Last updated: April 2026 · This policy applies to all AmpGate services.
AmpGate operates the AmpGate agentic identity platform accessible at ampgate.io (the "Service"). We act as the data controller in respect of personal data collected directly through the Service. For questions about this policy, contact us at privacy@ampgate.io.
Payment card details and billing addresses are collected and stored exclusively by our third-party payment processor (Paddle or equivalent). We receive only a transaction reference, subscription status, and payment outcome — never raw card numbers or full billing credentials.
If you contact our support team, we retain the content of that correspondence to resolve your enquiry and for quality purposes.
We do not collect the contents of agent private keys, the payload of tokens issued to agents, or any data processed by your AI agents through external services.
Where GDPR or UK GDPR applies, we rely on the following legal bases:
We do not sell, rent, or trade your personal data. We do not use your data to train machine learning models, and we do not use it to serve third-party advertising.
We share personal data only where necessary with the following categories of processors, all bound by appropriate data processing agreements:
We may disclose data to competent authorities where required by law, court order, or to protect the safety, rights, or property of AmpGate, our users, or the public.
We retain personal data for as long as your account is active or as needed to provide the Service. Specific retention periods:
| Data Category | Retention Period |
|---|---|
| Account / profile data | Duration of account + 30 days post-deletion request |
| Audit logs — Trial plan | 30 days |
| Audit logs — Starter plan | 30 days |
| Audit logs — Pro plan | 90 days |
| Audit logs — Business plan | 1 year |
| Audit logs — Enterprise plan | Custom (contractual) |
| API request metadata | Same as audit log for plan |
| Billing / transaction records | 7 years (tax / legal requirement) |
| Security / login event logs | 90 days |
| Support correspondence | 3 years from last interaction |
After the applicable retention period, data is permanently and securely deleted. You may request earlier deletion at any time (see Section 8).
We use a single first-party session cookie (tg_session) to maintain your authenticated session. This cookie is:
We do not use tracking cookies, advertising cookies, third-party analytics cookies, or any cookie that follows you across other websites. No cookie consent banner is required because we use only strictly necessary cookies.
Depending on your jurisdiction, you may have the following rights in respect of your personal data:
To exercise any of these rights, contact privacy@ampgate.io. We will respond within 30 days. We may need to verify your identity before processing a request. Where requests are manifestly unfounded or excessive, we reserve the right to charge a reasonable fee or refuse.
If you are in the EEA or UK and believe your rights have not been respected, you have the right to lodge a complaint with your local supervisory authority (e.g., the ICO in the UK, or the relevant national DPA in the EU).
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
To submit a CCPA/CPRA request, contact privacy@ampgate.io.
AmpGate operates globally. Your data may be transferred to and stored in countries outside your country of residence, including countries that may not provide the same level of data protection as your home country. Where we transfer personal data from the EEA or UK to countries that have not received an adequacy decision, we do so using appropriate safeguards such as the UK International Data Transfer Agreements (IDTA) or EU Standard Contractual Clauses (SCCs).
We implement industry-standard technical and organisational measures to protect your data:
While we take reasonable precautions, no method of transmission over the internet or electronic storage is 100% secure. In the event of a data breach affecting your rights and freedoms, we will notify affected users and relevant supervisory authorities as required by law.
The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us and we will delete it promptly.
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by email and by posting the updated policy on our website. The "Last updated" date at the top of this page indicates when the current version was published. Your continued use of the Service after notification constitutes acceptance of the updated policy.
For privacy questions, data subject requests, or to contact our data protection representative:
We aim to respond to all enquiries within 5 business days and all formal data subject requests within 30 days.