Privacy policy

Last updated: 16 September 2026

This privacy policy explains how amphi ("amphi", "we", "us" or "our") collects, uses, shares and protects personal data. It applies to our website at getamphi.com, our merchant dashboard, and the amphi storefront widget and Shopify app (together, the "Services").

amphi provides a widget that merchants add to their online stores to invite their customers to share responses — such as text, poll answers, voice notes, videos and images — in exchange for a reward. Because of this, we handle two different kinds of personal data, and act in two different roles, which we explain below.

1. Our roles: controller and processor

Under data protection laws such as the UK GDPR and EU GDPR, the party that decides why and how personal data is processed is the "controller", and a party that processes data on the controller's behalf is a "processor".

• When you are a merchant using amphi (you create an account and run campaigns), amphi is the controller of your account and business contact data.
• When a shopper submits a response through the widget on a merchant's store, the merchant is the controller of that response and the shopper's personal data. amphi acts as a processor, handling that data on the merchant's instructions to provide the Services. If you are a shopper and want to exercise your rights over a response, please contact the relevant merchant; we will support them in responding.

2. Information we collect

a. Merchant account information

• Identity and contact details — your name, email address and the brand or business name you provide.
• Account credentials — a securely hashed password and authentication data (handled by our authentication provider).
• Store and campaign details — your connected store domain, campaign settings, reward configuration and related preferences.
• Payment and payout information (where relevant) — details needed to fund or process rewards. Card and bank details are handled by our payment and payout providers, not stored by amphi.
• Support and communications — messages you send us and our correspondence with you.

b. Customer responses (shopper data)

• The content a shopper submits — text, poll selections, audio recordings, video recordings and images.
• Optional contact details a shopper provides, for example an email address used to deliver a reward.
• Context about the submission — the campaign, brand and store it relates to, and the date and time.
• Where a reward is issued, limited information needed to fulfil it through our payout provider.

c. Technical and usage information

• Device and connection data — IP address, browser type, operating system and similar identifiers.
• Usage data — pages viewed, features used, and interactions with the widget and dashboard.
• Log and diagnostic data used to keep the Services secure and reliable.

d. Information from Shopify

When a merchant installs our Shopify app, we receive information from Shopify needed to run the Services — such as the store's domain and basic store details, and, subject to Shopify's approval and the merchant's configuration, limited order or customer context associated with a response. We only request the access we need and handle any protected customer data in line with Shopify's requirements.

3. How we use information and our legal bases

We use personal data to:

• provide, operate and maintain the Services, including authenticating merchant accounts, running campaigns, and storing and displaying responses to the relevant merchant;
• issue and fulfil rewards and cashback where a merchant chooses to offer them;
• communicate with you about your account, updates and support;
• keep the Services secure, prevent fraud and abuse, and troubleshoot problems;
• understand how the Services are used so we can improve them; and
• comply with legal obligations and enforce our terms.

Where the UK GDPR or EU GDPR applies, our legal bases are: performance of a contract (to provide the Services to merchants); legitimate interests (to secure, improve and promote the Services, balanced against your rights); consent (for example, where a shopper voluntarily submits a response and any optional contact details, and for non-essential cookies); and legal obligation (to meet our legal and regulatory duties). Where we process shopper data as a processor, we do so under the merchant's instructions and their legal basis.

4. Voice, video and image content

Some responses include a shopper's voice, image or likeness. This content is submitted voluntarily by the shopper, who is told before recording that their response will be shared with the merchant and used in connection with the campaign and any reward. We do not use facial or voice recognition to identify individuals, and we do not use this content to create biometric identifiers. Merchants are responsible for how they subsequently use content shared with them, including obtaining any further permissions required to publish it.

5. How we share information

We share personal data only as needed to run the Services:

• With merchants — responses and related data are made available to the merchant whose campaign the shopper responded to.
• With service providers (subprocessors) — trusted companies that host our infrastructure, store data, provide authentication, deliver rewards, or help us operate. They may only process data on our instructions.
• For legal reasons — where required by law, regulation or legal process, or to protect the rights, safety and property of amphi, our users or others.
• In a business transfer — if amphi is involved in a merger, acquisition or sale of assets, data may be transferred as part of that transaction, subject to this policy.

We do not sell personal data.

6. Service providers and international transfers

We rely on trusted third-party service providers (subprocessors) to deliver the Services. They may only process personal data on our instructions and are bound by appropriate confidentiality and data-protection obligations. These providers fall into the following categories:

• hosting and infrastructure providers (for our website and application);
• database, file storage and authentication providers;
• e-commerce platform and store-integration providers;
• payment and payout providers (for delivering rewards and cashback, where offered);
• email and communication providers (for account, transactional and support messages); and
• analytics and security providers (to help us keep the Services reliable and improve them).

We can provide the current list of the specific subprocessors we use on request — contact us using the details below.

Some of our providers may store or process data outside the UK or European Economic Area, including in the United States. Where personal data is transferred internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or Addendum and the European Commission's Standard Contractual Clauses.

7. Cookies and similar technologies

We use cookies and similar technologies (such as local storage) that are necessary to run the Services — for example to keep merchants signed in and to remember essential preferences. We may also use limited analytics to understand and improve how the Services are used. You can control cookies through your browser settings; blocking essential cookies may affect how the Services work.

8. How long we keep information

We keep personal data for as long as needed to provide the Services and for the purposes described in this policy. Merchant account data is retained while the account is active and for a reasonable period afterwards. Shopper responses are retained on behalf of the merchant for as long as the merchant needs them, subject to the merchant's instructions and our agreement with them. We also retain data where necessary to comply with legal obligations, resolve disputes and enforce our agreements. When data is no longer needed, we delete or anonymise it.

9. How we protect information

We use technical and organisational measures designed to protect personal data, including encryption in transit and at rest, access controls and row-level security on our database, and limiting access to authorised personnel. No method of transmission or storage is completely secure, but we work to protect your information and to respond appropriately to any incident.

10. Your rights

Depending on where you live and your relationship with us, you may have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to delete your data;
• object to or restrict certain processing;
• request a copy of your data in a portable format;
• withdraw consent where we rely on it, without affecting processing already carried out.

To exercise these rights, contact us using the details below. If you are a shopper exercising rights over a response you submitted, please contact the relevant merchant, who is the controller of that data; we will assist them. If you are in the UK or EEA and are unhappy with how we handle your data, you can complain to your local data protection authority — in the UK, the Information Commissioner's Office (ICO) at ico.org.uk.

11. US state privacy rights

If you are a resident of California or another US state with comprehensive privacy laws, you may have rights to know what personal information we collect, to access or delete it, to correct it, and to opt out of its "sale" or "sharing" for targeted advertising. amphi does not sell personal information. To exercise these rights, contact us using the details below; we will not discriminate against you for doing so.

12. Shopify data and deletion

Where amphi operates as a Shopify app, we comply with Shopify's data protection requirements. We honour Shopify's mandatory data-deletion and data-request webhooks: when a merchant uninstalls the app or a store or customer data deletion is requested through Shopify, we delete or return the associated data as required. We handle any Shopify protected customer data in accordance with Shopify's policies.

13. Children's privacy

The Services are not directed at children, and we do not knowingly collect personal data from children under the age of 16 (or the minimum age in your jurisdiction). If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

14. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you. Your continued use of the Services after an update means you accept the revised policy.

15. How to contact us

If you have questions about this policy or how we handle personal data, or you want to exercise your rights, contact us at yannis@getamphi.com.