, body, and metadata are stored in our database hosted in the European Union, in Ireland. Storage is encrypted at rest and in transit. Access is restricted by row-level security so that only users in your organization with appropriate permissions can read messages you have synced or sent.

How we share it

Synchronized email content is processed by our AI sub-processor, Anthropic, in the United States, for sentiment analysis on inbound messages and, where you initiate AI assistance, for drafting replies or summarization. AI processing occurs only as needed to perform these functions; conversations are not used to train third-party AI models. Your organization can disable AI processing of synced email content from Settings.

We do not sell or transfer Google user data to data brokers, advertisers, or any third party for their independent use.

Limited Use disclosure

Amplysales' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How to revoke access and delete Google user data

• Disconnect the mailbox in Amplysales via Settings > Email, which revokes our refresh token.
• Revoke access from your Google account at myaccount.google.com/permissions.
• To delete email content already stored in the Service, delete the related prospects or contacts, or request full account deletion at info@amplysales.com. Email content is removed within 30 days of an account-deletion request, except where retention is required by law.

4. Microsoft Account Data

When you connect a Microsoft 365 or Outlook account, we request these Microsoft Graph permissions:

• Mail.Send - to send email composed in the Service through your mailbox.
• Mail.Read - to read messages from your inbox so they can be linked to prospects and surfaced in the CRM timeline.
• User.Read - to identify the connected mailbox.
• offline_access - to maintain a refresh token so the connection persists between sessions.

We access email metadata and message bodies within the rolling sync window. We do not currently access attachments, Calendar, OneDrive, Teams, or any Microsoft Graph endpoint outside Mail.

Microsoft email handling follows the same principles as Google handling: messages are linked to CRM records, optionally analyzed by our AI sub-processor for sentiment on inbound replies, stored encrypted in the EU, accessible only to authorized users in your organization, and never sold or transferred for independent third-party use. You can revoke Microsoft access through Settings > Email, myaccount.microsoft.com/consent for work or school accounts, or account.live.com/consent/Manage for personal accounts.

5. Public Business-Registry Data

To provide reliable company search and keep customer records current, we maintain a working copy of publicly available Estonian business-registry data, principally the Estonian e-Business Register and company tax-status information from the Estonian Tax and Customs Board. The same underlying data is available directly from these public registries; we maintain a working copy for performance and reliability, not as a separate commercial dataset.

• On-demand query - when an Amplysales customer searches for or asks the assistant about a company, we read from the working copy to return results.
• Daily refresh of customer prospects - for prospects a customer has already added to their CRM, we refresh certain registry fields so records stay current. We do not add new prospects to a customer's workspace through this refresh.

Amplysales does not push new prospects from the working copy to customers proactively, does not sell or redistribute the working copy, and does not use it for any purpose beyond serving customer workflows.

Individuals listed in this working copy who wish to remove or correct data about themselves may contact info@amplysales.com.

6. How We Use Your Data

• Providing the Service - authenticating you, showing your data, sending email on your behalf, syncing your inbox, and operating CRM workflows.
• AI features - processing your prompts and relevant context to generate enrichment data, drafts, and insights.
• Service improvement - aggregated usage analytics to understand which features are valuable.
• Security and abuse prevention - detecting unauthorized access, fraud, and abuse.
• Communications - service announcements, security alerts, and, with consent, product updates.

We do not use your data, your customers' data, or content from connected mailboxes for advertising, marketing to third parties, or AI model training by us or our sub-processors.

7. Legal Bases for Processing

• Contract - providing the Service to you under our Terms, including account, CRM, AI-feature, and email-sync processing.
• Legitimate interest - security monitoring, fraud prevention, and aggregated product analytics.
• Consent - optional features such as connecting an email account, enabling AI processing of email content, and product-update emails.
• Legal obligation - accounting records and responding to lawful requests from authorities.

8. Sub-processors

We use sub-processors to deliver the Service. Each is bound by a written agreement to process personal data only on our instructions and to apply appropriate security measures.

We will notify customers of material changes to this list at least 30 days before they take effect, where feasible.

9. Customer-Selected Third-Party AI and MCP Connections

If an organization owner connects an external AI service through Model Context Protocol ("MCP") or a similar integration, Amplysales transmits the Customer Data requested through enabled tools to that provider on the customer's instruction and subject to the connected user's Amplysales permissions. The information sent may include prompts, record identifiers, CRM field values, notes, activities, contact details, or other personal and confidential information needed to fulfil the request.

A provider selected and separately contracted by the customer is not one of our sub-processors for that customer-directed connection unless it is expressly listed in Section 8 for the same processing purpose. The provider processes received information under the customer's agreement with it and its own privacy terms. The customer, as controller of its CRM data, is responsible for establishing the lawful basis, notices, authorizations, data-processing terms, and international-transfer safeguards required for that disclosure.

Amplysales secures the MCP service within the Service and enforces configured Amplysales permissions. We do not control the external provider's storage, retention, deletion, model-training practices, or further processing after it receives the information. Disconnecting the provider prevents future access through Amplysales but does not delete data already held by the provider; the organization must use the provider's own controls to request deletion.

10. International Data Transfers

Customer data is hosted in the European Union. Some sub-processors, notably Anthropic, OpenAI, Perplexity AI, Cloudflare's global edge network, and certain Google and Microsoft services, process data in the United States or globally. Where personal data is transferred outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses or equivalent safeguards.

Those safeguards apply to our sub-processors. They do not automatically cover an external AI provider selected and separately contracted by the customer; the customer must assess and arrange any transfer safeguards required for that provider.

11. Data Sharing

We do not sell your data. Beyond the sub-processors listed above, we share personal data only:

• With your explicit instruction, for example when you choose to send email through the Service.
• To comply with a binding legal request.
• To protect rights, safety, or property when there is a serious threat.
• In a corporate transaction, in which case the acquirer is bound to honor this Policy.

12. Data Security

• Encryption in transit and at rest.
• Row-level security so users only access data within their organization.
• Role-based access control.
• Audited application code, automated security review on changes, and centralized error monitoring.
• Restricted access to production systems with multi-factor authentication.

We do not currently hold SOC 2 or ISO 27001 certification; we will update this Policy when we do. In the event of a personal data breach affecting your data, we will notify the Estonian Data Protection Inspectorate within 72 hours where required by GDPR Article 33 and affected customers without undue delay where required by GDPR Article 34.

13. Data Retention

Organization owners and administrators can delete their organization's data at any time through the Service or by contacting us. You are responsible for retention obligations arising from your own legal, tax, accounting, or contractual duties.

14. Your Rights

If you are in the European Economic Area, the United Kingdom, or any jurisdiction with comparable data-protection law, you have the right to:

• Access - request a copy of your personal data.
• Rectification - correct inaccurate data.
• Erasure - request deletion of your data.
• Portability - receive your data in a structured, machine-readable format.
• Restriction - request that we limit processing of your data.
• Objection - object to processing based on legitimate interests.
• Withdraw consent - for processing based on consent, withdraw at any time without affecting prior processing.

To exercise these rights, email info@amplysales.com. We will respond within 30 days. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (aki.ee) or your local supervisory authority.

15. Cookies

Amplysales uses only essential cookies required for authentication and session management. We do not use tracking cookies, advertising cookies, or third-party analytics cookies that identify individuals.

16. AI Processing and Opt-Out

AI features process your inputs, prospect attributes, and email content where applicable to generate outputs. We do not use your content to train third-party AI models, and our AI sub-processors are contractually prohibited from doing so. If you do not want AI to process email content, your organization admin can disable it in Settings; inbox sync will continue without sending email content to our AI sub-processor.

17. Children

The Service is intended for business users aged 16 and over. We do not knowingly collect data from children.

18. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date on this page reflects the most recent revision.

19. Contact

For privacy-related questions, to exercise your rights, or to request a Data Processing Agreement or sub-processor list update notification, contact us at info@amplysales.com.