AmpliFLY Entertainment, LLC Privacy Policy

This Privacy Policy describes how we collect, use, disclose, and protect information in connection with our website and our analytics and reporting services (the “Services”).

1. Scope

This Privacy Policy applies to information we process when you:

• visit our website;
• sign up for, purchase, or use the Services; or
• receive analytics reports, dashboards, or recommendations from us.

This Policy does not apply to third-party websites, platforms, or services (including social platforms, streaming platforms, ad platforms, and data vendors). Those third parties have their own privacy policies and terms.

2. Definitions

• Client: the business entity purchasing the Services.
• Authorized Users: Client personnel/contractors authorized to access reports or our portal.
• Client Data: information Client provides to us or authorizes us to access (including connected channel identifiers and imported datasets).
• Third-Party Data: performance metrics and related data obtained from third-party platforms and vendors (e.g., social, streaming, ads, sentiment, public sites) that we access via subscriptions, APIs, or client authorization.
• Personal Information: information that identifies, relates to, describes, or could reasonably be linked with an individual (definitions vary by jurisdiction).

3. Information We Collect

A. Information you provide

We may collect:

• Business contact information (name, email, phone, title, company, mailing address).
• Account information for our portal (username, authentication logs).
• Payment and billing details (invoices, payment status; payment card data is typically processed by a payment processor).
• Support communications (emails, call notes, tickets).

B. Information collected automatically

We may collect:

• Device and usage data (IP address, browser/device type, pages visited, timestamps, referring URLs).
• Cookies and similar technologies (see Section 10).

C. Information obtained from third parties and client-authorized sources

Depending on the engagement, we may process:

• Social media metrics (followers, reach, impressions, views, engagement, likes/comments/shares/saves, posting cadence, content performance).
• Streaming metrics (e.g., Spotify and other platforms: streams, listeners, saves, playlist adds, territory splits, etc., depending on availability).
• Advertising data (spend, impressions, clicks, conversions, audiences, creative performance, attribution fields—depending on permissions and source).
• Audience demographics (age ranges, regions, gender, interest categories, and other aggregated insights where available).
• Sentiment and public web insights (reviews, articles, public posts, mentions, trend signals).
• Other datasets the Client requests we analyze (e.g., email campaign exports, web analytics summaries), if provided or authorized.

Credential handling note: Clients authenticate directly with third-party systems; we do not use client passwords to log in as them.

4. How We Use Information

We use information to:

1. Provide the Services (retrieve/receive metrics, analyze performance, generate reports and recommendations).
2. Operate and support the Services (account management, support, communications).
3. Billing and administration (invoicing, collections, fraud prevention).
4. Improve and secure the Services (debugging, quality assurance, analytics, security monitoring).
5. Compliance and enforcement (legal obligations, dispute resolution, enforce agreements).

5. How We Share Information

We do not sell Personal Information.

We may disclose information to:

• Service Providers / Processors (hosting, cloud storage, report generation tools, support systems, billing/payment processors, security providers) under contractual confidentiality and security obligations.
• Third-Party Data Sources to retrieve or receive metrics and related data at the Client’s direction (e.g., data aggregators, analytics vendors, platform APIs).
• Professional advisors (lawyers, accountants) as necessary.
• Legal and safety recipients when required by law or to protect rights/safety and prevent fraud.
• Corporate transactions (merger, acquisition, financing, asset sale) subject to standard protections.

6. Data Ownership and Use Limitations

6a

• Client retains rights to Client Data and their content.
• Third parties retain rights to Third-Party Data subject to their terms.
• We do not claim ownership of Client Data or Third-Party Data.
• We use such data only to provide the Services, improve the Services, and meet legal/security obligations.

6b

ACCEPTABLE USE. Client and its Authorized Users will not (and will not permit any third party to):

a. use the Services in violation of any applicable law, regulation, or court order;

b. use the Services to violate, circumvent, or encourage violation of any third-party platform or vendor terms (including social media, streaming, advertising, and data-provider terms), including by attempting to obtain data without authorization or in a manner prohibited by those terms;

c. interfere with, disrupt, or attempt to gain unauthorized access to the Services, systems, networks, or accounts, including by probing, scanning, or testing vulnerabilities;

d. introduce malware, ransomware, worms, or other harmful code;

e. reverse engineer, decompile, or disassemble any portion of the Services, or attempt to derive source code or underlying models, except to the extent such restrictions are prohibited by law;

f. use the Services to develop or benchmark a competing product or service, except with Company’s prior written consent;

g. misrepresent the Reports or recommendations, remove proprietary notices, or use the Services/Reports in a deceptive or unlawful manner; or

h. use the Services to process or upload Sensitive Personal Information unless expressly agreed in writing (see below).

Sensitive Personal Information. Unless expressly agreed in writing, Client will not provide to Company any: government identifiers, precise geolocation, biometric identifiers, health/medical information, or other “sensitive” data as defined by applicable law, except to the extent included in aggregated analytics provided by third-party platforms.

Enforcement. Company may suspend or terminate Services for violations of this section, in addition to any other remedies.

7. Data Retention

We retain information as needed to:

• provide the Services and maintain records,
• comply with legal/tax obligations,
• resolve disputes and enforce agreements.

Unless otherwise stated in your contract, upon termination we will delete or de-identify Client Data within a commercially reasonable period, except where retention is required or permitted by law.

8. Data Processing

To the extent Company processes Personal Information on behalf of Client in providing the Services, the parties agree that Client is the “business” or “controller” (as applicable) and Company is a “service provider” or “processor” (as applicable). Company will process such Personal Information only to provide the Services and as otherwise permitted by this Agreement. If required by applicable law or reasonably requested by Client, the parties will enter into Company’s then-current Data Processing Addendum (“DPA”), which is incorporated into this Agreement by reference upon execution.

9. Security

We maintain reasonable administrative, technical, and physical safeguards appropriate to the nature of the information processed. No system can be guaranteed 100% secure.

10. Security Incident Notification

a. Security Incident. “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Client Data in Company’s possession or control.

b. Notice. Company will notify Client without undue delay after becoming aware of a Security Incident involving Client Data and will provide information reasonably necessary for Client to meet any applicable notification obligations, to the extent such information is available to Company.

c. Mitigation. Company will take reasonable steps to contain, investigate, and remediate the Security Incident and to mitigate its effects.

d. No Admission. Security Incident notices are not an admission of fault or liability.

e. Client Cooperation. Client will promptly cooperate with Company’s reasonable requests related to investigation and remediation.

f. Client Systems. Company is not responsible for security incidents originating from Client systems, Client accounts, or third-party platforms outside Company’s control.

11. International Transfers (Canada + cross-border)

We may store or process information in the United States or other jurisdictions where we or our service providers operate. These jurisdictions may have different privacy laws. We take steps to protect information consistent with this Policy and applicable law.

12. Cookies and Analytics

We may use cookies and similar tools for:

• essential site functionality,
• performance and analytics,
• preferences.

You may control cookies through browser settings. Disabling cookies may reduce site functionality.

13. Your Privacy Rights (California + Canada + other US states as applicable)

A. California (CPRA)

If you are a California resident (to the extent applicable), you may have rights to:

• request access to Personal Information,
• request deletion,
• request correction,
• request information about disclosures,
• opt out of certain “sharing” for cross-context behavioral advertising (we do not share for this purpose as described above).

We will not discriminate against you for exercising your rights.

B. Canada (PIPEDA and provincial laws)

Individuals in Canada may request access to and correction of their Personal Information and may withdraw consent subject to legal/contractual restrictions.

C. How to exercise rights

Email: contact@ampliflyent.com with “Privacy Request” in the subject line. We may verify identity/authority before fulfilling requests.

14. Children

Our Services are not directed to children, and we do not knowingly collect Personal Information from children.

15. Marketing and Client List

Unless the Client opts out in writing, we may identify the Client as a customer and use their name/logo in our marketing materials (e.g., website, proposals). We do not publish non-public performance metrics without permission.

16. Changes

We may update this Policy. We will post the updated version and revise the Effective Date.