Privacy Policy

Last updated: 2026-08-22

This Privacy Policy explains how Ampersand IT collects, uses and protects your personal data on ampersand-it.com and across the products we operate. Ampersand IT is the data controller for the processing described below. Individual products publish their own policy with product-specific detail; where they do, that policy prevails for the product in question.

1. Who we are

Ampersand IT is a software engineering company that builds and operates the products listed at ampersand-it.com/products. You can reach us at any time at support@ampersand-it.com.

2. What data we collect

Account data. When you sign in through Ampersand Identity (auth.ampersand-it.com) or a connected provider (Google, Discord, Telegram), we receive your identifier, email address, display name and avatar.
Content you create. Files, messages, settings, records and any other data you upload to or generate inside Ampersand IT.
Enquiries. The name, email address and message you send through the contact form on this website, so that we can reply to you.
Technical data. IP address, browser and device type, operating system, language, referring page, timestamps and pages visited.
Diagnostics. Error reports and performance logs used to keep the service stable.

We do not intentionally collect special categories of personal data, and we ask you not to submit them.

3. Why we process your data

To provide, operate and maintain Ampersand IT — performance of a contract with you.
To authenticate you and keep your account secure — performance of a contract and our legitimate interest in preventing abuse.
To fix bugs, monitor availability and improve the service — legitimate interest.
To answer your support requests — performance of a contract and legitimate interest.
To comply with accounting, tax and other legal obligations — legal obligation.

4. Cookies and similar technologies

We use strictly necessary cookies to keep you signed in, remember your interface language and protect forms against cross-site request forgery. These cookies are required for the service to work and cannot be switched off in our systems. Where we use optional analytics, it is aggregated and cannot be used to identify you individually. You can delete cookies in your browser settings at any time, but parts of Ampersand IT may stop working.

5. Who we share data with

We never sell your personal data. We share it only with service providers who process it on our behalf and under contract:

Ampersand Identity — authentication and single sign-on.
Hosting provider — infrastructure on which the service and its databases run.
Ampersand Email Service — transactional email (confirmations, password resets, notifications).
Payment providers — where Ampersand IT offers paid features; card details are handled by the payment provider and never reach our servers.

We may also disclose data when required by law, or to protect the rights, property or safety of Ampersand IT, our users or the public.

6. International transfers

Our infrastructure and some of our providers are located in the European Economic Area and other countries. Where data leaves the EEA, we rely on adequacy decisions or on the European Commission's Standard Contractual Clauses.

7. How long we keep data

We keep account data for as long as your account exists and for up to 90 days after you delete it, so the deletion can be reversed if it was accidental. Technical logs are kept for up to 12 months. Data we must retain for accounting or legal reasons is kept for the period required by law.

8. Your rights

Subject to applicable law — in particular the GDPR — you have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent where processing is based on consent. To exercise any of these rights, write to support@ampersand-it.com; we respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

9. Security

We protect data in transit with TLS, store passwords only as salted hashes, restrict internal access to what each role needs, and keep audit logs of administrative actions. No system is perfectly secure, so we cannot guarantee absolute security, but we will notify you and the competent authority about a breach affecting your data as required by law.

10. Children

Ampersand IT is not directed at children under 13 (or the minimum age required in your country). We do not knowingly collect their data. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy as the service evolves. The "last updated" date at the top always reflects the current version, and we announce significant changes inside the product or by email.

12. Contact

Ampersand IT — support@ampersand-it.com — ampersand-it.com