Privacy-Policy

Last Updated: October 26, 2026

Introduction

Amster is an AI governance platform developed by Ariqt Global Technologies (“Ariqt”). It is designed to help organizations understand and govern employee AI usage through usage visibility, prompt classification, risk indicators, dashboards, and governance reporting. Where supported by the platform and its configuration, this may include classification in relation to categories or requirements under the EU Artificial Intelligence Act (EU AI Act).

This Privacy Policy explains how personal data may be collected, used, shared, and retained when Amster is used. Processing depends on the features enabled, the organization’s configuration, and the applicable customer agreement. Ariqt aims to handle personal data in accordance with applicable data protection laws, including the GDPR where applicable.

What Data We Collect

Depending on how Amster is configured and used, we may process the following categories of information:

Contact and account information: name, business email address, role, organization, and authentication or account details.
Employee AI usage information: prompts or queries entered in an AI tool, records of AI interactions, and related usage details where those features are enabled.
Technical and usage metadata: timestamps, tools or application identifiers, device or browser information, logs, and diagnostic data.
Governance information: classifications, risk indicators, review notes, dashboards, reports, and records of decisions made by authorized users.
Communications and support information: information that you provide when contacting us.

Prompts and related records may contain personal, confidential, or sensitive information. Organizations should configure Amster appropriately and avoid collecting information that is unnecessary for their governance purposes. Depending on the relationship and applicable law, the organization using Amster may act as the data controller, and Ariqt may act as a processor, or the parties may have different roles for processing activities.

How We Use Your Data

We may use information to provide and operate Amster; show authorized users visibility into AI usage; classify prompts or use cases; generate governance insights, risk indicators, dashboards, and reports; support review of AI use in relation to relevant policies or EU AI Act categories where supported; administer accounts; provide customer support; maintain security; troubleshoot issues; and improve the reliability and usability of the platform where permitted by law and applicable agreements.

We do not use personal data for a purpose incompatible with the purpose for which it was collected. Any use of customer data for model training or product improvement must follow Ariqt’s actual practices, applicable contracts, and law; organizations should consult their service agreement or contact Ariqt for details applicable to their deployment.

Amster’s outputs are intended to support governance and review. They do not, by themselves, establish legal compliance, misconduct, or a final determination about an individual or AI system.

Legal Bases for Processing

Where the GDPR applies, the legal basis for processing may include performance of a contract, compliance with a legal obligation, legitimate interests, or consent where consent is appropriate. The relevant basis depends on the purpose and circumstances of the processing.

Organizations using Amster are responsible for identifying and documenting an appropriate legal basis for employee monitoring, providing required transparency notices, and meeting applicable workplace and data-protection obligations. Consent may not be an appropriate legal basis in some employment contexts because of the imbalance between employer and employee.

Data Sharing and Transfers

We may share information with authorized personnel within Ariqt, service providers that help operate or support Amster, the customer organization and its authorized administrators, competent authorities where required by law, and parties involved in a corporate transaction where legally permitted and subject to appropriate safeguards.

We do not sell personal data as part of the described Amster service model. Where personal data is transferred internationally, we will use an appropriate transfer mechanism where required, such as an adequacy decision or Standard Contractual Clauses, together with any additional safeguards required by applicable law.

Data Retention

We retain personal data for as long as reasonably necessary to provide Amster, meet the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce agreements.

Retention periods may depend on the type of data, the platform configuration, the customer agreement, and applicable law. Organizations should confirm and configure appropriate retention periods for employee AI usage records and governance reports. When data is no longer required, it will be deleted or anonymized where appropriate, subject to legal, security, backup, and contractual requirements.

Your Rights

Depending on applicable law, individuals may have rights to request access to their personal data, correction, deletion, restriction of processing, objection to processing, data portability, or withdrawal of consent where processing is based on consent. Individuals may also have the right to lodge a complaint with a relevant supervisory authority and rights relating to certain automated decisions.

If Amster processes employee usage information on behalf of an organization, the organization may be the appropriate first point of contact for requests relating to that information. Ariqt will support the organization as required by the applicable agreement and law. We may need to verify identity before responding to a request, and some rights may be limited by applicable law.

Data Security

Ariqt uses reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. Measures may include access controls, authentication, permissions, logging, monitoring, and secure handling practices appropriate to the service.

No system or method of transmission can be guaranteed to be completely secure. Organizations are responsible for managing their users, access permissions, configurations, and internal procedures appropriately. Where required by law, Ariqt will handle personal data breaches in accordance with its legal and contractual obligations.

Cookies and Tracking

The Amster website may use cookies or similar technologies needed for website operation, security, preferences, and, where enabled, analytics. Non-essential cookies will be used only where required consent, or another valid legal basis, has been obtained.

You can manage cookies through your browser settings, and any cookie controls made available on the website. The final published policy should accurately identify the cookies and tracking technologies actually in use.

Policy Updates

We may update this Privacy Policy to reflect changes to Amster, our data practices, or applicable legal requirements. Updates will be published with a revised “Last Updated” date. We will provide additional notice where required by law or contract.