Privacy policy

Who we are

Ambrain is a product of Ambroot BV.

• Enterprise number: 1043.141.958
• Registered office: Hendrik Speecqvest 62 bus 1, 2800 Mechelen, Belgium
• Email: support@ambrain.eu

What Ambrain does

Ambrain reads advertising, social media and website statistics from the accounts a customer connects. It uses them to show dashboards, reports and AI analyses to that customer.

A customer can connect these accounts:

• Google Ads
• Google Analytics 4
• Meta: Facebook Pages, Instagram accounts and ad accounts
• LinkedIn, through a partner or through LinkedIn’s API
• Teamleader

From advertising, social media and website accounts, Ambrain only reads. It never posts, never changes campaigns and never spends budget.

In Teamleader, Ambrain reads deals and projects. At a user’s request it can also create a draft quotation there. Ambrain never sends that quotation.

AI in Ambrain: two situations

• Your own AI tool. If you use your own AI tool, such as Claude, ChatGPT or Copilot, through Ambrain’s connector, that AI provider is your own supplier. Your questions and the answers stay in your own account with that provider. Ambrain only receives the calls to its tools (which tool, which client, which period) and records them in the usage log.
• Ambrain’s own AI. For the weekly summaries and the assistant in the portal, Ambrain itself calls an AI model, through Anthropic. Only in those cases is Anthropic our subprocessor.

What data we process

Per type of data: what it is, what we use it for and how long we keep it.

• Marketing figures: aggregated performance figures, post texts and post statistics, and names and ids of the connected business accounts. Used for: dashboards, reports and AI analyses for the customer. Kept: for as long as the contract runs, plus 3 months.
• Teamleader data: deals, projects and the draft quotations Ambrain creates on request. Used for: showing them alongside the marketing figures, using them in reports and AI analyses, and preparing draft quotations. Kept: for as long as the contract runs, plus 3 months.
• Usage log per user: which tool or skill was used, for which client, over which period, and when. This includes the calls from your own AI tool. Used for: security, troubleshooting and abuse prevention, and a usage overview for the customer’s admins. Kept: for as long as the contract runs, plus 3 months.
• Questions and answers with the assistant in the portal, and the weekly summaries. Used for: answering your question and producing the summary. Kept: for as long as the contract runs, plus 3 months.
• Portal sign-in data: name and email address. Used for: signing in to the portal. Kept: for as long as the contract runs, plus 3 months.
• Access tokens of connected accounts. Used for: reading data from those accounts, and creating draft quotations in Teamleader. Kept: until the account is disconnected; we then delete them immediately.

We do not receive the questions you ask in your own AI tool, or its answers.

We do not process personal data of followers or ad audiences, beyond what the platforms themselves provide in aggregate.

Legal basis and roles

We only use the data to provide the service set out in the contract with the customer. That contract is also the legal basis.

• Ambroot acts as processor, on the customer’s behalf, for: the marketing figures, the Teamleader data, the questions and answers with the assistant in the portal, the weekly summaries, and the usage overview we show to the customer’s admins. The customer is the controller for these.
• Ambroot acts as controller for: the sign-in data, and the usage log insofar as we use it for security, troubleshooting and abuse prevention.

Data processing agreement. Customers can request a data processing agreement at support@ambrain.eu.

Ambrain's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Subprocessors

These parties process data on our behalf:

The provider of your own AI tool is not our subprocessor. Your own agreements with that provider apply.

Transfers outside the EU

Some subprocessors are US companies: Anthropic, Railway, Auth0 by Okta, Google and Cloudflare. Even where data is stored in the EU, transfers to or access from the US can take place. This happens under the EU-US Data Privacy Framework and/or the European Commission’s standard contractual clauses.

Security

• Data is encrypted in transit and at rest.
• Access tokens of connected accounts are stored encrypted.
• Only authorised staff have access to the data.

Data breaches. If a breach affects a customer’s data, we notify that customer without undue delay.

Your rights

You have the right of access, correction, deletion, objection and portability of your data.

Email your request to support@ambrain.eu. We reply within 30 days.

If you are not satisfied, you can lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit): gegevensbeschermingsautoriteit.be.

Data deletion

How to request deletion, disconnect an account or revoke Ambrain’s access in Facebook, Google or LinkedIn is explained on Data deletion.

This website

The website ambrain.eu uses no cookies and stores nothing in your browser.

We use Cloudflare Web Analytics to see aggregated visit statistics: the number of visits, which pages are viewed and how fast they load. It works without cookies, does not track individual visitors across sites and does not build profiles.

Cloudflare hosts the website. Like any web host, Cloudflare processes technical data, such as your IP address, to deliver and secure the pages.

Changes

If we change this policy, we update the date at the top. We notify customers of significant changes by email at least 30 days in advance.