Privacy Policy
AmPhi Labs™ ("AmPhi Labs", "we", "us") is operated by AmPhi Labs B.V., Singel 542, 1017 AZ Amsterdam, Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 42122322, VAT (BTW) number NL869828514B01. We respect your privacy and handle personal data in line with the EU General Data Protection Regulation (GDPR).
What we collect
- Contact data you provide via our forms (name, email, company, your message and selected interests).
- Newsletter data (email address, plus your first name if you choose to give it) when you subscribe.
- Analytics data, only if you accept analytics cookies. Google Analytics 4 then records pages viewed, approximate region, referring site, device and browser type, and assigns a pseudonymous identifier stored in a cookie on your device. Your IP address is truncated before storage. If you decline, no analytics data is collected and nothing is stored on your device.
Why we use it (legal basis)
- To respond to your enquiry and provide our services: performance of a contract / your request.
- To send updates you asked for: your consent, withdrawable at any time.
- To measure how the site is used: your consent, given via the cookie banner and withdrawable at any time.
- To keep the site secure and available: our legitimate interest.
How long we keep it
We keep personal data only as long as needed for the purpose it was collected, or as required by law. Newsletter data is kept until you unsubscribe. Contact form submissions are kept for up to two years after our last contact. Analytics data is retained for 14 months.
Who we share it with
We use a small number of trusted processors to run the site and our communications. Each acts only on our instructions and under a written data processing agreement. We never sell your data, and we do not use it for advertising or profiling.
- Netlify: website hosting and form handling. Your contact and newsletter submissions are stored in Netlify Forms. Netlify, Inc. is US-based; transfers are covered by Standard Contractual Clauses.
- Google: email (Google Workspace) and, with your consent, website analytics (Google Analytics 4). Messages you send us and our replies are processed through Google's mail servers. Our contract is with Google Ireland Limited; Google LLC in the US acts as a sub-processor and is certified under the EU-US Data Privacy Framework. Advertising features and data sharing are switched off in our Analytics configuration.
- Google Fonts: our typeface is served from Google's font CDN, which means your browser's IP address is visible to Google when a page loads. No cookies are set by this.
- Resend: transactional email. When you submit a form, Resend delivers our notification and your confirmation email (using EU-based sending infrastructure). Resend, Inc. is US-based and certified under the EU-US Data Privacy Framework, with Standard Contractual Clauses as an additional safeguard.
- Freelance specialists: we occasionally engage independent contractors to deliver client work. Each is bound by a written data processing agreement and a confidentiality obligation, and may only process personal data on our documented instructions.
Where your data goes
We prefer EU-based processing wherever we can get it. Where a processor is established outside the EEA, the transfer is covered by an adequacy decision (the EU-US Data Privacy Framework) or by the European Commission's Standard Contractual Clauses, together with additional technical and organisational safeguards.
AI and your data
We build AI systems for a living, so we will be direct about this: we do not put your personal data into general-purpose AI models. Nothing you send us through this website (your name, your message, your email address) is used to train an AI model, ours or anyone else's, and it is not pasted into a public chatbot.
In client engagements we use AI development tooling (including large language models) on the data our clients ask us to work with, always under the terms of the relevant client agreement and data processing agreement, on infrastructure agreed with that client, and never for model training. If we introduce a new processor or a new use of AI that touches personal data collected through this website, we will add it to this policy before it goes live.
Your rights
Under the GDPR you may request access, correction, deletion, restriction, or portability of your data, and object to certain processing. Where processing is based on consent, you can withdraw it at any time without affecting what was lawful before. To exercise any right, email . You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Cookies
We use no advertising, marketing, or profiling cookies, and no third-party trackers. We use exactly one category of non-essential cookie, and only with your permission:
- Analytics (optional, consent required): Google Analytics 4 sets
_gaand_ga_<container-id>cookies to distinguish visitors and sessions. Lifetime: up to 24 months. These are not set unless you press “Accept analytics” on our cookie banner.
Nothing is written to your device before you choose. If you decline, we load no analytics script at all and delete any analytics cookies left from a previous visit. Your choice is remembered locally for 12 months, after which we will ask again.
Our record of your choice. The law requires us to be able to show that consent was freely given, so when you press Accept or Decline we store a record of it: a random identifier generated in your browser (not linked to your name or email), your choice, the date, and the version of this policy you were shown. As with any form on this site, our host Netlify also logs the IP address the request came from. We keep these records for as long as the consent is valid, and use them for nothing else.
You can change your mind at any time on our Cookie Policy page, which is linked in the footer of every page, or by clearing cookies and site data in your browser. Our hosting and forms (Netlify) set no cookies for visitors.