Privacy Policy

1. Who we are

AmplifyU is provided by AmplifyU Technologies Ltd, a company registered in the United Kingdom.

Company number: 17283627
Registered office: 14/2E Docklands Business Centre, 10-16 Tiller Road, London, E14 8PX
Contact: hello@amplifyu.app

We are the data controller for the personal data described in this policy. AmplifyU does not require a Data Protection Officer, confirmed directly with the ICO.

This policy covers both our website (amplifyu.app) and our app.

2. Your privacy at a glance

• Your core AmplifyU programme responses are stored locally on your device, not in an AmplifyU database.
• When you use AI coaching or voice practice, certain information is temporarily sent to our AI and technology providers so they can provide the requested feature.
• We don't sell your personal information or use it for advertising.
• We don't currently require you to create an account with your name or email address to use the programme.
• You can delete the programme data stored on your device at any time.
• Our website uses optional analytics cookies, only with your consent.

3. What information we collect

A. Information you provide

• Onboarding reflections (e.g. what's holding you back, where you want to grow, how you'd describe yourself, where you want to be)
• Your professional role category
• Day 14 blueprint questions (your current role, what you most want to be known for in 12 months, what held you back most at the start, where you felt the biggest change, and what still feels hardest)
• Creative and practice content you submit for specific features, including: notes for narrative/storytelling exercises (e.g. Day 8), briefs for the AmplifyU Speech Writer, and context for High-Stakes Conversation practice (your role, who you're meeting, the purpose of the meeting, your industry, and any additional context or notes on pressure/style you choose to add)
• Your LinkedIn profile content, if you choose to use the LinkedIn audit/rewrite feature — either as pasted text, or as an uploaded screenshot image
• Any other answers you voluntarily provide within the programme

B. Voice and practice data

• Where the programme includes voice-based practice (including High-Stakes Conversation rehearsal), we access your microphone and process the resulting audio to provide coaching feedback (see Section 7).
• On Day 2, AmplifyU measures vocal pitch, energy, and pauses using on-device audio analysis, and calculates your speaking pace from your transcript's word count and timing. These descriptive scores are sent to Anthropic as text to generate feedback. Day 3 measures only pause timing on-device and sends this as descriptive text to Anthropic. Day 7 measures pitch and pauses on-device, but uses these locally to adjust feedback rather than sending them to Anthropic. None of this identifies who is speaking, produces a voiceprint, or detects emotion (see Section 12).
• AmplifyU uses your camera in the Day 12 Simulation exercise to record a short self-practice video (60–90 seconds) so you can watch yourself back and improve your body language, eye contact, and presence. This recording stays on your device and is never uploaded, transmitted to any AI provider, or shared.

C. Access and purchase information

AmplifyU does not require you to create an account, and we do not collect your email address, name, or other identifying contact details to use the app.

Paid content is unlocked via Apple's In-App Purchase system. When you make a purchase, Apple processes the payment as the merchant of record — AmplifyU does not receive your card details, and does not automatically receive your email or name through this process. AmplifyU receives only a signed confirmation from Apple that the purchase was made, which is used to unlock the relevant content on your device.

If you get a new device or reinstall the app, you can restore your purchase via Apple's standard "Restore Purchases" mechanism, which is tied to your Apple ID and does not require AmplifyU to hold any personal account information.

Your purchase itself (payment method, billing, App Store account) is governed by Apple's own privacy policy, not this one.

D. Website information

Cookie and analytics information, only after you consent via our cookie banner (see Section 16 and our Cookie Policy).

E. Contact information

If you email us, we process your email address, name if provided, and the contents of your message, in order to respond and maintain appropriate records.

F. Information about other people that you provide

Certain features (particularly High-Stakes Conversation practice) invite you to describe who you're meeting and the context of that meeting. If you include identifying details about another person (e.g. a colleague, manager, or client), that information is processed in the same way as your own responses — sent to our AI providers to generate your practice scenario. We'd encourage you to use roles or initials rather than full names or other identifying details about other people where possible.

4. What stays on your device

AmplifyU does not maintain a separate server-side copy of your core programme data. Your onboarding reflections and Day 14 blueprint inputs are stored locally on your device. This means:

• We cannot access this data ourselves, even if we wanted to
• Deleting the app, or clearing its data via your device settings, permanently removes it
• If you switch devices or reinstall the app, this data does not carry over, since it never leaves your device

Stored locally on your device:

• Onboarding reflection answers
• Day 14 Blueprint inputs and outputs — including your Communication Archetype, which Anthropic generates as part of the Blueprint (see Section 5)
• Stories, speeches, and other content generated via features like the AmplifyU Speech Writer, which you can save to your device
• Your Day 12 self-practice video recording — camera access is used solely to create this recording for your own playback; it never leaves your device

5. What leaves your device

None of this data is stored by AmplifyU itself — it is processed by these providers to generate a response, which is returned to your device.

Separately, on Days 2, 3, and 7, AmplifyU performs vocal delivery analysis entirely on your device — no audio for this analysis is sent anywhere. Day 2 sends descriptive pitch/energy/pause/pace scores to Anthropic as text; Day 3 sends only a descriptive pause-timing score; Day 7's locally-measured scores are used to adjust the feedback already generated by Anthropic and are not sent to Anthropic at all.

5A. Outbound links to third-party retailers

At the end of each chapter, the Review tab recommends two books, with links to purchase them on Amazon. Where these are live, they are Amazon Associates affiliate links — AmplifyU earns a small commission on qualifying purchases made through them, at no extra cost to you. This affiliate relationship is disclosed directly in the app, next to the book recommendations themselves.

Clicking these links takes you to Amazon's website, which is not operated by AmplifyU and is governed by Amazon's own privacy policy and terms, not this one. Amazon may use its own cookies or tracking to attribute the referral and calculate commission, in line with its own privacy practices — AmplifyU has no visibility into or control over this.

6. How AmplifyU uses AI

AmplifyU uses third-party AI services to provide certain coaching features. Depending on the feature you use, information you provide may be sent securely to an AI provider to generate a response — such as coaching feedback, a transcription, or a personalised exercise.

Does AmplifyU use your data to train our own AI models? No — AmplifyU does not operate its own AI models; we use third-party providers (Anthropic, OpenAI).

Do our AI providers use your data to train their models? No, not by default. Both Anthropic and OpenAI's standard commercial/API terms state that data submitted via their APIs is not used to train their models, unless a customer explicitly opts into a separate programme to allow this. AmplifyU has not opted into any such programme with either provider. This does not apply to Vercel, which is a hosting/CDN provider, not an AI model provider, and has no equivalent setting.

AI-generated feedback is produced automatically and may not always be accurate or appropriate to your individual circumstances.

7. Voice and audio processing

Where you choose to use a voice-based practice feature, AmplifyU accesses your microphone and processes the resulting audio to provide that feature. Your audio is transmitted to OpenAI's Whisper service (Audio API) to produce a text transcript.

OpenAI's Audio API applies no abuse-monitoring or application-state retention by default, confirmed against their published API documentation — meaning your audio is not retained by OpenAI after the transcript is generated and returned. AmplifyU does not maintain a permanent copy of your raw audio on our own systems. The resulting transcript is used to generate your coaching feedback via Anthropic.

7A. LinkedIn screenshots and image data

If you use the LinkedIn audit feature by uploading a screenshot rather than pasting text, that image may contain your photograph, your full name, your employer, and — depending on what's visible in the screenshot — the names or photos of other people (e.g. connections or recommendations shown on your profile page).

This image is processed by Anthropic's vision-capable model to extract your profile content as text, which then feeds into the same analysis used for pasted text. No OpenAI involvement, no OCR, no separate image-processing provider.

The image itself is not retained by AmplifyU at any point — it exists only in the app's temporary in-memory state on your device and is never written to local storage or any AmplifyU server. It is processed by Anthropic under their standard API terms (see Section 9) and not retained beyond their standard 30-day window.

Because this feature can surface identifying information about people other than you, we'd recommend pasting only the text of your own profile where possible, rather than a full-page screenshot, if you'd prefer not to share this additional visual information.

8. Why we use your information and our legal bases

We use your personal information only where we have a lawful basis to do so under UK data protection law. The lawful basis we rely on depends on why we are using your information.

Where we rely on legitimate interests, we consider whether our interests are necessary and proportionate and whether they are outweighed by your rights and freedoms.

Where we rely on consent, you can withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

Our AI-enabled features are designed to provide learning and professional-development support. They are not used to make decisions about your employment, promotion, credit, insurance or other legal or similarly significant outcomes.

9. Who processes your information

Where a third party processes personal data on AmplifyU's behalf, UK GDPR (Article 28) requires a written contract governing that processing — a Data Processing Agreement (DPA). This sets out what the provider can and can't do with the data, how long they can keep it, their security and breach-notification obligations, which sub-processors they may use, and (for providers outside the UK) the legal transfer mechanism relied on to move data to them lawfully.

Anthropic

• Purpose: AI coaching content and Day 14 blueprint generation
• Data: reflection and blueprint answers
• Role: Anthropic is AmplifyU's processor (confirmed via Anthropic's published Data Processing Addendum, Section B.1)
• Location: United States
• Retention: inputs and outputs are automatically deleted within 30 days of receipt or generation under Anthropic's standard commercial API terms, unless a longer period is required to enforce Anthropic's Usage Policy or comply with law. Not used to train Anthropic's models under these terms
• Transfer mechanism: Standard Contractual Clauses (DPA Section I.1), with the UK Addendum for UK-GDPR-scoped data (DPA Schedule 3, Section B)
• Data Processing Agreement: in place, automatically incorporated into Anthropic's Commercial Terms of Service for API customers

OpenAI

• Purpose: voice transcription (Whisper, via the Audio API); cover image generation for Story Architect (via the Images API)
• Data: audio (Whisper); a derived text prompt summarising story content (Images API) — not raw user-typed text
• Role: OpenAI acts as a Data Processor on AmplifyU's behalf (signed DPA, clause 1.1)
• Location: United States
• Retention: Audio API (Whisper) — no retention at all by default. Images API — retained up to 30 days for abuse-monitoring purposes only, with no application-state/reuse retention. Neither endpoint uses submitted data to train OpenAI's models by default
• Transfer mechanism: Standard Contractual Clauses as amended by the UK Addendum (DPA clause 4.2), with the ICO named as the competent supervisory authority (DPA clause 8.2(ix))
• Data Processing Agreement: signed 5 September 2026 between AmplifyU Technologies Ltd and OpenAI

Vercel

• Purpose: hosting our app and website; serverless functions briefly handle raw reflection answers and audio in-transit before forwarding to Anthropic/OpenAI
• Data: transient request data. Server-side logging is limited to configuration warnings, error messages, and byte/character counts — no full request bodies, raw audio, transcripts, or story content are logged
• Location: North America (function region iad1, Washington D.C., USA)
• Role: Vercel is AmplifyU's processor for Customer Data (the app's actual content/data), per Vercel's published DPA (Section 4.1). Vercel is separately a controller only for its own account/billing information, which does not apply to app content
• Log retention: no Log Drains configured, so logs are never forwarded to a third party; the default retention window on the Pro plan is 1 day (24 hours)
• Transfer mechanism: Standard Contractual Clauses (Module Two) with the UK International Data Transfer Addendum incorporated by reference (DPA Schedule 3, Sections 2–3)
• Data Processing Agreement: incorporated by reference into Vercel's Terms of Service for Pro and Enterprise plan customers; AmplifyU is on the Pro plan

Google Analytics

• Purpose: website analytics only
• Consent: required and obtained via cookie banner before any data collection
• Data/retention: see Cookie Policy

10. International transfers

Some of our providers are located outside the United Kingdom. Where personal data is transferred internationally, we rely on an appropriate legal mechanism and safeguards in accordance with UK data protection law. OpenAI and Anthropic rely on Standard Contractual Clauses with the UK Addendum; Vercel relies on Standard Contractual Clauses with the UK International Data Transfer Agreement (see Section 9 for each).

11. How long we keep information

12. How we protect your information

• Data in transit between your device and our servers/AI providers is encrypted (HTTPS/TLS) — TLS 1.2 minimum enforced by default, with TLS 1.3 supported for compatible clients; older insecure versions are not supported, and all HTTP traffic is automatically redirected to HTTPS
• Access to our hosting and provider accounts (Vercel, Anthropic, OpenAI) is restricted and access-controlled — two-factor authentication (authenticator app) on Vercel; email-based verification code required at login for Anthropic and OpenAI
• Because AmplifyU stores most of your data locally rather than on our servers, the security of that data also depends on your own device's protections (passcode, biometric lock, disk encryption) — we'd encourage you to use these
• At-rest encryption: environment variables are encrypted at rest, and file storage/build artifacts are encrypted at rest using AES-256

AmplifyU does not perform facial recognition, biometric identification (i.e. identifying who is speaking or appearing on camera), or emotion detection from your voice or video. AmplifyU does analyse generic vocal delivery qualities on-device on three days, and this varies by day: Day 2 measures pitch, energy, and pauses via on-device audio analysis, plus a speaking-pace score calculated from your transcript's word count and timing — these descriptive scores are sent to Anthropic as text to generate feedback. Day 3 measures only pause timing on-device, sent to Anthropic as descriptive text. Day 7 measures pitch and pauses on-device, but these are used locally to adjust feedback already generated by Anthropic, rather than being sent to Anthropic at all. None of this identifies who is speaking, produces a voiceprint, or detects emotion. Separately, voice recordings used for transcription (see Section 7) produce only a text transcript via OpenAI's Whisper, with no additional analysis requested or performed on that audio. The Day 12 video recording is for your own personal playback and self-review only — no frame is ever extracted from it and it never leaves your device.

Under UK GDPR, voice can become biometric data where it is used for the purpose of uniquely identifying a person. AmplifyU's vocal delivery analysis works differently: it measures how you sound (delivery characteristics such as pitch, energy, pauses, and pace) in order to generate coaching feedback, rather than building a biometric template used to identify who you are. AmplifyU does not process biometric data for the purpose of uniquely identifying users, and does not create voiceprints or identify speakers.

12A. Data breach notification

If a personal data breach occurs that creates a risk to your rights and freedoms, we will notify the ICO without undue delay, and in accordance with UK GDPR requirements. Where the breach is likely to result in a high risk to you, we will also notify you directly, without undue delay.

13. Your privacy rights

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data ("right to be forgotten")
• Restrict or object to certain processing, where applicable
• Data portability, where applicable
• Withdraw consent, where we rely on consent as our legal basis
• Rights relating to automated decision-making, where applicable (see Section 14)

Because most of your programme data is stored locally on your device rather than on our servers, you can exercise your right to delete this data directly, at any time, by clearing the app's data or deleting the app. Deleting the app removes programme data stored locally on your device. Information that has already been transmitted to our service providers for processing (see Sections 5 and 9) is subject to the retention periods described in this policy, rather than being erased immediately on deletion of the app.

In the meantime, or for any other question about your rights, email hello@amplifyu.app — we will respond within one month, as required by law. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

14. AI, profiling, and automated decision-making

AmplifyU uses AI to generate coaching feedback, your Communication Archetype display, and your Day 14 Blueprint. These outputs are intended to support your learning and development. They do not determine your employment, promotion, access to services, credit, insurance, or any other legal or similarly significant outcome.

AmplifyU may use automated processing to generate personalised coaching content and identify patterns in the information you provide. This may constitute profiling under UK data protection law. However, these outputs are provided solely for your personal learning and development and are not used to make decisions producing legal or similarly significant effects concerning you. Because AmplifyU's profiling does not trigger Article 22 of the UK GDPR, it is not subject to that Article's additional restrictions and safeguards — but it remains subject to the same transparency, lawful-basis, and rights obligations that apply to all processing described in this policy.

15. Sensitive information

AmplifyU is not designed to request or intentionally infer special-category personal data. Please do not include information about health conditions, political opinions, religious or philosophical beliefs, racial or ethnic origin, sexual orientation, sex life, trade union membership, or other special-category information in free-text responses, unless a specific feature asks for it.

16. Cookies and analytics

Our website uses cookies for optional analytics (Google Analytics), only after you give consent via our cookie banner. You can manage your preferences at any time via "Cookie Settings" at the bottom of any page on amplifyu.app. See our full Cookie Policy for detail.

Our app does not currently use cookies, analytics, or tracking of any kind.

17. Contacting us

If you contact us, we may process your email address, name if provided, and the contents of your message, in order to respond to your enquiry and maintain appropriate records. Retention period: 12 months.

18. Children's privacy

AmplifyU is designed for working professionals and is not intended for use by anyone under the age of 18. We do not knowingly collect data from anyone under 18. This position is also reflected in our Terms of Service.

19. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you via the app or website before the change takes effect. We will not use your personal data for a materially different purpose without providing appropriate information about that new use first. The "last updated" date at the top reflects the most recent version.

20. Contact us and the ICO

AmplifyU Technologies Ltd
Email: hello@amplifyu.app
Company number: 17283627
Registered office: 14/2E Docklands Business Centre, 10-16 Tiller Road, London, E14 8PX

You have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data properly.