Amboras procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ If you are located in the EEA, UK, or Switzerland, you have the following rights in respect of personal data for which Amboras is the controller: access; rectification; erasure; restriction of processing; data portability; objection to processing based on legitimate interests (including direct marketing); and withdrawal of consent at any time, without affecting prior processing. To exercise these rights, contact contact@amboras.com; we will respond within one month. You also have the right to lodge a complaint with your local supervisory authority (in the UK, the ICO). Where Amboras acts as a processor of your data (Section 6), please direct your request to the relevant merchant.” | Captured 2026-07-19Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Upon termination: your right to use the Services ceases; your storefront will be taken offline; all outstanding fees become immediately due; we will retain your account data for 90 days, during which you may request an export, after which it may be permanently deleted; and any provisions that by their nature should survive (including Sections 5.6, 6, 7, 8, 10, 11, 13, and 14) survive.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ For personal data relating to your storefront visitors and customers, you are the controller and Amboras is your processor. We process that data only to provide the Services to you and on your documented instructions, under our Data Processing Addendum ("DPA"), which forms part of our agreement with you. As the controller, you are responsible for: providing legally required privacy notices to your customers; establishing a lawful basis for the processing; obtaining any required consents (including cookie and tracking consents); and honoring data-subject rights and opt-out signals. If your customer contacts us directly with a privacy request, we will direct them to you and provide reasonable assistance as required by the DPA.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ The Services interoperate with, depend on, and may give you access to third-party software, platforms, and services, including payment providers, the platforms you integrate (such as Shopify), AI model providers, hosting, DNS, CDN, and email-delivery infrastructure, and advertising and analytics networks (collectively, "Third-Party Services"). Your use of any Third-Party Service is at your own risk and subject to the applicable third party's terms, which are solely between you and that provider. Amboras makes no warranty regarding Third-Party Services, does not control them, may enable or disable integrations at any time, and, to the maximum extent permitted by law, is not liable for any damage, loss, or claim arising from Third-Party Services, including their acts, omissions, outages, data practices, pricing, account suspensions, or discontinuation. If you enable a Third-Party Service, you authorize us to share your data with that provider as required for interoperation.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Merchants may connect their own advertising pixels to their storefront. When a merchant enables this: the pixel identifier and server-side access token belong to the merchant's advertising account, not Amboras; we store these credentials encrypted at rest (server-side tokens are never sent to the browser) and use them only to forward storefront events on the merchant's instruction; the merchant is the controller (or co-controller with Meta or Google) for data collected through these tools, and Amboras acts solely as a processor; and data forwarded is governed by Meta's Business Tools Terms , Meta's Custom Audiences Terms , and Google Ads Data Processing Terms respectively. Merchants are contractually required under our Terms of Service to maintain their own privacy policy, obtain valid consent where required, and honor opt-out signals such as Global Privacy Control.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We share personal data with the following categories of service providers, each bound by a written data-processing agreement and permitted to process personal data only on our documented instructions: Hosting and infrastructure: Fly.io (application hosting), Vercel (frontend hosting), Supabase (managed PostgreSQL, authentication), GitHub (source-code storage for per-store deployments). Product analytics: PostHog (see Section 10). Payments: Stripe, for Amboras subscription billing only; we never receive or store your full card number. Transactional and storefront email: Resend. AI processing: Anthropic (Claude models) and OpenAI (speech-to-text); these providers do not use data submitted via their APIs to train their models. Customer support: Intercom, Slack. Error monitoring: Sentry, Datadog. Storefront payments. Payments made by your customers on your storefront are processed by payment providers (such as Stripe or PayPal) under accounts belonging to you and agreements between you and those providers. Amboras does not receive or store your customers' full card details. Connected platforms. Where you connect a third-party platform such as Shopify, data exchanged with that platform is also subject to its privacy policy. Legal requirements and corporate events. We may disclose personal data where required by law, to protect our rights, safety, and property or those of others, or in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate safeguards. We may add or replace sub-processors as the Services evolve. If a change materially expands how your personal data is processed, we will update this policy per Section 15, and, where the DPA applies, follow its sub-processor change procedure.” | Captured 2026-07-19Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ (g) interfere with or disrupt the integrity or performance of the Services or the storefronts of other merchants;” | Captured 2026-07-19Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ Support channels and target response times, if any, are as described for your plan on our pricing page or in your Enterprise agreement, and are targets, not guarantees.” | Captured 2026-07-19Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ We may offer features identified as beta, preview, early access, or experimental. Beta features are provided for evaluation, may be modified or withdrawn at any time, may contain defects, and are provided without warranty or liability of any kind and excluded from any support or availability commitment.” | Captured 2026-07-19Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ The Services, including the hosting and serving of your storefront and checkout, are provided on an "as is" and "as available" basis. Amboras does not commit to any uptime level, service level, or support response time, and no service-level agreement applies unless separately agreed in writing (for example, in an Enterprise agreement). The Services may be interrupted, suspended, or degraded, including for maintenance, updates, capacity constraints, security response, Third-Party Service failures, and events beyond our reasonable control. Where practicable we will give advance notice of planned maintenance, but we may perform emergency maintenance without notice.” | Captured 2026-07-19Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.