Privacy Policy — Amnetic

This Privacy Policy describes how Amnetic AI, Inc., a Delaware corporation ("Amnetic," "we," "us," or "our"), collects, uses, shares, and keeps information when you visit amnetic.ai or use the Marketplace. Capitalized terms not defined here, including "Marketplace," "User," "Buyer," "Seller," "Buyer Agent," "Data Product," and "User Content," have the meanings given in our Terms of Service ("Terms"), which incorporate this Privacy Policy by reference.

Information we collect

Account information. To create an account you give us your email address and a password. Sign-in is handled by Amazon Cognito; your password goes to Cognito and is never sent to or stored by Amnetic. If you sign in with Google, Google shares your name and email address with Cognito. We store your email address, a name (usually taken from your email address; if your account was created from a Google sign-in without completing our signup page, the name on your Google account), and the identifier of your sign-in account.

Profile information you choose to add. A display name, business description, and website; whether you act as an individual or an entity, and its legal name; an annual revenue band; and any domain you verify.

Content you submit. User Content and Data Products you upload or create, including listings, cleanroom files, analysis requests and reports, messages and attachments you send to other Users, and conversations with agents. When a Buyer Agent searches the Marketplace, it sends us its working conversation; we store that conversation encrypted.

Payment records. Records of purchases, credits, payouts, and refunds. Card and bank details are collected by Stripe, not by us (see Payments and payouts).

Records of agreements and actions. When you accept the Terms, we record the version, the time, your IP address, and your browser's user agent. We record the same details when, as a Seller, you publish, approve, decline, or price a listing, or accept an authorization or rider that applies to one. We record which credential (a signed-in session or a named API key) made each cleanroom decision.

Logs. Our application logs record the requests made to our services and can include the email address or account ID of the signed-in account that made them. They do not record your IP address. Our network flow logs record the IP addresses of connections to our services and are kept up to 90 days. The audit log of downloads from our file storage records the IP address and browser details of each download. For API keys we store only a hash, a short prefix, and when the key was last used.

Cookies and browser storage

amnetic.ai sets no cookies. The site and portal use your browser's local and session storage to keep you signed in, to resume large uploads, to hold the state of a flow you are in the middle of, and for the per-tab analytics identifier described below. Sign-in pages served by Amazon Cognito run on Amazon's domain, under Amazon's practices. Our pages load fonts from Google Fonts, so Google receives your IP address and browser details when you view them.

Website analytics

We measure site and product usage ourselves, without third-party analytics. When you visit amnetic.ai we record which pages you view, how far you scroll, roughly how long homepage sections stay on screen, which signup and sign-in buttons you click, and coarse steps in the signup and portal flows. Each record includes the page path (never its query string or fragment), the site page or external website you arrived from (as a hostname only), and a random identifier that lives in your browser tab's session storage and is discarded when the tab closes, so we can see the order of pages within one visit. We set no cookies, use no persistent or cross-site identifiers, do not link these records to your account, and do not log your IP address with them. Events never include emails, names, account or listing IDs, tokens, transaction amounts, uploaded content, or other free-form data.

How we use information

To provide the Marketplace: sign you in, store and deliver content, run the analyses and searches you request, and show your profile and listings to the Users described below.
To process purchases, credits, and payouts, and to keep financial and tax records.
To send the email described below.
To index content for search, including by creating embeddings.
To detect fraud, abuse, and unauthorized resale. We fingerprint Seller uploads and run automated provenance checks on new listings; a listing those checks flag is held for review by a person.
To record trust and reputation signals about listings and accounts.
To keep evidence of what you agreed to and what you published, approved, or priced.
To secure, operate, and debug our services, and to comply with law.

Section 9.2 of the Terms describes the license you grant us to use User Content and Data Products for these purposes.

We do not use your data to train AI models. None of the uses above involves training or fine-tuning an AI model on your information, User Content, or Data Products. See AI processing.

AI processing

Analyses, Buyer Agent searches, hosted agents, and the automated provenance checks on Seller uploads use Claude models, developed by Anthropic and served by AWS Bedrock in Amnetic's AWS account in the United States. Search embeddings are generated by AWS Bedrock Titan Embed v2. We do not send content directly to Anthropic or any other model provider. Under AWS Service Terms section 50.12.5, AWS may share information about our use of a model with that model's provider, but not our content. Our AWS permissions block our systems from turning on the Bedrock setting that would share content with model providers. Bedrock may keep cached prompt prefixes for up to one hour, isolated to our AWS account.

No training on your data. Amnetic does not use your data to train or fine-tune AI models. That includes the files you upload, cleanroom contents, analysis requests and other prompts, reports, messages, and agent conversations. The model providers do not train on it either: Anthropic does not receive your content, and AWS does not use prompts or outputs sent to Bedrock to train models. Creating search embeddings uses an existing model and does not train it. Any model training a Buyer does with a Data Product it licenses is done by that Buyer, under its license and the Terms, not by Amnetic.

Agents run in isolated sandboxes provided by E2B. The content an agent works on, including cleanroom files, requests, Data Products, and Buyer Agent conversations, passes through E2B's cloud while the agent runs.

Amnetic operators can turn on full logging of AI request and response content for sessions they start themselves to debug the service. Those logs are kept no more than 30 days.

How information is shared

With other Users.

Signed-in Users with Marketplace access can see a Seller's display name, account ID, business description, website, verified domain, the date the account was created, and the listings that Seller makes available to them.
When you contact a Seller as a Buyer, by opening an inquiry or a transaction, purchasing, or requesting an evaluation, that Seller sees your account ID; your display name (the name you set; if you set none, the name we store for you unless it was taken from your email address; otherwise a neutral label); whether you act as an individual or an entity and its legal name; your business description, website, and verified domain; a buyer tier derived from the annual revenue band you declare; and how many deals you have had with that Seller. Outside cleanrooms, Sellers do not see your email address. They see the messages and attachments you send them.
A Seller's hosted agent sees your display name, your messages and attachments to that Seller, and your past deals with that Seller, and can remember what it learns about you.
A cleanroom owner sees the email address of each person they grant access to, and each member's requests, attachments, and reports in that room. Members see how many members a room has, but not who they are.
A Seller who limits who may see or buy a listing does so by entering email addresses.

With service providers. We use these providers to run the Marketplace:

Amazon Web Services: hosting, databases and storage, sign-in (Amazon Cognito), email (Amazon Simple Email Service), AI models (AWS Bedrock), and logs and monitoring.
Stripe: card payments, Seller onboarding and identity checks, and payouts.
E2B: sandboxes in which agents run.
Google: sign-in, if you choose Google; the fonts on our pages; and our team's email (Google Workspace), which receives account-creation notices, bounce and spam reports, and email you send us.

For legal reasons. We may disclose information when required by law or legal process, and to protect the rights and safety of Amnetic, our Users, or others. If Amnetic is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction.

We do not sell personal information and do not share it for targeted advertising.

Payments and payouts

Card payments are made on Stripe's hosted checkout page. Your card details go to Stripe and never reach Amnetic. We receive the checkout and payment identifiers and amounts.

Sellers who receive payouts complete onboarding on Stripe's hosted pages. We give Stripe the Seller's email address. Stripe collects the identity and bank details it requires; we receive only whether onboarding is complete and whether payouts are enabled, and the records of each transfer. Stripe's use of this information is governed by Stripe's privacy policy.

Email we send

Sign-up verification and password-reset codes are sent by Amazon Cognito from no-reply@verificationemail.com. All other email is sent through Amazon Simple Email Service from notifications@amnetic.ai, and only about your own account, the deals you are party to, and the cleanrooms you can open: notices when a buyer requests your data, a draft is waiting for your sign-off, a quote is ready, a buyer has accepted and paid, or a newer version of a listing you bought is available; reminders when a deal is still waiting on you or your quote is about to expire; and a notice when a cleanroom owner grants your email address access to a room, which can be sent before you have an account. Our notices reach only addresses we have registered with Amazon Simple Email Service; when we register yours, Amazon sends you a one-time message asking you to confirm it. We do not send marketing email, and we do not sell email addresses.

Every reminder email has a one-click unsubscribe link. Other notices about your deals, purchases, and cleanroom access are part of using the service. Addresses that bounce or mark our mail as spam are automatically suppressed from further sending, and our team is notified of each bounce and spam report. Our team also receives an email with your email address, account ID, and signup time when you create an account.

Retention and closing your account

While your account is open we keep your information for as long as we need it to provide the Marketplace; logs and backups expire on the schedule below. To close your account, email harrison@amnetic.ai or legal@amnetic.ai.

When your account is closed, its API keys are revoked and the marketplace, its API and its MCP server refuse every new request from it straight away. Sessions already signed in to our hosted-agent service end within 60 minutes of your sign-in identity being deleted. After closure:

Your sign-in identity is deleted within 30 days.
API keys stop working at closure and are deleted within 30 days.
Your profile, listings that were never sold (except as below), drafts and uploads, evaluations, agent conversations and buyer-session transcripts, and your entries in our email-send log are deleted or de-identified within 90 days, including from backups.
Cleanrooms you own are wiped. Reports you released stay with the members who received them. IDs of the room, its runs, members and files, file hashes and sizes, receipts, and file names reduced to hashes are kept as the audit and billing record. File contents are not kept.
Messages and inquiries about deals are kept for 2 years, then deleted.
Payment, credit, payout and tax records and the verification status Stripe gives us are kept for 7 years after the end of the tax year of your last transaction.
Terms-acceptance records, and the records of what you published, approved or priced as a seller (including IP address and browser), are kept for 7 years after closure.
Signed license agreements are kept for 10 years; audit, fraud-prevention and trust records for 7 years.
Listings you sold are kept, and stay available to the buyers who licensed them for as long as their licenses allow; they are not deleted when those licenses end. A listing that was never sold is kept in the same way if a buyer licensed its sample, a slice of it or a listing derived from it.
We keep your unsubscribe, bounce and spam-report status so we never email you again.
If a seller put your email address on an access list, which decides who may buy their listings, that entry is kept, so it still applies if you sign up again.
A seller's hosted agent you dealt with keeps the name it knew you by, what it remembered about you and your messages to it, for as long as the seller keeps that agent.
Application logs are kept up to 90 days and database backups 35 days. Security audit logs, which can record the names of files you upload, are kept up to 400 days.
A legal hold pauses deletion of what it covers. A hold on a deal, evaluation, buyer session or listing connected to yours, or on the account of someone you dealt with, can also keep your listings derived from theirs, your evaluations, requests and messages with them, your agent conversations and the email address on your account until it is released.

Security

Connections to our website and services use TLS. Our databases and storage are encrypted at rest. We never store your password, and we store API keys only as hashes. Access to production systems is limited to authorized Amnetic personnel. Emergency access to our databases goes through an audited break-glass session, and administrative actions are recorded in AWS audit logs. No system is perfectly secure, and we cannot guarantee the security of information you send us.

Your choices

You can change your display name, business description, and website at any time in the portal under Account, Profile (where shown), or with the update_my_profile tool.
You can unsubscribe from reminder emails with the link in any reminder.
To ask for a copy of your information, to correct it, or to have it deleted, email harrison@amnetic.ai. Deletion follows the retention schedule above.

Where information is processed

Amnetic stores and processes information on Amazon Web Services in the United States. Stripe, E2B, and Google process the information they receive on their own infrastructure. If you use the Marketplace from outside the United States, your information is transferred to the United States.

Children

The Marketplace is intended only for people who are at least eighteen (18) years of age, as set out in Section 3.1 of the Terms. If you believe someone under eighteen has given us information, email harrison@amnetic.ai.

Changes to this policy

We may change this Privacy Policy from time to time. We will post the updated policy on this page and update the "Last Updated" date above. For significant changes, we may also notify you by email at the address associated with your account.

Contact

Amnetic AI, Inc.
Privacy questions and requests: harrison@amnetic.ai
Legal notices: legal@amnetic.ai