Privacy Policy

inAmber is a trading name of Capitalizt Ltd, company number 16890768, registered office 128 City Road, London EC1V 2NX, United Kingdom. Capitalizt Ltd is the data controller for the personal data described in this policy.

Capitalizt Ltd is registered with the Information Commissioner's Office, registration number ZC056790.

This policy applies to the inAmber website and application at inamber.ai and to the emails inAmber sends. It is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Account data: name, email address and authentication credentials. Where a recipient holds an account, the same.

Completing your account: your date of birth, mobile number and address, which you add in Settings after you sign up. We hold them to make sure your messages are delivered on the right day and to the right people, and to check that nobody else can claim to be you (performance of a contract). They are never shown to the people you write to.

Message data: the text you write, the audio and video you record or upload, the title, the occasion, the delivery date or event, and the name and email address of each person you address a message to. Text is stored encrypted on our servers. Audio and video are encrypted in your browser before upload and stored encrypted.

To help you write, transcribe your recordings and keep everyone safe, your words are processed by machines: our writing guide, our transcription service and an automated safety check. No person at inAmber reads them.

People you name: the name, email address and relationship of each recipient, and of each guardian you appoint to confirm that an event has occurred. A guardian’s response to a confirmation request, and any note they add, is stored with the request.

Data about a recipient under eighteen: a declared date of birth, and the name and email address of one adult who consents to the young person opening what was left for them. Nothing further is collected about a child.

Amber: the conversation you have with Amber, the writing companion, and the drafts it helps you produce.

Payment data: the order, the tier bought, the amount paid, and the payment provider’s reference. Card details are entered on the payment provider’s pages and are not stored by inAmber.

Access records: when a message is opened by its recipient, and when a guardian or consenting adult responds to a request, we record the time and a hashed form of the network address. The address itself is not stored.

Visits to our public pages: for each page you view we count the page, the website or advert link that brought you here, your country and the kind of device (phone, tablet or computer). To count each visitor once a day, we turn the date, your network address and your browser into a one way code and keep only that code. We do not keep your network address, we set no cookie and we store nothing in your browser. The code changes every day, so we cannot follow anyone from one day to the next, and we do not use it to identify you.

Performance of a contract (Article 6(1)(b)): to operate your account, to store and seal messages, to notify recipients and guardians, to deliver messages at the time or on the event you set, and to take payment.

Legal obligation (Article 6(1)(c)): to keep financial records, and to respond to requests made under data protection law.

Legitimate interests (Article 6(1)(f)): to keep the service secure, to keep a record of who opened a message and when, to prevent misuse, to count visits to our public pages so we can run and improve the site, and to tell you about changes to the service or to this policy.

Consent (Article 6(1)(a)): for anything optional. Consent can be withdrawn at any time and withdrawal does not affect the rest of the service.

Our own news, ideas and offers (soft opt in, regulation 22 of the Privacy and Electronic Communications Regulations, and legitimate interests): if you open an account, we may email you about inAmber's own news, ideas and offers. Every email we send you carries a link to stop them, and one press does it. Messages about your account, your messages and your payments are not marketing and are not affected.

Personal data is not sold, rented or shared with any third party for marketing, and message content is not used for advertising or for training models.

Each message is encrypted with its own 256 bit key using AES 256 GCM. That key is itself encrypted with a master key held in the application environment and not in the database. The master key is versioned so that it can be rotated without altering stored content.

inAmber holds the master key and is therefore technically able to decrypt message content. This is not zero knowledge encryption and it is not end to end encryption in the strict sense. Content is decrypted only to open a message for the person it was addressed to, to open it for you, or to answer a subject access request from you. Each opening by a recipient is recorded.

A fuller description is on How we safeguard your messages.

The following providers process personal data on our behalf under contract. None of them may use it for their own purposes.

• Supabase: database, authentication and encrypted file storage, London.
• Vercel: hosting of the application, London region.
• Resend: transactional email, Ireland.
• Stripe: payment processing.
• Cloudflare: domain name services for inamber.ai.
• An AI model provider: words Amber’s questions when our own model is not used; may be outside the United Kingdom.
• A speech to text provider: turns your recordings into captions and transcripts; receives the audio only; United States.

Amber’s questions are worded by our own model, or by an AI model provider acting only on our instructions under contract. Whichever is used, it is not allowed to train on what you write to Amber, and keeps it for no more than thirty days unless its own safety checks need it for longer. Our own safety checks run first, on every turn. Amber never writes your message for you.

Amber also gets better from how she is used, without keeping any of your words: for example, which questions people answer and where they stop. Your own words are used to teach inAmber’s model only if you say yes to helping Amber learn, and you can stop that at any time in Settings.

When you record, the speech to text provider receives the audio so that it can make captions and a transcript. It acts only on our instructions, is not allowed to train on your recordings, and deletes the audio once the job is done.

Recipients and guardians receive your name, and recipients receive the content you addressed to them. A guardian is told that a message exists and what they are asked to confirm. A guardian is not shown message content.

Personal data may be disclosed where the law requires it, for example to a court or a regulator.

Message content, account data and encrypted media are stored in the United Kingdom. Email is sent from Ireland, within the European Economic Area, which the United Kingdom recognises as providing adequate protection.

When you talk to Amber and our own model is not used, what you type may be sent to an AI model provider outside the United Kingdom, including the United States, so that her question can be worded, and is deleted there as set out in section 5. When you record, the audio is sent to our speech to text provider in the United States for the same reason, and is deleted there once the job is done.

Where any transfer outside the United Kingdom takes place, including to Stripe and to the providers above, inAmber relies on adequacy regulations, including the UK Extension to the EU US Data Privacy Framework where the provider is certified, or on the International Data Transfer Agreement or Addendum issued by the Information Commissioner’s Office.

Account data is kept for as long as the account is open.

A sealed message is kept until it is delivered. The delivery date may be up to twenty five years from purchase, depending on the tier. The retention terms in force when a message is sealed are recorded on that message and are not changed by any later change to this policy or to our pricing.

A message that has been delivered is kept at no charge for 10 years after delivery. Before that time ends, we will remind you. You can renew to keep it hosted, and downloading a copy is always free. If it is not renewed, we will send a final warning before it is deleted. Messages bought before 10 November 2026 keep the terms they were bought under.

For messages bought before 10 November 2026: a message that has been delivered is never deleted, whether or not it has been opened. If the person it was for is not ready, it waits for them.

Financial records, including order records, are kept for six years after the end of the financial year they relate to, as UK tax rules require.

Visit counts are kept for 13 months and then deleted.

If a refund or a dispute deletes your messages, we still keep the record of the payment, the refund and what you confirmed on the refund screen for six years, because the law requires us to keep financial records.

A request to delete a child’s data is actioned on receipt rather than at the end of any retention period.

Under the UK GDPR you have the right to access the personal data we hold about you, to have it corrected, to have it erased, to restrict its processing, to receive it in a portable form, and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time.

A subject access request includes the content of your messages, which inAmber is able to decrypt and return to you.

Requests are answered within one month. Where a request is complex, that period may be extended by up to two further months and you will be told within the first month. How to make a request is set out on your data rights.

A person must be eighteen or over to create and send messages.

Accounts are for people eighteen or over. Something left for a person under eighteen goes first to the adult they were named with, who can hand it over when the moment feels right. Anything still kept goes to them directly on their eighteenth birthday. inAmber applies the age of eighteen in every country it operates in.

For a person under eighteen we hold a declared date of birth and one adult’s name and email address. Children are not profiled and are not marketed to.

We use necessary cookies to keep you signed in and safe. Only if you say yes, we also use optional cookies from Google and Meta on our public pages, to see which adverts bring people here. They never run in your vault or on your messages. Our cookie policy has the detail, and you can change your answer there at any time.

Our visit counter uses no cookie, so it runs whether or not you say yes.

Some people find us through partner websites. If you arrive from one and say yes to optional cookies, our affiliate network, Awin, records that visit. If you then buy, we send Awin the order reference, the amount and the product, never your name or email, so the partner who sent you can be paid. If the order is refunded, we tell Awin so the partner is not paid for it. Awin's own privacy notice explains how it uses this: awin.com/gb/privacy.

If you type a question into the chat on our pages, it is sent to a trusted AI service provider, which writes the answer. It is used only to answer you. We do not keep your questions, and the chat sets no cookies. Please do not type personal details into it.

If you leave your email in the questions chat, we use it only to reply to you.

If you give us your email for a welcome code, we use it to send that code and a few short emails about inAmber, at most one a week. We keep your email and when you agreed. You can unsubscribe from any email, and we then stop at once and delete your address within 30 days, unless you are also a customer. We never share or sell it.

If you apply to be an ambassador, we use what you send (your name, contact details, address, links and any CV) only to review your application and, if you join, to run your agreement and pay you. Only we see it. If we decline your application, we delete it, including any CV.

When you sign the ambassador agreement, we keep a record of your signature: the name you typed, the date and time, the version and wording of the agreement, and the IP address and device you signed from. We keep it while your agreement runs and for six years after it ends, as evidence of the agreement and for our tax records. If we decline your application, we delete the record with the rest of it.

This policy may be updated. The date at the top records the current version. Where a change materially affects how your data is processed, account holders are notified by email before it takes effect.

Data protection enquiries: hello@inamber.ai.

By post: Capitalizt Ltd, 128 City Road, London EC1V 2NX, United Kingdom.

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the supervisory authority for data protection in the United Kingdom: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; telephone 0303 123 1113; ico.org.uk.