Privacy Policy

Introduction

Amptune is operated by Moltke Benjaminsen ApS, an EU-based company that acts as the data controller for the personal data described in this policy. This policy covers account holders and the data routed through the platform. As an EU company, we process personal data in accordance with the EU General Data Protection Regulation (GDPR).

Private Beta

Because Amptune is in private beta, our data-handling practices may change as the product evolves, and beta data may be reset or purged during this period. We will update this policy to reflect material changes.

Information We Collect

Account data

• Email address and username
• A bcrypt hash of your password (we never store your password in plain text)
• Email-verification tokens and password-reset tokens
• Failed-login attempts and account lock status
• Last-login timestamp
• Newsletter subscription flag
• Terms-acceptance date

Reach / product data

• reach_uid — a per-product, abstracted UUID that need not contain any PII
• Push subscription data — endpoint, p256dh key, auth_key, and user_agent
• Notification fires and interaction timestamps, such as clicks and returns

Why We Collect It & Legal Basis (GDPR)

• Account creation and service delivery — performance of a contract.
• Account security and anti-abuse — our legitimate interests.
• Newsletter and push notifications — your consent.
• Legal compliance — compliance with a legal obligation.

Cookies & Sessions

We use a session cookie backed by Redis to keep you signed in, and PostgreSQL for persistent storage. We use only minimal, essential cookies required to operate the service.

Push Notification Data

When an end user subscribes to Web Push, their browser provides a subscription consisting of an endpoint URL and cryptographic keys (p256dh and auth_key) along with a user_agent. We use this data solely to deliver the notifications that the end user or customer has opted into.

Third Parties / Sub-processors

Delivery relies on third-party push services that receive the tokens and payloads necessary to deliver notifications:

• Web Push browser services (using VAPID)
• Apple Push Notification service (APNs)
• Firebase Cloud Messaging (FCM)

Infrastructure providers for hosting and email are used generically to operate the service.

Data Retention

We retain personal data while your account is active and throughout the beta. Beta data may be reset or purged during this period. Verification and password-reset tokens are short-lived. When your account is terminated, your data may be deleted.

Your Rights (GDPR)

Subject to applicable law, you have the right to access, rectification, erasure, portability, restriction, and objection, as well as the right to withdraw consent (for example, for the newsletter or push notifications) at any time. You also have the right to lodge a complaint with a supervisory authority — in Denmark, the Danish Data Protection Agency (Datatilsynet). To exercise your rights, contact us using the details below.

Changes to This Policy

We may update this policy from time to time. Updates are posted here, and the “Last updated” date above reflects the latest revision.

Contact

The data controller is Moltke Benjaminsen ApS. For privacy questions or to exercise your rights, email [email protected].