AmuletIQ
Sign InBook a Demo

Privacy Notice.

Collecting Data

AmuletIQ acts as the Data Processor on behalf of the customer, who is the Data Controller. Data is collected by AmuletIQ on behalf of the customer.

What Data is Collected

The personal data that AmuletIQ collects can be split into administrator and monitored user data, representing the person who purchases and configures the subscription and the employees whose AI tool usage is governed by it respectively.

Data collected about the administrator is:

  • Name
  • Email address
  • Phone number
  • Password (stored only as a one-way hash)
  • Two-factor authentication secret and recovery codes (stored encrypted)
  • Company name and company logo
  • Payment references - Stripe customer and payment identifiers, amount, currency and status

AmuletIQ does not collect or store card numbers, cardholder names or expiry dates. Card details are collected and tokenised by Stripe in the customer's browser and never reach AmuletIQ.

Data collected about the monitored user is:

  • Name
  • Email address
  • Phone number
  • Password (stored only as a one-way hash)
  • Two-factor authentication secret and recovery codes (stored encrypted)
  • Role within the customer's organisation

AmuletIQ also collects a record of each monitored user's activity on the AI websites the customer's policies govern. This activity data is linked to the individual, and consists of:

  • The website address visited
  • The type of activity - site visit, prompt submission, or file upload
  • The action the policy applied - block, redirect, warn, or none
  • The date and time, and the grouping of consecutive activity on one website into a single visit
  • The text of a submitted prompt, where the applicable policy's logging level records it
  • The name, size and type of an uploaded file, where the applicable policy's logging level records it
  • The text extracted from an uploaded file, where the applicable policy's logging level records it
  • Which of the customer's sensitive-data patterns were matched in that prompt or file

The logging level is set by the customer on each policy and can be set to record any amount of content from nothing at all to the entire text contents of the files/text inputs submitted. Only activity relevant to preventing data leakage and compliance breaches is recorded; AmuletIQ does not observe general browsing, and does not collect IP addresses, operating system, browser type or referring URLs.

Legal Basis

The basis for collecting this data is as follows.

To fulfil a contract:

  • Customer information is needed to create and administer the customer's account, to bill the subscription, and to contact the administrator about it.
  • Monitored user account information is needed for AmuletIQ to identify the user, authenticate them, and deliver the correct policy to their browser.

Legitimate interest:

  • Activity data is processed in the customer's legitimate interest in governing the use of AI tools within their organisation - preventing sensitive or regulated information from being sent to third-party AI services, evidencing that controls are working, and identifying where policies need adjusting.
  • Prompt text, file metadata and extracted file content are recorded only where the customer has judged it necessary to establish what information was at risk of disclosure, and only to the extent their policy specifies. Prompt text is only recorded when the customer opts in via dashboard/settings. The customer may opt out of recording raw prompt content or file contents from page dashboard/settings, or by contacting support@amuletiq.com.

Legal obligations:

  • Account, payment and activity information can be provided to authorities where AmuletIQ or the customer is required to do so, or where it evidences criminal activity carried out through the customer's systems.

Data Sharing with Third Parties

AmuletIQ uses a small number of processors to deliver the service, and shares only what each needs:

  • Stripe, to take payment and manage the subscription - the administrator's contact details and payment information, which is supplied to Stripe directly by the customer's browser.
  • Resend, to deliver account emails such as invitations and verification codes - the recipient's email address.
  • Atlassian (Jira), only where the customer has connected their own Jira site, and only for the activity records the customer chooses to export to it.

AmuletIQ does not sell any of this data, does not use it to train AI models, and does not share it with any other third party without first receiving customer consent.

Information Usage

Data is used for the purposes outlined in the Legal Basis section of this document.

Data Retention

Account and activity data is stored for as long as the customer's subscription remains active, and is deleted six months after the subscription end. The customer can delete activity records at any point from their dashboard, and account records when a user leaves their organisation.

Rights of Subjects

Either an administrator or a monitored user can request access to, correction of, or removal of their data at any point. Requests concerning a monitored user's activity data are decided by the customer as Data Controller; AmuletIQ will pass such a request to them and act on their instruction. If an account is removed, that user can no longer sign in and the extension will stop applying the customer's policies on their browser.

Raising a Complaint or Making Data Removal Requests

Data subjects can raise issues, complaints, or request to have their data removed by emailing support@amuletiq.com.