Privacy Policy.

Who this policy covers

AMBITON helps business owners plan, build and manage digital products. This draft describes the website and the product features present in the reviewed local candidate. A demo, proposed connection or unavailable feature does not mean a live service is operating.

For account administration and our own website inquiries, AMBITON determines how information is used. If a business uses AMBITON to handle its customers' information, that business may determine the purposes of processing. The applicable roles, processing agreement and that business's customer privacy notice must be established before real customer data is used. A customer's application may have a separate operator and privacy policy.

Review required. Before publication: identify AMBITON's legal operator, address, applicable jurisdictions and any required representative. The domain and contact address alone do not identify a legal entity.

Information you provide and create

Project inquiries can include your name, email, optional phone number, company, website, project goals, budget range, timing, description and referral source. Account access can use your email and password or an email sign-in link. Configured account access uses Supabase Authentication.

A workspace can contain your business description, messages, requirements, design choices, draft and approved blueprints, revision and decision history, generated source files, build and verification records, checkpoints, and export requests. Saved business setup can include owner contact details, products, prices, ingredients, allergen wording, stock, delivery rules and proposed operating permissions.

Optional saved preferences include a companion choice, display name, colors and appearance or device preferences. A launch checklist can include a proposed entity name, entity type, jurisdiction, registry reference, domain and your statement of domain control. Saving these drafts does not verify, register or purchase anything.

Files, images and research references

Files staged in the chat composer stay in page memory until the available submission flow is used. Separately enabled private file storage can hold file bytes, names, types, sizes, integrity checks and references to their project and message. Access depends on current project permissions. Uploading a file does not itself send it to an AI service or authorize an action.

The reviewed file reader accepts validated plain text as untrusted reference material. General image and PDF analysis is not qualified. A separate screenshot design service is gated and its real vision provider is disabled in this candidate. If image analysis or creative generation becomes available, the selected provider, information sent, rights and retention must be disclosed before use.

Planning can use manually supplied source excerpts, links, publication or retrieval dates, claims, uncertainty and review history. The local source registry does not establish that internet research occurred. Sources and AI suggestions may be incomplete, outdated or incorrect. Only upload material you are entitled to use; remove secrets and unnecessary personal information first.

Voice, audio and transcripts

Optional browser dictation starts after your action and microphone permission. Your browser may send audio to its speech service; processing and retention depend on that service and your settings. AMBITON's dictation feature does not store an audio file. The draft transcript stays in page memory until you add and submit the text through the normal message or brief flow. You can type instead, stop dictation or discard the draft.

Reading a reply aloud uses an available device-local voice after your action. It does not request microphone access. Separately gated two-way voice is a different service: it would send microphone audio to its configured real-time provider and return audio and captions. Live two-way audio is not qualified in the reviewed candidate. Trial code holds captions in temporary memory and keeps session, permission and usage records separately; clearing displayed captions is not deletion of provider records. The active provider, session lifecycle and retention require review before enabling it.

How information is used

The reviewed flows use information to answer inquiries; authenticate users and check project access; save and revise business plans; prepare requested builds and previews; explain supported business records; provide requested exports; and record permissions, failures, usage and estimated costs. Model requests use the context selected for that workflow. Some fixed-rule suggestions, design choices and practice calculations run without an AI call.

A suggestion, remembered fact, spoken request or connected account does not grant spending, publishing, customer-messaging or other execution authority. Review the specific action and scope presented by the product. Demo automation and local rehearsals do not establish that an external action occurred.

Review required. Before publication: confirm the purposes, legal bases where required, legitimate interests if relied on, required versus optional information, and any legally significant automated decisions. Do not treat this policy as blanket consent.

Service providers and connections

Configured flows may use authentication and database services, private storage, AI services, isolated build environments, hosting, source repositories, email delivery and payment services. Code includes Supabase, OpenAI, Resend and other provider adapters, but inclusion in code or a catalog does not show that a provider is active for your account. A verified list of active providers and their relevant processing must be completed before launch.

The optional Google Drive connection has separate setup and storage gates. Its current implementation requests account identity and access to app-authorized files; its bounded test reads selected file metadata. It does not establish broad Drive access, import file contents into model context, or enable other catalog connections. Stored connection credentials are handled separately from public connection status. Disconnecting AMBITON and revoking a provider grant are different actions; revocation can fail or affect other access in the same provider project.

Authorized workspace members can access records permitted by their role. Information you deliberately export, publish or send to another service reaches that destination under its own controls. Provider processing, access locations, transfers and backup practices need separate verification; this draft does not promise zero retention, on-device AI processing or that information can never be used for provider training.

Review required. Before publication: verify active recipients, processing contracts, countries and transfer safeguards; any support access, legal disclosures or business-transfer practices; and sale, sharing, advertising or analytics practices. No blanket no-sale or compliance claim is established here.

Cookies, browser storage and technical records

Configured sign-in uses session cookies. Separate private test applications use their own sessions. Some test checkout flows temporarily keep selected meals, a sample ZIP code and a retry reference in session storage; a local owner page can retain the last catalog identifier in browser storage. These are distinct from saved server records.

The inquiry endpoint hashes a forwarded IP value for an in-memory rate limit. Hosting and configured services may also receive network requests and technical logs. No advertising tracker was identified in the reviewed application source; that source review does not verify all hosting, browser, embedded-content or third-party behavior. Cookie names, lifetimes and any non-essential tracking must be inventoried before launch.

Customer records and private tests

The meal-prep prototype uses sample data and simulated operations. A separately configured private test app can retain account, catalog, inventory, meal selection, ZIP code, delivery, price, order, test-payment and owner-recorded fulfillment records. Its account and permissions are separate from an AMBITON account. Customers read their own permitted records; assigned owners can read permitted business records.

Optional Stripe Checkout is a separately configured test flow, not evidence of live payments or an AMBITON subscription. Local messaging, marketing and workflow drafts do not show that customer outreach, ad spending or physical fulfillment happened. Use synthetic data in test surfaces. Real customer operations require a verified configuration, appropriate notices and permissions.

Retention, removal and exports

Unsaved page-memory drafts and practice records usually disappear when that view is left or reloaded. Explicit saves, submitted messages, server records and downloaded copies are different. Signing out, closing a tab, resetting a preview or cancelling a draft does not delete saved account or business records.

For enabled hosted files, removal revokes new access before physical deletion is confirmed. Failed deletion can leave cleanup pending, and accountability metadata can remain. A previously issued short-lived download link or downloaded copy cannot be immediately recalled. An export is limited to the feature and records it describes; it is not necessarily a complete account copy or recoverable backup. Keep downloaded copies private.

No complete retention schedule or account-wide deletion process is verified for this candidate. Storage, backups, audit and usage records, provider copies, legal holds and deletion exceptions must be addressed before launch. Contact us about access, correction, export or deletion; the request must be scoped and verified without sending passwords.

Review required. Before publication: approve retention periods or specific criteria by data category, backup expiry, deletion handling and verification, request deadlines and responsible staff. No instant or universal deletion promise is made.

Your choices and privacy requests

You can type instead of dictating, decline an optional connection, stop available voice controls, leave unsaved drafts unsubmitted, and use the exports available for your permitted records. Revoking future access does not undo an action already completed or remove copies at other destinations.

Depending on applicable law and your relationship with the service, you may have rights to access, correct, delete, restrict or object to processing, receive portable information, withdraw consent where processing relies on it, or complain to a privacy regulator. Contact contact@ambiton.io with the account or project concerned and the request. We may need proportionate identity and authority checks. Do not send credentials. Required regional rights, request methods, appeals and regulator details remain to be completed after jurisdictions are confirmed.

Audience, updates and contact

The reviewed experience is designed around business-owner workflows. The permitted minimum age, audience and countries are not yet confirmed. Child-directed services or children's data must not be enabled without a reviewed policy and appropriate safeguards.

Product changes create proposed policy updates for owner and counsel review. A proposed draft does not change an effective policy or an existing agreement. Any publication, effective date, material-change notice and additional consent must be deliberately reviewed. Questions about this draft can be sent to contact@ambiton.io.

Portable source exports

An explicit owner download, where the checkpoint export is available, can include the selected checkpoint's allowed saved source files and its exact approved business and product definitions, including owner details you supplied. Keep this copy private and share it intentionally. A separately downloaded receipt records integrity digests and checkpoint references. This feature sends the download to your browser; no new provider receives it through this feature.

Known credential material is refused, and dedicated data records, internal transcripts and unsupported files are excluded. Filtering is not a guarantee that arbitrary source contains no personal information. Database schema, current records, storage, accounts, secret values, Git history and external effects are not backed up or restored. A downloaded copy cannot be recalled. This feature does not import, execute, deploy or overwrite a project.

Review required. Owner and counsel must review this disclosure and the actual hosted authorization and filtering boundaries before activation. Hosted checkpoint export remains unqualified in this local integration.

Per-chat browser workspace preferences

The per-chat workspace surface stores browser preferences in localStorage under a key separated by actor, project and chat. The record contains those scope identifiers, a saved timestamp, typed preview and output resource references, selected tab, category and pane state, and HTTPS website addresses you explicitly enter. This surface does not include artifact names, artifact contents, chat content or credential fields in the saved record. Do not put secrets or unnecessary personal information in a website address.

Each chat workspace record is bounded to 20 tabs and 16 KiB of metadata. Website entries accept a limited HTTPS domain-address format without credentials, queries or fragments and reject IP addresses and certain private or reserved host names. This is a syntax check, not a DNS lookup or verification that a destination is public, safe, owned by you or operating.

Metadata has a 30-day expiry checked when the surface reads or changes it. Expired metadata is held until explicitly removed; its bytes may remain in browser storage. This expiry is not a promise of automatic physical deletion after 30 days. Browser storage settings, device cleanup and removal failures can affect retention.

Private preview and output content must resolve against a fresh authenticated catalog for the same actor, project and chat. The host display lease is limited to 30 seconds from its authenticated observation; checking, expiry or lost access holds private content. Saved tab metadata cannot renew that lease, authorize a provider action, establish a working preview or serve as a project backup.

Session revocation and the explicit forget control attempt to remove only the current scoped workspace key. Removal is best effort when browser storage is unavailable or refuses the operation. Hiding or leaving the page holds private content while retaining workspace metadata for reopening; it does not remove server records or other chats' storage.

Saved websites are explicit external browser links. AMBITON does not automatically fetch these pages or embed them in an iframe through this surface. Choosing a link opens the destination in your browser, where that website receives the browser request and applies its own privacy practices. A saved address does not grant permission to act on that website.

Review required. This describes the bounded local per-chat workspace implementation. Review the final hosted access enforcement and browser behavior before publication or activation; the draft sets no effective policy date.