Privacy Policy

1. Who we are

The data controller is Amber Multi UK Ltd, a company registered in England and Wales (Company No. 14017710), registered office 27 Old Gloucester Street, London WC1N 3AX. Data protection contact: info@ambermulti.co.uk.

2. Data we collect

• Account data — name, email, business name, phone number, login credentials.
• Payment data — handled by Stripe; Amber Multi never sees or stores full card details.
• Project data — intake form responses, uploaded files, dashboard messages.
• Usage data — login times, dashboard activity, IP addresses, browser metadata.
• Your visitors' data — where your delivered website collects visitor data (e.g. contact forms), you are the controller and Amber Multi acts as processor on your behalf.

3. Why we use it (lawful bases)

• Delivering the service you booked — contract performance (UK GDPR Art. 6(1)(b)).
• Payment processing — contract performance.
• Service improvement and fraud prevention — legitimate interests (Art. 6(1)(f)).
• Marketing emails — consent only (Art. 6(1)(a)), and only if you opt in.
• Legal compliance — legal obligation (Art. 6(1)(c)).

4. Sub-processors

We use the following providers to run the service: Stripe (payments), Vercel (hosting infrastructure), Supabase (database and authentication), and Resend (transactional email). This list is kept current in this policy as the stack evolves.

5. International transfers

Where personal data is transferred outside the UK (for example to US-based infrastructure providers), we rely on appropriate safeguards including UK adequacy regulations, the International Data Transfer Agreement, or Standard Contractual Clauses with the UK Addendum.

6. How long we keep it

• Account data: while the account is active, then 6 years after closure (UK tax and contract limitation periods).
• Payment records: 7 years (HMRC requirement).
• Project intake data: for the duration of the hosting relationship plus 6 years.
• Dashboard messages: duration of the hosting relationship plus 2 years.
• Marketing subscriptions: until you withdraw consent.

7. Your rights

Under UK GDPR you can access, rectify, erase, restrict, port, and object to processing of your personal data, and withdraw consent where processing is based on consent. Email info@ambermulti.co.uk — we respond within one month.

8. Security

We apply reasonable technical and organisational measures including encrypted transmission (HTTPS/TLS), access controls, row-level database security, regular software updates, and platform-level backups. No system is 100% secure — please use a strong, unique password for your dashboard.

9. Cookies

See our Cookie Policy.

10. Children

Our services are not intended for under-18s and we do not knowingly collect data from minors.

11. Changes

Material changes are notified via dashboard message at least 30 days before taking effect.

12. Complaints

Contact us first at info@ambermulti.co.uk and we'll do our best to put things right. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.