Legal

Last Updated: January 2026

Amp respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, disclose, and protect your personal data when you use our website, products, or services. It describes your rights under applicable laws, including the EU General Data Protection Regulation (EU GDPR), the UK General Data Protection Regulation (UK GDPR), the California Consumer Privacy Act/California Privacy Rights Act (CCPA/CPRA), and the Singapore Personal Data Protection Act of 2012 (PDPA).

1. Important Information and Who We Are

Purpose of this privacy policy

This privacy policy explains how Amp collects and processes your personal data through your use of this website or our products and services, including any data you may provide through this website or our apps available on the Shopify App Store.

It is important that you read this privacy policy together with any other privacy policy or fair processing policy we may provide on specific occasions when we are collecting or processing personal data about you. This website is not intended for children under the age of 18, and we do not knowingly collect data relating to children.

Controllers

Amp is a unified brand comprising separate legal entities (collectively, the "Amp Group"), a list of which can be found in Section 13. Each product or service is legally operated by a specific entity within the Amp Group. That entity is solely responsible for processing your personal data as a controller under applicable data protection laws.

We have appointed a data protection officer ("DPO") who is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact the relevant Data Protection Officer using the details set out in Section 13.

Third-party links

This website and our products may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements.

2. The Data We Collect About You

Personal data, or personal information, means any information about an individual from which that person can be identified. We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data — first name, last name, username or similar identifier.
• Contact Data — billing address, email address and telephone numbers.
• Financial Data — bank account and payment card details.
• Transaction Data — details about payments to and from you and other details of applications and services you have purchased from us.
• Technical Data — internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
• Profile Data — your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.
• Usage Data — information about how you use our website, applications, and services, such as session statistics, browsing history, page views, clicks, trackers, user counts, and data communicated while using the services.
• Marketing and Communications Data — your preferences in receiving marketing from us and our third parties and your communication preferences.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity.

We do not intentionally collect special categories of personal data (as defined under GDPR) or sensitive personal information (as defined under CPRA) without explicit consent or where required by law.

3. How Is Your Personal Data Collected?

We use different methods to collect data from and about you including through:

• Direct interactions. You may give us your Identity, Contact and Financial Data by filling in forms or by corresponding with us by email or otherwise. This includes personal data you provide when you purchase products or services, create an account, subscribe to our newsletter, request marketing, or request support.
• Automated technologies or interactions. As you interact with our website or products, we automatically collect Usage Data and Technical Data about your device, browsing actions, and patterns. We collect this data through cookies, trackers, server logs, and similar technologies. Please see our Cookie Policy for further details.
• Third parties or publicly available sources. We may collect or receive personal data about you from analytics providers such as Google and HubSpot, advertising networks such as Google Ads and Meta Ads, payment and delivery services such as Shopify and Amazon Web Services, and hosting and backend infrastructure providers.

4. How We Use Your Personal Data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract we are about to enter into or have entered into with you.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal obligation.

AI Features and Data Processing

We offer AI-powered features, such as our AI Assistant. User inputs in these features are processed to generate responses and insights. We share these inputs with service providers (such as OpenAI) solely to fulfill your requests, under contracts that limit their use of this data to our purposes and prohibit its use for training their own general models.

Marketing

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. We use cookies, trackers, and similar technologies to manage your preferences. For users in the EEA and UK, we will obtain your explicit consent before sending direct marketing communications. You have the right to object at any time to the processing of your personal data for direct marketing purposes.

Advertising and analytics

We use services such as Google Ads, Meta Ads, Google Analytics, HubSpot, and other providers to help us deliver relevant content and measure marketing effectiveness. These providers may use cookies and trackers to collect Usage Data to support interest-based advertising and analytics. You can manage your advertising preferences through our cookie settings or by following opt-out instructions provided in our Cookie Policy.

Opting out

You can ask us or third parties to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you or by contacting us. This opt-out will not affect data provided as part of a purchase or other transaction.

5. Disclosures of Your Personal Data

We may share your personal data with:

• Internal Third Parties such as other companies in the Amp Group, acting as processors (and in some cases as joint controllers), who provide IT, system administration, hosting, support, and reporting services.
• External Third Parties including service providers who help us deliver and support our services (payment processors, hosting and cloud infrastructure providers such as Amazon Web Services, WP Engine, Shopify; tag management services such as Google Tag Manager, Segment; and user database management services such as HubSpot CRM); analytics and advertising partners (such as Google Analytics, Google Ads, Meta Ads, HubSpot); and professional advisers such as lawyers, bankers, auditors, and insurers.
• Government agencies, regulators, tax authorities and other public authorities where reporting or disclosure is required to comply with legal obligations.
• Third parties to whom we may sell, transfer or merge parts of our business or our assets.

We require all third parties to respect the security of your personal data and to handle it in accordance with the law.

6. International Transfers

We operate globally and may transfer your personal data to countries outside of your country of residence, including outside the United States, the European Economic Area (EEA), and the United Kingdom (UK). These countries may have different data protection laws from those in your jurisdiction. Whenever we transfer your personal data internationally, we take steps to ensure it is treated securely and in accordance with this privacy policy and applicable law.

For residents of the EEA and UK, we ensure a similar level of protection is applied by implementing appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission or UK Government. For transfers of personal data originating from Singapore, we ensure compliance with the Singapore PDPA.

7. Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. For users in the EEA or UK, we will notify the relevant supervisory authority within 72 hours. For California residents, we will notify in the most expedient time possible and without unreasonable delay. For users in Singapore, we will notify the Personal Data Protection Commission (PDPC) within three days of determining that the breach is notifiable.

8. Data Retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. In general, this means we keep data for as long as you maintain an account with us or as needed to provide you with our services, and for a period after that where required for legal or operational reasons.

By law, we are required to keep basic information about our customers (including Contact, Identity, Financial, and Transaction Data) for a period required by applicable tax and legal obligations after they cease being customers. In some circumstances we will anonymise your personal data for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

9. Your Legal Rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data. You have the right to:

• Request access to your personal data (commonly known as a "data subject access request").
• Request correction of the personal data that we hold about you.
• Request erasure of your personal data where there is no good reason for us continuing to process it.
• Object to processing of your personal data where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object.
• Request restriction of processing of your personal data in certain scenarios.
• Request the transfer of your personal data to you or to a third party in a structured, commonly used, machine-readable format.
• Withdraw consent at any time where we are relying on consent to process your personal data.

If you wish to exercise any of the rights set out in this Privacy Policy, please contact us using the details provided in Section 13. We try to respond to all legitimate requests within one month.

10. EEA Data Subjects: Your Rights Under the EU GDPR

As an EEA (European Economic Area) data subject, you have specific rights under the EU General Data Protection Regulation (EU GDPR). These rights are in addition to the general legal rights outlined in Section 9.

To file a GDPR complaint with a supervisory authority, please visit the European Data Protection Board's website.

11. California Consumers: Your Rights Under the CCPA/CPRA

You have the right under the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA), to exercise free of charge:

• Disclosure of Personal Information — You have the right to know the categories of personal information we have collected about you, the categories of sources, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about you.
• Opt-out of Sale or Sharing — You have the right to opt-out of the sale of your personal information or sharing for the purpose of targeted behavioral advertising. To opt-out, email hello@useamp.com.
• Right to Limit Use of Sensitive Personal Information — You have the right to limit the use and disclosure of your sensitive personal information to uses necessary to perform the services.
• Right to Deletion — Subject to certain exceptions, you may request that we delete your personal information from our records and direct our service providers to do the same.
• Right of Correction — If we maintain inaccurate personal information about you, you have the right to request correction.
• Protection Against Retaliation — You have the right to not be retaliated against for exercising any of your rights under the CCPA/CPRA.

12. Singapore Users: Your Rights Under the Singapore PDPA

• Right of Access — you may request access to your personal data and information on how it has been used or disclosed in the past year.
• Right of Correction — you may request that we correct any errors or omissions in your personal data.
• Right to Withdraw Consent — you may withdraw consent that you previously gave, subject to legal or contractual restrictions.
• Right to Data Portability — you may request a copy of your personal data in a commonly used machine-readable format and have it transmitted to another organisation, where this right applies under the Singapore PDPA.

13. How to Contact Us / Data Protection Officer

For any questions regarding this Privacy Policy or to exercise your legal rights, please contact the relevant Data Protection Officer:

You also have the right to make a complaint at any time to the data protection authority in your jurisdiction, though we would appreciate the opportunity to address your concerns first.

14. Governing Law and Dispute Resolution

The governing law and dispute resolution provisions applicable to this Privacy Policy are set forth in our Terms of Service. All disputes arising in connection with this policy shall be handled in accordance with the arbitration and jurisdiction provisions stated therein.

Last Updated: January 2026

This Cookie Policy is part of Amp's Privacy Policy and should be read together with it. This policy explains how Amp ("we," "us," "our") uses cookies, trackers, and similar technologies on useamp.com and related services to deliver, secure, and improve our services, enhance your experience, and support marketing and analytics.

1. What Are Cookies and Trackers?

Cookies are small text files placed on your device when you visit our website, used to store information such as preferences or session data.

Trackers refer more broadly to technologies like web beacons, pixel tags, scripts, and device fingerprinting that collect data about your interactions with our content and services. Throughout this document, we'll often refer to all such technologies collectively as "Trackers."

2. Why We Use Trackers

We use Trackers to:

• Ensure the proper functioning of our website and services.
• Enhance your user experience by remembering preferences.
• Measure website usage and performance.
• Support compliance with legal obligations (e.g., cookie consent logging).

We use both first-party Trackers (set by us) and third-party Trackers (set by our service providers). Consent is required for non-essential cookies and similar technologies that collect personal data, while strictly necessary cookies — such as those used for security, authentication, or core site functionality — do not require consent. Consent can be given through cookie banners or your browser and device settings, and you may withdraw it at any time.

3. Types of Trackers We Use

• Strictly Necessary Trackers — Essential for our website to operate correctly. For example, they allow you to log into secure areas, use a shopping cart, or access e-billing services.
• Analytical/Performance Trackers — Help us understand how visitors use our website, including the number of visitors and how they navigate our pages.
• Functionality Trackers — Recognize you when you return to our website, allowing us to personalize content for you and remember your preferences.
• Targeting/Marketing Trackers — Record your visits to our website, the pages you've viewed, and the links you've followed. We use this information to make our website and advertising more relevant to your interests. Session cookies generally expire when you close your browser, while persistent cookies remain for a limited period.

4. Specific Trackers We Use

Please note that third parties (including advertising networks and web traffic analysis services) may also use Trackers over which we have no control. For complete and up-to-date information, please consult the privacy policies of the respective third-party services listed.

AI and Trackers

Certain Amp features are powered by AI tools that use trackers to analyze user inputs and behavior. These trackers help deliver tailored responses and improve service functionality. See our Privacy Policy for more details on how AI-powered features process your Personal Data.

5. How to Manage Your Tracker Preferences

Your Consent and Preferences

When the use of Trackers requires your consent, you can provide or withdraw that consent by adjusting your preferences through the privacy choices panel available on useamp.com. For any third-party Trackers, you can manage your preferences using their specific opt-out links (where provided), by consulting their privacy policies, or by contacting the third party directly.

Controlling Trackers via Your Device Settings

You can also manage or delete Trackers, including cookies, through your browser settings. For mobile apps, you can manage certain categories of Trackers by adjusting your device's advertising or tracking settings.

Opting Out of Interest-Based Advertising

You can opt out of interest-based advertising through industry initiatives such as:

• YourOnlineChoices (EU and UK)
• Digital Advertising Alliance (US)
• DAAC (Canada)
• DDAI (Japan)

The Digital Advertising Alliance also offers an application called AppChoices to help control interest-based advertising on mobile apps.

6. Consequences of Denying Trackers

You are free to decide whether or not to allow the use of Trackers. However, please note that Trackers help useamp.com provide a better experience and advanced functionalities. If you choose to block the use of Trackers, we may be unable to provide certain features.

7. Owner and Data Controller

Data Protection Officer:
Addition Apps Pte Ltd (UEN 202142308H)
90 Eu Tong Sen Street #03-02, Singapore 059811
dpo@useamp.com

8. Your Rights

You have the right to control how your data is collected and used via cookies and trackers. For more information about your legal rights under applicable privacy laws, please consult our Privacy Policy.

9. Governing Law and Dispute Resolution

The governing law and dispute resolution provisions applicable to this Cookie Policy are set forth in our Terms of Service. All disputes arising in connection with this policy shall be handled in accordance with the arbitration and jurisdiction provisions stated therein.

Last Updated: January 2026

This Data Processing Agreement and its Annexes ("DPA") is incorporated into and part of the Terms of Service ("TOS") between the Controller and Processor (collectively, the "Parties"). This DPA reflects the parties' rights and obligations with respect to Personal Data processed as part of the Services. In the event of a conflict between the terms of this DPA and the TOS with respect to the subject matter herein, the terms of this DPA govern.

1. Definitions

For the purposes of this DPA, the following terms shall have the meanings specified below:

• "Breach Event" means any incident where security is compromised, resulting in unintentional or illegal destruction, misplacement, modification, or unauthorized sharing or access to Personal Data that has been transmitted, stored, or otherwise processed.
• "Controller" means the customer who is accessing and using the Services.
• "Data Privacy Laws" means all applicable data protection and privacy laws, regulations, codes, and regulatory requirements relating to the collection, use, disclosure, or other processing of Personal Data, including EU GDPR, UK GDPR, CCPA/CPRA, and the Singapore PDPA.
• "Data Subject" refers to the identified or identifiable natural person whose Personal Data is processed.
• "Personal Data" refers to any information that is tied to an identified or identifiable natural person that is protected as personal data or personally identifiable information under applicable Data Privacy Laws.
• "Personnel" refers to the employees or other individuals who are in a contractual relationship with the Processor, including employees or other individuals who are in a contractual relationship with the Sub-Processor.
• "Processing" means actions performed by the Processor on the Personal Data whether by automated means or not, including collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
• "Processor" means the specific legal entity within the Amp Group that provides the Services to the Controller under the TOS. A list of Amp Group legal entities is set out in Schedule 4.
• "Services" means any products or services provided by the Processor pursuant to the TOS, including the Apps.
• "Subprocessor" or "Subcontractor" refers to any third party appointed by the Processor to assist in fulfilling its obligations in providing Services to the Controller.

2. Purpose

The purpose of this DPA is to define the conditions under which the Processor shall process Personal Data on behalf of the Controller.

3. Compliance with Laws

The Processor warrants that any Processing activities performed on behalf of the Controller will be conducted in accordance with all applicable Data Privacy Laws. The Processor must notify the Controller if it is no longer able to meet its obligations under applicable Data Privacy Laws.

The Controller has sole responsibility for the quality and accuracy of the Personal Data and how it acquired such data. The Controller is also responsible for complying with transparency and consent requirements for the collection, use, and transfer of the Personal Data under applicable Data Privacy Laws.

4. Ownership of Data

All Personal Data processed by the Processor in performing the Services shall remain the property of the Controller.

5. Duration of Processing

Processing obligations under this DPA will run until the end of the Processor's provision of Services to the Controller.

6. Types of Data

The Processor will process the categories of Personal Data provided by the Controller as set forth in Schedule 1.

7. Instructions for Processing

The Processor shall only process Personal Data in accordance with this DPA, including specific instructions set forth in Schedule 2, except where otherwise required by applicable law. The Processor shall immediately inform the Controller if any instruction relating to the Personal Data infringes or may infringe any Data Privacy Laws.

AI Processing Notice: Where the Services include features powered by artificial intelligence (AI), such as chat-based assistants or automated content generation, the Processor shall ensure that all such processing is conducted in compliance with the obligations set forth in this DPA. The Processor shall not use Personal Data for AI model training unless explicitly instructed by the Controller.

8. Data Subject's Rights

The Processor shall promptly notify the Controller of any requests from a Data Subject to exercise their rights under applicable Data Privacy Laws and shall assist the Controller in responding to a Data Subject's request as provided in the processing instructions, Schedule 2.

9. Data Protection Impact Assessments

The Processor shall assist the Controller in performing data protection impact assessments. At the Controller's request, the Processor shall provide all necessary information the Controller needs to meet their data protection assessment obligations, including information about data transmittal, data storage, methods of processing, encryption, and data destruction.

10. Confidentiality

Both Parties agree to maintain the confidentiality of Personal Data and not to disclose such data except as expressly permitted under the terms of this Agreement. The Processor shall ensure that all personnel authorized to process Personal Data are subject to binding confidentiality obligations.

11. Liability

The Parties agree to indemnify one another against any claims, including but not limited to damages and fines, arising out of their respective breaches of this Agreement. Each Party's liability shall be determined in accordance with applicable Data Privacy Laws, subject to the limitations of liability under the TOS.

12. Data Security

The Processor shall, at all times, implement and maintain appropriate technical and organizational security measures to ensure a level of security appropriate to the risk to protect the Personal Data against accidental, unauthorized, or unlawful destruction, loss, alteration, disclosure, or access. Such measures shall be at least equivalent to the technical and organizational measures set out in Schedule 3.

13. Breach Notification

The Processor shall notify the Controller without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of a Breach Event. The Processor will provide the Controller with all information reasonably available to assist the Controller in assessing the breach and in complying with its notification obligations under applicable Data Privacy Laws.

14. Limitations on Use

The Processor shall not use or authorize the use of the Personal Data for any purpose other than those outlined in this Agreement or for purposes other than performing its obligations under the TOS.

15. Subcontractor Requirements

The Processor may engage Subprocessors to process Personal Data on its behalf, provided that: (a) each Subprocessor is subject to obligations equivalent to those set out in this DPA; (b) the Processor remains fully liable for the acts and omissions of its Subprocessors; and (c) the Processor shall notify the Controller in advance of any intended changes concerning the addition or replacement of Subprocessors, thereby giving the Controller the opportunity to object on reasonable grounds.

16. International Data Transfers

The Processor shall not transfer Personal Data to a country or territory outside the European Economic Area, the United Kingdom, Singapore, or other jurisdictions recognized as providing an adequate level of protection, unless such transfer is made in compliance with applicable Data Privacy Laws. Appropriate safeguards may include the use of Standard Contractual Clauses, legally enforceable obligations, or other lawful transfer mechanisms.

17. Destruction or Return of Data

The Processor agrees to, at the Controller's choice, securely delete or return the Personal Data within 30 days upon the Controller's request at any time during the TOS term or upon termination or expiration of the TOS, except to the extent that storage of any such data is required by applicable law. For further details on Amp's data retention practices, please refer to our Privacy Policy.

18. Audits and Compliance

The Processor shall permit the Controller, or an independent auditor appointed by the Controller, to conduct audits or inspections with reasonable notice during regular business hours to ensure compliance with the terms of this DPA and applicable Data Privacy Laws. The scope of the audit shall be limited to the systems, procedures, and documentation relevant to the processing of Personal Data.

19. Recordkeeping Obligations

The Processor shall maintain records of processing activities carried out on behalf of the Controller as required under applicable Data Privacy Laws. Such records shall be made available to the Controller upon request within a reasonable period.

---

Schedule 1 — Types of Data and Data Subjects

Categories of Personal Data

• Contact details (e.g., names, email addresses)
• Technical identifiers (e.g., IP address, device ID)
• Usage and analytics data (e.g., clickstream, app interactions)
• Transaction data (e.g., order and payment history)
• Location or demographic data (e.g., language, country)

Categories of Data Subjects

• End users of the Amp application or website
• Customers or clients of the Controller
• Employees or contractors of the Controller (if applicable)

Schedule 2 — Specific Processing Instructions

The Processor shall:

• Process Personal Data only as necessary to provide the Services described in the TOS
• Assist the Controller in responding to Data Subject requests as required by applicable Data Privacy Laws
• Refrain from using Personal Data for its own purposes
• Limit access to Personal Data to authorized personnel only
• Implement appropriate security measures as set out in Schedule 3
• Notify the Controller of any Breach Event in accordance with Clause 13

Schedule 3 — Minimum Technical and Organizational Security Measures

The Processor shall implement appropriate measures to ensure the confidentiality, integrity, availability, and resilience of Personal Data. These measures include, at a minimum:

• Encryption of data in transit and at rest
• Role-based access controls and authentication mechanisms
• Regular vulnerability and patch management
• Secure data backup and recovery processes
• Monitoring and logging of access and use

Schedule 4 — Amp Group Entities