Privacy Policy

This policy explains what AMI collects, why, who else sees it, and what you can ask us to do about it. The data controller is Mahmoud Zehri, Doueir Main Street, Nabatieh 7104, Lebanon. Questions or requests: support@myamiapp.com.

1. What we collect

a. Things you give us

• Account details — your email address, a password (stored only as a hash, never in readable form), and the display name you choose.
• Preferences — interview language, tone, answer length, theme, overlay settings and similar choices.
• Personalisation you type in — the optional background, specialities, stories, ideas and job-description text you enter to make answers fit you. This is stored on your own computer, and is sent to our servers only as part of the prompt when an answer is generated.

b. Things created by using AMI

• A device identifier — a one-way hash derived from characteristics of your computer. It lets us enforce a one-time free trial per machine without requiring an account. It is not your name, your hardware serial, or anything that identifies you personally.
• Interview time used — a count of seconds, to enforce the free trial.
• Answer usage records — for each answer: the time, your plan, which model was used, how many words (tokens) were processed, the cost, how long it took, whether it succeeded, and how many earlier turns of the session were included. Never the question or the answer text. Used to keep the service fast and affordable.
• Your confirmations — that you are 18 or over, and which version of these terms and this policy you accepted, and when.
• Question text and generated answers — passed through our server to the AI provider. See section 3 for retention.
• Subscription state — your plan, its status, the renewal or end date, and an identifier for the subscription at our payment provider.
• Technical logs — standard server logs, including IP address and timestamps, used for security and debugging.

c. What we never collect

• Audio or recordings. None, ever.
• Card or bank details. These go directly to Paddle. We never see or hold them.
• Screenshots or screen contents. AMI does not capture your screen. Its invisibility self-check runs entirely on your machine.
• Contacts, files, or browsing activity.

2. Why we use it, and our legal basis

To provide AMI	Performance of our contract with you.
To enforce the free trial	Legitimate interest in offering a trial without it being abused.
To take payment	Performance of our contract, and legal obligations on tax and records.
To send service email	Performance of our contract (verification, password reset, receipts).
Security and debugging	Legitimate interest in keeping the service safe and working.

We do not sell your data. We do not use it to train AI models. We do not run advertising or third-party tracking on our website.

3. How long we keep it

• Question text and answers: passed through to generate your answer and not stored in our database. They may persist briefly in server logs and, separately, in the AI provider’s own systems under their retention policy.
• Account and subscription records: for as long as your account exists, and after deletion only where we must keep records for tax or accounting.
• Device identifier and trial usage: kept while the record is needed to enforce the one-time trial.
• Server logs: a short rolling period.
• Backups: encrypted copies of our database, made by hand at most monthly and before changes to it, kept for up to three months. They contain the same account and usage records described above, and never question or answer text.

4. Who else processes your data

We use a small number of service providers. Each acts on our instructions, and this list is complete as of the date above:

• Supabase — accounts, authentication and database, hosted in the European Union (Frankfurt, Germany).
• Render — hosting for our server and website, in Frankfurt, Germany.
• Groq — AI inference. Receives the question text, your personalisation prompt and the earlier questions and answers of the same session (so follow-up questions make sense), in order to generate an answer. Receives no audio and no account credentials.
• Paddle — our Merchant of Record. Handles checkout, payment, tax and invoicing, and is the controller of your payment data. We send Paddle your account email and an AMI identifier for your device so your subscription can be matched to you. See Paddle’s own privacy policy.
• Resend — our email delivery provider. It delivers the emails we send you (account verification and password reset), so it receives your email address and the content of those emails.
• Cloudflare — domain name service, routing of inbound support email, and the network that delivers our website and server traffic.
• GitHub — hosts the AMI installer and its updates. When you download AMI, or the app checks for an update, GitHub receives your IP address and the app version.

Some of these operate outside your country, so your data may be transferred internationally. Where that happens we rely on the safeguards those providers offer for such transfers, such as standard contractual clauses.

Groq, Resend, Paddle, Cloudflare, GitHub and Supabase each state in their own terms that they may process personal data outside the European Union; Groq, Resend, GitHub and Supabase name the United States. They describe safeguards such as the European Commission’s standard contractual clauses, and Resend, Cloudflare and GitHub also state that they comply with the EU-U.S. Data Privacy Framework.

5. Your rights

Depending on where you live, you may have the right to:

• ask what we hold about you, and get a copy;
• have inaccurate details corrected;
• have your data deleted;
• object to, or ask us to restrict, certain processing;
• receive your data in a portable form;
• withdraw consent where we relied on it;
• complain to your local data protection authority.

Email support@myamiapp.com and we will respond within 30 days. Deleting your account is a real deletion, not a flag — but note that payment and invoice records held by Paddle are subject to their retention obligations, and that deleting your account does not cancel a subscription: cancel it first.

6. Security

Traffic is encrypted in transit. Passwords are hashed by our authentication provider and are never visible to us. AI provider keys are held only on our server and are never shipped inside the application. Access to the database is limited to what the service needs.

No system is perfectly secure. If a breach ever affects your personal data, we will notify you and the relevant authority as the law requires.

7. Children

AMI is for adults. It is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has created an account, tell us and we will remove it.

8. Other people’s voices

AMI processes the sound your computer plays through its audio output (during a call, the voices of the other participants). It never uses your microphone. That processing happens on your machine only, and no recording is created or transmitted. Even so, the law in many places requires you to have everyone’s consent before recording or processing a conversation. Obtaining that consent is your responsibility, not ours — see section 4 of our Terms of Service.

9. Changes

If we change this policy materially we will say so here and, where it affects you, by email or in the application.

10. Contact

Mahmoud Zehri, Doueir Main Street, Nabatieh 7104, Lebanon
support@myamiapp.com