Amplitude Privacy Policy, Mar. 2018

Amplitude, Inc. ("Amplitude," "we," or "us") is a cloud-based product-analytics platform that helps customers build better products. Amplitude respects the privacy of individuals and is committed to protecting the information of visitors to the website ("Visitors") and individuals or entities that register to use the Amplitude products and services through the Website ("Customers"). This privacy policy describes Amplitude’s practices for collecting, using, maintaining, protecting, and disclosing information in relation to Visitors of the website, amplitude.com ("Website"), Amplitude’s marketing activities, and Customers accessing and using the products and services available on the Website (collectively, "Product").

This privacy policy does not apply to the mobile applications, websites or services offered by our Customers. This privacy policy also does not apply to the personal data or information of the users of our Customers’ mobile applications, websites or services.

Please read the following carefully to understand our policies and practices regarding your information collected through the Website, through your use of the Product, through our marketing activities and how we will treat it. If you do not agree with the below policies and practices, your choice is not to use our Website or register to use the Product through our Website.

Amplitude acts as a data controller when it collects personal information from: (i) Visitors to Amplitude’s publicly available Website; (ii) Customers when our Customers register to use the Product through the Website or access their account through Amplitude’s account portal at: https://analytics.amplitude.com/login; and (iii) when we receive personal information from you related to our marketing activities. Amplitude is a data processor with respect to our Customer End User Data (as defined below). This privacy policy does not apply to our Customer End User Data as explained in more detail below.

Throughout this privacy policy, we use the terms "personal information" and "personal data" interchangeably to mean any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

2.1 PERSONAL INFORMATION WE COLLECT AND HOW WE COLLECT IT

Information You Provide to Us:

• You provide to us your personal information when you voluntarily fill in forms on our Website such as when you request a demo or to contact sales. This personal information may include: first and last name, company name, job title, work email address, phone number and the content of your request.
• You may also share personal information with us through our Website when you sign up to register for an event, to receive our newsletter, subscribe to our blog, register for an online webinar, download a whitepaper or complete a survey.
• In order to access and use the Product, you are required to register for an account with us. When you register for an account, you may provide personal information to us, including first and last name, email address, company name, telephone number, physical address, username and password.
• In order to participate in Amplitude’s start-up scholarship program, you may provide your credit card or other payment details information directly to our third party payment processor. As explained below, Amplitude does not store this information.
• You may also provide Amplitude with your personal information at a marketing event.

Information We Collect Automatically:

• As you navigate through and interact with our Website or Product, we may use cookies, which are small files placed on the hard drive of your computer or mobile device, and web beacons, which are small electronic files located on pages of the Website, to collect certain information about your equipment, browsing actions, and patterns. You can learn more about cookies and how we use them here.
• We also use cookies to access information when you sign in, store your preferences, to keep you logged in, and to store a limited amount of behavioral data.
• The data automatically collected from cookies and web beacons may include information from your Web browser (such as browser type and browser language) and details of your visits to our Website, including traffic data, location data and logs, page views, length of visit and website navigation paths as well as information about your computer and internet connection, including your IP address and how you interact with our Product. We collect this data in order to help us improve our Website, the Product and the user experience with our Website and Product. You can learn more about cookies and how we use them here.
• Amplitude currently does not support Do Not Track signals set by your browser because there is not an industry or legal standard for these signals. Do Not Track is a preference you can set in your web browser to inform websites that you do not want to be tracked.
• The information we collect automatically may also include statistical and performance information arising from our Customers’ use of our Product and Visitors to our Website. This type of data will only be used by us in an aggregated and anonymized manner.

Information From Third Party Sources:

• Amplitude may obtain personal information about you from third parties, including, but not limited to, marketing event organizers, partners and resellers. This information may include your first and last name, company name, job title, work email address, phone number and address. Amplitude requires that any third party providing it with information has obtained the information lawfully and the third party has obtained the appropriate consent to share the information with Amplitude.

2.2 THE WAY AMPLITUDE USES YOUR PERSONAL INFORMATION

We use information that we collect about you or that you provide to us, including personal information, in order to respond to a request from you, to carry out our legal obligations, to fulfill a contract with you, to protect your vital interests, to provide you with notices and for other purposes with your consent as described below.

• We use the personal information you provide to us when you fill in forms on our Website to respond to your request and to contact you about that request. Our legal basis for processing this personal information is our legitimate interest in communicating with you and fulfilling your requests.
• We may use your personal information to provide the Product to you as well for non-marketing or administrative purposes (such as notifying you of major changes to the Website, the Product or for customer service purposes). Our legal basis for processing this personal information is in the performance of our contract to provide the Product or other services to you.
• We also use the personal information you provide to us for the purpose of operating our Website, ensuring the security and integrity of our Website and Product and maintaining back-ups of our databases. Our legal basis for processing this personal information is our legitimate interests, namely the proper administration of and security of our Website and Product.
• For data and information that we collect through tracking technologies about your interaction with our Website and Product, we use this information for analyzing the use of the Website and Product in order to improve the quality and design of our Website and the user experience with our Website and Product. Our legal basis for processing this type of data is our legitimate interests, namely to provide you with a better user experience.
• We may use the personal information you provide to us at marketing events, when you register for an online webinar or download a whitepaper for the purpose of offering, marketing and selling products and services to you. Our legal basis for processing this personal information is consent, which you can withdraw at any time.
• We may also use any of your personal information identified in this privacy policy for the purposes of: (i) enforcing our agreements and policies, (ii) protecting or defending Amplitude’s legal rights; (iv) protecting your vital interests or the vital interests of another natural person; or (v) complying with a legal obligation.

We may disclose personal information that we collect or you provide to us as described below. Amplitude does not share or sell your personal information with any third parties for direct marketing purposes.

• We may disclose personal information that we collect or you provide to us to our subsidiaries and affiliates.
• We may share your data and personal information collected from you as described in this privacy policy with third-party service providers who need to access the data and personal information in order to perform services on behalf of Amplitude, such as processing or storing such information or providing analytics services on our behalf. The third-party service providers are limited to using the data and personal information solely to provide the services to us and are bound by contractual obligations to keep personal information confidential and to use it only for the purposes for which we disclose it to them.
• If you make a purchase through the Website, your credit card or debit card information is provided directly to our third-party payment processor, Stripe, to process the payments. The payment information is transmitted directly via an encrypted connection to Stripe. Stripe uses, processes and stores your personal and payment information in accordance with Stripe’s privacy policy available at stripe.com/us/privacy. Amplitude does not collect or store your payment information. Stripe maintains that it is PCI compliant and you can learn more about Stripe’s security measures available at stripe.com/help/security.
• We may share your personal data and information if we believe disclosure is necessary to comply with applicable laws, regulations, respond to a court order, subpoena or a government request (such as a search warrant). If a government requests or other legal process requires Amplitude to disclose your personal data, then Amplitude will use reasonable efforts to provide you with prior notification of the disclosure unless Amplitude is prohibited by law from doing so.
• Amplitude also reserves the right to disclose your personal data that Amplitude believes, in good faith, is appropriate or necessary to: (i) enforce our agreements and policies, including for billing and collection purposes, (ii) protect the security or integrity of the Website or Amplitude’s products and services; or (iii) protect or defend Amplitude’s legal rights.
• In the event that Amplitude is acquired by or merged with a third party entity, we reserve the right, in any of these circumstances, to transfer or assign your personal data we have collected from you as part of such merger, acquisition, sale, or other change of control. In the unlikely event of our bankruptcy, insolvency, reorganization, receivership, or assignment for the benefit of creditors, or the application of laws or equitable principles affecting creditors rights generally, we may not be able to control how your personal information is treated, transferred, or used.
• Amplitude may disclose non-personally identifiable information about Visitors to the Website or our Customers’ use of the Product that does not identify any individual in the aggregate in published studies without restriction. Amplitude will not compromise the confidentiality of your personal data in publishing these studies or publish any identifying information.
• Amplitude may disclose personal information that we collect or you provide to us for any purpose disclosed by us when you provide the information or with your consent.

This privacy policy does not apply to Customer End User Data or Customer Applications. With respect to Amplitude’s Customers, Amplitude is a data processor, and Amplitude processes the personal data collected by our Customers and sent to us only in accordance with the instructions of our Customers. Our Customers may integrate into their mobile applications, websites or other services (collectively, "Customer Applications") certain aspects of our Product in order to understand how their own users ( "Customer End Users") engage with the Customer Applications ("Customer End User Data").

Our Customers, not Amplitude, choose the type of Customer End User Data collected by Customer Applications, and processed, transferred and stored through our Customers’ use of the Products. We process the Customer End User Data only according to the instructions of Customers and, our legal obligations with respect to the Customer End User Data is set forth in the agreement between us and our Customers. The collection of Customer End User Data through Customer Applications is governed by our Customers’ privacy policies, and if you are a Customer End User then you should review the Customer’s privacy policy to learn more about the Customer’s data handling practices.

While Amplitude recognizes that an individual has the right to access, delete and amend the data collected about that individual, Amplitude does not have a relationship with the Customer End Users but rather only with our Customers. If you are a Customer End User and you would like to access, amend or delete your data, then you need to contact the Customer directly and Amplitude will respond within a reasonable period of time to any such request by our Customer.

Amplitude only retains the Customer End User Data we process on behalf of our Customers for as long as necessary to provide the Product to our Customers or as required to comply with legal obligations, resolve disputes and enforce any agreement.

The data servers Amplitude uses to provide the Website and Product are located in the United States. By interacting with the Website or using the Product, you understand that your personal data will be transferred to the United States and you consent to such transfer.

To the extent Amplitude collects or processes personal data transferred from the European Union or Switzerland to the United States, Amplitude complies with the EU-U.S. and the Swiss-U.S. Privacy Shield Frameworks as set forth by the U.S. Department of Commerce regarding the collection, use and retention of personal data transferred from the European Union and Switzerland to the United States, respectively. Amplitude has certified to the Department of Commerce that it adheres to the Privacy Shield Principles. If there is any conflict between the terms in this privacy policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program and to view the certification for Amplitude, please visit: https://www.privacyshield.gov/.

For the actions of third party agents Amplitude engages to process data on our behalf, Amplitude remains responsible and liable under the Privacy Shield Principles if a third party agent processes the personal data in a manner inconsistent with the Privacy Shield Principles, unless Amplitude proves that it is not responsible for the event giving rise to the damage.

Amplitude uses commercially reasonable physical, managerial, and technical safeguards designed to secure your personal information from accidental loss and from unauthorized access, use, alteration and disclosure. All information you provide to us is also encrypted and stored on our secured servers behind firewalls.

However, you are also responsible for maintaining the confidentiality of your password and other information used by you to access the Website or use the Product. While Amplitude does its best to protect your personal data, Amplitude cannot guarantee the security of your personal information transmitted to our Website because the transmission of information via the internet is not completely secure. Any transmission of your personal information is done at your own risk and Amplitude cannot guarantee that such personal information may not be accessed, disclosed, altered, or destroyed by breach of any of our physical, technical, or managerial safeguards. If Amplitude learns of a security systems breach, then we may attempt to notify you electronically so that you can take appropriate protective steps. Amplitude may post a notice on the Website if a security breach occurs. Depending on where you live, you may have a legal right to receive notice of a security breach in writing. To receive a written notice of a security breach (or to withdraw your consent from receiving electronic notice) you should notify us at privacy@amplitude.com.

We strive to provide you with choices regarding the personal information you provide to us and we understand that you have the right to access, correct, delete, object to and restrict our use of your personal information. We also understand that you have the right to obtain a copy of your personal information from us and to withdraw your consent of the processing of your personal information by us. Please note we may ask you to verify your identity before responding to such requests. We have created mechanisms to provide you with the following control over your personal information:

• You may choose not to provide personal information through our Website or when you register for the Product, in which case Amplitude may not be able to provide certain services to you or respond to your requests.
• You can access, review and change your personal information by logging into your account on the Website and visiting your account profile page. You may also send us an email at privacy@amplitude.com to request access to, correct or delete any personal information that you have provided to us. In some cases, we may not be able to delete your personal information except by also deleting your user account.
• If you do not wish to have your email address or other contact information used by us to promote our own products or services, you can opt-out by checking the relevant box located on the form on which we collect your personal data or at any time by logging into the Website and adjusting your user preferences in your account profile by checking or unchecking the relevant boxes, or by sending us an email stating your request to privacy@amplitude.com. If we have sent you a promotional email, you may unsubscribe to receive future emails via the unsubscribe link in that email or adjust your user preferences in your account profile as noted above. The opt out specified above does not apply to information provided to us as a result of a purchase, product service experience or other transactions.
• You may also request a copy of your personal information that you have provided to us directly by sending an email to privacy@amplitude.com. We will provide you a copy of your personal information in a commonly used electronic form.

8.1 Our Retention Practices

Personal data that Amplitude processes as a data controller for the purposes identified in this privacy policy are not kept by Amplitude for longer than is necessary for the specific purpose identified in this privacy policy unless Amplitude is required to retain your personal data for a longer period of time to comply with our legal obligations (for example, if we are required to retain your personal information to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies. Personal data that Amplitude processes on behalf of its Customers as a data processor is retained for the period of time specified in the agreement between Amplitude and its Customers, unless Amplitude is required to retain the personal data for a longer period of time to comply with our legal obligations (for example, if we are required to retain your personal information to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

8.2 Children’s Privacy

Amplitude does not knowingly collect personal information directly from Visitors of the Website that are under the age of 16. If you are under 16, do not use or provide any information on the Website or register on the Website to use the Product. If we learn that a child under 16 has directly provided us with their personal information through the Website, then we will delete that information. If you believe a child under 16 has registered for an account on the Website, please contact us at privacy@amplitude.com.

8.3 Automated Decision-Making

Amplitude does not use any personal information provided by you for the purpose of automated decision-making.

8.4 Other Websites; Links

Our Website may contain links to other third party websites or applications (such as Facebook, LinkedIn or Twitter). This privacy policy does not apply to any third party websites, including through any application that may link to or be accessible from or on the Website, and Amplitude is not responsible for the privacy policies and the content of the third party websites or applications.

Please note that we reserve the right, at any time, to add to, change, update, or modify this privacy policy. If, in our reasonable discretion, the changes are material, we will post a notice on our website or send you an email. The modified privacy policy will be posted on this website along with the effective date. You are responsible for ensuring that we have an up-to-date active and deliverable email address for you, and for periodically visiting our Website and this privacy policy to check for any changes. Changes to this privacy policy are effective when they are posted on this page.

As part of our commitment to the Privacy Shield Principles, if you are a resident of the European Union or Switzerland and you have a privacy or data use concern, please contact Amplitude directly at privacy@amplitude.com and Amplitude will use its best efforts to address your concern within 45 days of receipt of your complaint. For an unresolved privacy or data use concern that Amplitude has not addressed satisfactorily, please contact our U.S. based third party dispute resolution provider (free of charge) at https://www.jamsadr.com/file-an-eu-us-privacy-shield-or-safe-harbor-claim.

For any Privacy Shield disputes that cannot be resolved by the methods above, you may be able to invoke a binding arbitration process under certain conditions. To find out more about the Privacy Shield’s binding arbitration scheme, please see: https://www.privacyshield.gov/article?id=ANNEX-I-introduction.

The Federal Trade Commission has investigation and enforcement authority over Amplitude’s compliance with the Privacy Shield Framework.

If you have any comments, concerns or questions about this privacy policy or our privacy practices in general, please send an email to privacy@amplitude.com or send mail to:

Amplitude, Inc.
Attn: Privacy
501 2nd Street, Suite 100
San Francisco, CA 94107

Your right to file a complaint with a data supervisory authority about our privacy practices remains unaffected.