Amralytics Connect Privacy Policy
We don’t sell your data, we don’t use it for advertising, and we don’t train our own AI models on it. This policy explains what we collect through Amralytics Connect, why, who sees it, and how to get it deleted.
1. Who we are and what this policy covers
Amralytics Connect is operated by Amralytics, LLC, a Texas limited liability company located at 551 S I-35 Frontage Rd, Ste 300, Round Rock, TX 78664 (“Amralytics,” “we,” “us”). Amralytics Connect connects to the business platforms you choose, pulls data from them, and turns it into reports and insights for your business (the “Service”).
This policy covers the Service, our website at https://customer.amralytics.com, and any communications with us about them. It does not cover the third-party platforms you connect, which have their own privacy policies.
Our two roles. We handle two kinds of information, and our role differs for each:
- Connected Data is the data we pull from platforms you connect, such as Google Analytics, QuickBooks, or HubSpot. Your business decides what to connect and why. For Connected Data, we act as a service provider (“processor”) on your business’s behalf, and we only use it to provide the Service to that business. If your business’s data includes information about its own customers, contact your business first with questions about that information.
- Account Data is information about you as a user of the Service, such as your name, email, login activity, and billing details. For Account Data, we decide how it is used, and this policy governs it directly.
If your business has a signed agreement with Amralytics. If your business has signed a Services Agreement or other contract with Amralytics, that contract also governs how we handle your business’s data. Where it gives your business more protection than this policy, the contract controls.
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account Data | Name, work email, company name, role, password (stored hashed) | You, when you sign up |
| Connected Data: analytics and advertising | Website traffic, sessions, conversions, campaign spend and results | Google Analytics, Google Ads, and similar platforms you connect |
| Connected Data: spreadsheets | Contents of the specific spreadsheets you select | Google Sheets |
| Connected Data: accounting | Invoices, payments, transactions, customers, vendors, account balances | QuickBooks, Xero, and similar platforms you connect |
| Connected Data: CRM and e-commerce | Contacts, companies, deals, orders, products, customer purchase history | HubSpot, Shopify, and similar platforms you connect |
| Billing data | Plan, billing contact, payment history. Card numbers are handled by our payment processor, QuickBooks Payments, and never stored by us | You and our payment processor |
| Usage data | Pages viewed, features used, device and browser type, IP address, log and error data | Automatically, when you use the Service |
| Cookies | Login session cookies and preference cookies | Automatically, when you use the Service |
| Communications | Support requests, emails, feedback | You |
We connect to platforms through their official sign-in process (OAuth). We never see or store your passwords for those platforms. We request read-only access wherever the platform offers it, and only the access the features you use need. The list of platforms will grow over time. Before connecting any platform, the Service shows you what access it requests.
Please don’t send us sensitive personal information we don’t need, such as Social Security numbers, health information, or full payment card numbers. If we find it in Connected Data, we will tell your business, stop using it, and delete it at your business’s direction.
3. How we use it
We use the information we collect to:
- Provide the Service: pull and organize Connected Data, and generate reports and insights for your business
- Run your account: sign-in, billing, support, and service messages
- Keep the Service secure: detect abuse, investigate incidents, and prevent fraud
- Improve the Service: understand which features are used, using Usage Data, not Connected Data
- Meet legal obligations
What we don’t do. We don’t sell personal information. We don’t use Connected Data for advertising or share it for targeted advertising. We don’t use Connected Data to build benchmarks or to train or improve any AI model we own or control, unless your business approves it in writing. We don’t make decisions about individuals that produce legal or similarly significant effects.
How we use AI. The Service uses AI tools to help generate insights. We only send Connected Data to AI providers whose contracts or terms prohibit them from training their models on it and limit how long they keep it. We never use consumer-grade or free AI tools that train on inputs. AI-generated insights can be wrong. Treat them as a starting point for your own judgment.
Google user data. Amralytics Connect’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we only use Google user data to provide and improve the user-facing features of the Service that you use. We don’t transfer it to others except as needed to provide those features, for security, to comply with law, or as part of a merger or acquisition with notice to you. We don’t use it for advertising. We don’t use it to develop, improve, or train generalized AI or machine learning models. No person at Amralytics reads it unless you give us permission for specific messages or files, it is needed for security or to comply with law, or it is aggregated and anonymized for internal operations.
4. Who we share it with
We share information only in these cases:
- Service providers (subprocessors) that help us run the Service, under contracts that require them to protect the data and use it only for us. They currently include: Google Cloud Platform (hosting and infrastructure, including sign-in and service emails), Nango (secure connections to the platforms you connect), Anthropic (AI processing), Microsoft 365 (email, including support requests), and QuickBooks Payments (billing). We keep this list current and update it before adding a provider that handles Connected Data.
- Within your business. Users your business adds to its account can see your business’s Connected Data and insights.
- Legal requirements. When required by law, court order, or government request. Where the law allows, we tell your business first.
- Business transfers. If Amralytics is involved in a merger, acquisition, or sale of assets, your information may transfer as part of it, subject to this policy. We will notify you before it becomes subject to a different policy.
- With your permission. When you ask us to share it.
5. Disconnecting, retention, and deletion
- Disconnect any time. You can disconnect a platform in the Service or revoke our access from that platform’s own settings. When you do, we stop pulling new data from it immediately.
- Connected Data is kept while your account is active. When your business closes its account, we delete its Connected Data within thirty (30) days, including from systems and backups we control.
- Backups held by our providers may keep copies for a limited period after that, as set out in our records for each provider, and then delete them in the ordinary course.
- Account Data is deleted within thirty (30) days of account closure, except billing records and other information we must keep by law, typically up to seven (7) years for tax records.
- Usage Data is kept for up to 12 months, then deleted or anonymized.
- Export first. You can export your reports before you close your account. On request, we confirm deletion in writing.
6. How we protect it
We encrypt data in transit and at rest, limit access to the people who need it to run the Service, and require multi-factor authentication for staff access to systems holding Connected Data. Built-in AI features are turned off in workplace tools that handle Connected Data. No system is perfectly secure. If we confirm unauthorized access to your business’s data, we will notify your business within forty-eight (48) hours of confirming it, and notify individuals and regulators as the law requires.
We are based in the United States, and we store and process data in the United States.
7. Your rights
Depending on where you live, including under the Texas Data Privacy and Security Act, you may have the right to:
- Confirm whether we process your personal information, and get a copy of it in a portable format
- Correct inaccurate personal information
- Delete your personal information
- Opt out of the sale of personal information, targeted advertising, and profiling. We don’t do any of these.
How to ask. Email team@amralytics.com. We will verify your identity and respond within forty-five (45) days. If we need more time, we will tell you why and may extend that once by another forty-five (45) days. You can use an authorized agent. We won’t treat you differently for using these rights.
Appeals. If we decline your request, you can appeal by replying to our decision. We will respond within sixty (60) days. If we deny your appeal, you can contact the Texas Attorney General at texasattorneygeneral.gov.
Information your business controls. If your request is about Connected Data, such as information about a customer of a business that uses Amralytics Connect, we will send your request to that business and help it respond.
8. Children
The Service is for businesses. It is not directed to anyone under 18, and we don’t knowingly collect personal information from children. If you believe we have, contact us and we will delete it.
9. Changes to this policy
We will post any changes on this page and update the effective date. If a change materially affects how we use information we already have, we will notify account owners by email at least thirty (30) days before it takes effect.
10. Contact us
Amralytics, LLC, 551 S I-35 Frontage Rd, Ste 300, Round Rock, TX 78664. Email: team@amralytics.com.