Privacy Policy

We take data protection seriously and comply with the applicable data protection law, in particular the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG). This policy also tells you about the rights you have. Our service is aimed at companies and developers, not at children under the age of 16.

If any of the terms used here are unfamiliar, our glossary explains them. You can also simply write to hello@useampersand.io with any question about data protection. For our provider identification, see the Legal Notice.

1. Two roles: website operator and processor

This policy covers two different kinds of processing that need to be kept apart:

• As controller for the data that arises when you visit this website, sign in, and pay for a plan (sections 2 to 6).
• As processor for the event data our customers send to POST https://useampersand.io/collect (section 7). There, our customers are the controllers for their own end users’ data; we process it solely on their documented instructions under the data processing agreement. If you are an end user of one of our customers and have a question about your data, please address it to that customer, not to us.

2. Data processed when you visit this website

When you visit this website, data is collected and processed automatically so that we can deliver the site to you:

• IP address and the country derived from it
• browser type and version, and the browser language you have set
• operating system
• the file requested and the volume of data transferred
• the page you came from (referrer URL)
• date and time of the server request

For security reasons this information is stored in our hosting provider’s log files and deleted there after at most 30 days. In individual cases a longer storage period is necessary, for example where abuse or fraud is suspected. In those cases the log files concerned are kept until the matter has been clarified and the resulting measures have been completed.

To deliver this website we use service providers that process your data solely on our behalf and on our instructions (processors under Art. 28 GDPR) and that have implemented appropriate technical and organisational measures to protect it. For operation, delivery and name resolution we use the following:

Vercel (hosting and delivery)

Vercel Inc., 1046 Kearny St., San Francisco, CA 94133, USA. Vercel is the cloud platform on which our website and our API run and from which they are delivered. The application runs in Frankfurt am Main, Germany; requests are received at the Vercel edge location nearest to you, which for visitors in Europe is located in Europe. Technically necessary access data including your IP address is processed in the course of this. You can find more information at https://vercel.com/legal/privacy-policy.

Cloudflare (DNS)

Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare runs the authoritative name servers for our domain and therefore answers the question of which address our website can be reached at. The request for the website itself does not go through Cloudflare but straight to Vercel — Cloudflare is not placed in front of our hosting as a proxy or content delivery network and receives neither the content of your request nor, as a rule, your IP address. You can find more information at https://www.cloudflare.com/en-gb/privacypolicy/.

Neon (database)

Neon, Inc., USA. Neon runs the Postgres database in which account, project and event data is stored. The database we use is located in the Frankfurt am Main region (eu-central-1), that is, inside the European Union.

Some of these providers are established in the USA, so access from there — for example for support or operations — cannot be ruled out, and Resend sends emails from the USA. Such transfers to a third country outside the European Union (EU) and the European Economic Area (EEA) take place on the basis of the European Commission’s adequacy decision for the EU–U.S. Data Privacy Framework, where the provider is certified under it, and otherwise on the basis of the EU standard contractual clauses that form part of the respective providers’ data processing agreements.

The legal basis for processing your data in order to provide this website is Art. 6(1)(f) GDPR. We have a legitimate interest in processing your data so that we can offer you our website and the services provided through it in a technically sound, secure and optimised way.

3. Signing up and signing in

For an account we process your email address and, if you enter one, your name. There is no password: signing in and signing up follow the same path — you enter your address and confirm a six-digit one-time code that we send you by email. The code confirms the address at the same time. We therefore store neither a password nor a password hash. When an account is created, we also record the time and the version of the Terms of Service and the data processing agreement in force at that moment, so that we can show which terms were agreed to.

Accounts are stored by our application in the Neon database described above. One-time codes and other transactional emails are sent by Resend, Inc., USA; your email address and the time of sending are processed in the course of this. Both act as processors under Art. 28 GDPR.

For each signed-in session we store your IP address and your browser’s user agent together with the session, so that sessions can be recognised and misuse of an account can be traced. They are deleted together with the session when you sign out, when the session expires (at the latest one day afterwards) or when you delete your account.

To prevent sign-in codes from being requested in bulk, we count requests per email address and per IP address. We do not store either in readable form, only as a keyed hash, and delete the counters after at most 24 hours. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting the service and the people whose addresses could otherwise be flooded with codes.

The legal basis is Art. 6(1)(b) GDPR — the processing is necessary to perform our contract with you. If you delete your account, your account and project data and the associated events are deleted with it.

4. Payment processing

When you subscribe to a paid plan, our payment service provider Stripe processes the data required for it, including name, payment details and billing address. The payment details themselves never reach us; from Stripe we only receive the status of the subscription and the billing data. You can find more information at https://stripe.com/privacy.

The legal basis is Art. 6(1)(b) GDPR.

5. Cookies and similar technologies

We set exactly one cookie: after you sign in, a technically necessary session cookie that keeps you signed in. It is required in order to provide the service you have expressly asked for — the dashboard. The legal basis is Art. 6(1)(b) GDPR; no consent is required for it under Section 25(2) no. 2 TDDDG (formerly TTDSG).

Beyond that we set no cookies and use no cookie-like technologies such as pixel tags. That is why this website has no cookie banner and no consent manager: there is nothing for you to consent to. The glossary explains what a cookie is.

6. Page views, no advertising — and our own product events

We count visits to this public website on our own servers. When you open a page, we record a page view together with the page’s address (limited to its path and any utm_ campaign parameters), the address of the page that linked to it (limited to its domain and path), and a timestamp.

To determine your country and region, device type, operating system, browser, and whether a request comes from a known crawler, we send your IP address and the user agent provided by your browser to our own analytics service. Both are discarded immediately after this information has been derived and are never stored. We do not set a cookie for this purpose, read anything from your device, or assign you an identifier. As a result, we cannot tell whether two page views come from the same person.

There are no third-party analytics services, advertising networks, social media plugins, or third-party scripts. The legal basis for this processing is Art. 6(1)(f) GDPR. Our legitimate interest is to understand which pages are read and how visitors find us. You can object at any time (see section 10.8).

If you have an account, we also collect a limited number of product events relating to your use of the service. These include signing up and signing in, requesting a sign-in code, creating a project or API key, changing your name, completing a checkout, and deleting your account.

Each event is associated with your account ID and, where applicable, the relevant project ID. The events do not contain your email address or any content received by your projects. We send these events to our own Use Ampersand project on the same infrastructure described above. No other party receives these events. We use this information to understand how the service is used and to improve the service.

The legal basis for this processing is Art. 6(1)(f) GDPR. You may object to this processing at any time (see section 10.8). We retain these events for as long as your account exists and delete them together with your account.

7. Our customers’ event data (processing on their behalf)

Customers send event data to us through the API, typically an event name and a client_id they assign themselves as a pseudonymous identifier for their end users. We do not require the end user’s IP address or user agent for this — there is no fingerprinting, no browser snippet and no cookies. Use Ampersand works server-side only: the data comes from our customer’s backend, not from their end user’s browser.

Customers may additionally choose to send their end user’s IP address and user agent (context.client.ip, context.client.user_agent) so that geo and device information can be derived from them. This processing is transient: both raw values are used solely to derive that information immediately, and are not stored and not logged in the process. The data model has no column for the IP address and none for the user agent. The lookup runs locally against a bundled geo database on our own infrastructure; no additional processor is involved. Whether a customer sends these fields is entirely their decision — if they do not, we process no IP address and no user agent.

We process all event data solely on our customers’ instructions, on the basis of a data processing agreement under Art. 28 GDPR. The data is processed and stored in the EU: the application runs in Frankfurt (see section 2, Vercel), and so does the database (see section 2, Neon).

8. Recipients and processors

We inform our customers in advance before adding or replacing any further processor; the data processing agreement sets out the details.

9. Routine deletion and blocking of data

As a rule we store your data only for as long as is necessary to achieve the purpose of storage, or for as long as required by the European legislator or another legislator in laws or regulations we are subject to. Once the purpose no longer applies or a statutory storage period expires, your personal data is routinely blocked or deleted in accordance with the statutory provisions.

Specifically: server logs are deleted after at most 30 days (section 2), session data when you sign out, at the latest one day after the session expires, or when you delete your account, and rate-limit counters after at most 24 hours (section 3). Account and project data is stored for as long as the account exists. Event data is deleted automatically and irreversibly once the retention period of the relevant plan has passed; which period applies to which plan is shown under Pricing.

10. Your rights

As a data subject you have rights against us, which we set out below. You will find the details in Art. 15 to 21 GDPR and in Sections 32 to 37 BDSG. To exercise your rights, simply write to hello@useampersand.io.

10.1 Right of access

You have the right to obtain confirmation from us as to whether and which data we process about you. This includes, among other things, information about how long and for what purpose we process the data, where it comes from, and which recipients or categories of recipient we pass it on to. You can also obtain a copy of that data from us.

10.2 Right to rectification

You have the right to have inaccurate or no longer accurate information about you corrected by us without undue delay. You can also request that incomplete personal data about you be completed. Where legally required, we will also inform third parties of that correction if we have passed your data on to them.

10.3 Right to erasure (“right to be forgotten”)

You can delete your account yourself at any time under Account settings → Danger zone. This removes your account, all projects and their events, API keys and settings, and cancels a paid subscription beforehand. You do not have to give a reason, and you do not have to write to us first.

Beyond that, you have the right to obtain the erasure of your personal data from us without undue delay where one of the following grounds applies:

• Your data is no longer necessary for the purposes for which it was collected or otherwise processed, or that purpose has been achieved.
• You withdraw your consent and there is no other legal basis for the processing.
• You object to the processing and there are no overriding legitimate grounds for it.
• Your personal data has been processed unlawfully.
• Erasure is required to comply with a legal obligation under Union law or the law of a member state to which we are subject.

Please note that your right to erasure may be restricted by statutory provisions, in particular the restrictions in Art. 17 GDPR and Section 35 BDSG. If your request concerns event data that one of our customers transmitted to us through the API, please address it to that customer — they are the controller for it (see section 1).

10.4 Right to restriction of processing

You have the right to obtain a restriction of the processing of your personal data where one of the following applies:

• You contest the accuracy of your personal data, for a period enabling us to verify its accuracy.
• The processing is unlawful and you oppose erasure and request the restriction of use instead.
• We no longer need your personal data for the purposes of the processing, but you need it to establish, exercise or defend legal claims.
• You have objected to the processing, pending the verification of whether our legitimate grounds override yours.

10.5 Right to withdraw consent

You can withdraw consent given to us at any time with effect for the future. An informal message to the contact address above is enough. Withdrawing your consent does not affect the lawfulness of the processing carried out up to that point. We currently base no processing on this website on consent.

10.6 Right to data portability

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and to transmit that data to others. You will find the details and limitations in Art. 20 GDPR. Exercising this right does not affect your right to erasure.

10.7 Right to lodge a complaint with a supervisory authority

If you believe that our processing of your data infringes applicable data protection law, you have the right to lodge a complaint with a competent supervisory authority, in particular in the member state of your residence, your place of work or the place of the alleged infringement. The authority competent for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 27, 91522 Ansbach, Germany.

10.8 Right to object under Art. 21 GDPR

Under Art. 21 GDPR you have the right, on grounds relating to your particular situation, to object at any time to the processing of your data where we base that processing on legitimate interests under Art. 6(1)(f) GDPR. If you object, we will no longer process your personal data, except in two cases:

• We can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms.
• The processing serves to establish, exercise or defend legal claims.

11. Glossary

This policy uses terms that the legislator uses too, in particular in the GDPR. Because it matters to us that this policy is understandable, some of them are explained below.

Processor

A natural or legal person, public authority, agency or other body which processes personal data on behalf of a controller.

Browser

A browser is a program for displaying websites on the internet, for example Google Chrome or Mozilla Firefox.

Cookies

Cookies are small text files containing a characteristic string (the cookie ID) that are placed and stored on your device through a browser, unless you prevent this through technical settings. Cookies allow the websites and servers you visit to tell your individual browser apart from others. You can configure your browser not to accept cookies, and delete cookies that have already been set at any time. Without our session cookie, however, you cannot sign in to the dashboard.

IP address

An IP address is an address assigned to your device on the internet so that it can be addressed and reached there.

Personal data

Any information relating to an identified or identifiable natural person. A natural person is regarded as identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more special characteristics.

Pseudonymisation

The processing of personal data in such a way that it can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures. The client_id our customers send us is a typical example.

12. Security

We use technical and organisational security measures to protect personal data against misuse, loss, destruction and access by unauthorised persons. We use TLS encryption throughout to protect data in transit; you can recognise an encrypted connection by the padlock symbol and by the address beginning with https://. API keys are not stored in plain text but hashed.

13. External links

This website contains links to external third-party websites, in particular to the privacy policies of the providers named above. If you follow such a link, you leave our website. We have no influence over the data processing on the pages linked to. Their respective providers or operators are solely responsible for their content and for compliance with data protection law.

14. Validity and changes to this privacy policy

This privacy policy is currently valid and is dated 24 September 2026. As our service develops or new technologies are introduced, it may become necessary to change it. We reserve the right to make such changes at any time.

15. Questions about data protection

If you have any further questions about this privacy policy or about your rights, please write to hello@useampersand.io.