Last updated 11 November 2026
Privacy policy
This policy says what Amaware collects about you, where it comes from, why we use it, who else touches it, how long we keep it, and what you can do about it. It covers amaware.ai, platform.amaware.ai, check.amaware.ai, the free check, the emails we send, the MCP server and the API, the people we contact about Amaware, and the calls we have with you.
The short version. We keep what we need to run your workspace, bill you, keep bots out and answer your emails. The AI models that write for you see the content needed for the task and nothing more, under business terms that forbid training on it. We never sell personal data. Google Meet records our calls with you, and we delete the recording when you ask. On amaware.ai, and only there, services called RB2B and Leadpipe try to identify which businesses and people visit, and you can opt out. You can ask for a copy of your data or for it to be deleted at any time at hello@amaware.ai, and we answer within 30 days.
1. Who we are and what this covers
Amaware is run by REmomentum LLC, a Wyoming limited liability company, which is the controller of the personal data this policy describes, except where section 11 says you are the controller and we process for you. "We" means REmomentum LLC. Write to us at hello@amaware.ai, or by post to REmomentum LLC, Amaware, Colorado, USA, at the street address we give you on request.
Personal data means anything that identifies a person or could with reasonable effort. Business data about a company, its website, its prices and what AI engines say about it is mostly not personal data, and this policy covers it only where a person is in it. The Terms of service govern the Service and this policy is part of them.
2. What we collect
When you visit our sites
- The requests your browser makes: the pages, the time, your browser and device type, the language, the page that sent you, and your IP address, which we keep only as a hash with the city and country it came from, for rate limiting and abuse checks.
- Google Analytics measurement on amaware.ai, platform.amaware.ai and check.amaware.ai: pages, events, device, rough location, and its own identifiers in cookies. It is not loaded on pages that carry a private link, such as an invite, a review link, a code or a connection step, in an automated browser, or in a browser our own team works from.
- On amaware.ai only, RB2B, Leadpipe and their partners try to match a visit to a business and a person, as section 8 says.
- On amaware.ai, on free check reports and, when you are signed in, on the pages of the app other than Settings and Connections, how you use the page: the page as it was shown, where you clicked, where your mouse went and how far you scrolled, with everything you type hidden before it leaves your browser. It is kept with your browser's visitor id, your city, your device and, for 30 days, your IP address, as section 8 says; in the app it is kept with your account and your workspace, so our team can see where the product got in your way. In the EU, the EEA, the UK and Switzerland this records only after you say yes.
- If you book a demo: your name, email, company and what you told us you want to get done, through the Cal.com booking.
- For a Google Meet call with our team, whoever hosts it: the invitation's title, time and guest list. If we host it, also who joined, the recording, the transcript with who said what and when, and Gemini's notes, as section 10 says.
- If you email us: the email and what you wrote, and our reply.
When you run a free check
Your email, the domain you asked about, an optional note, a hashed IP and your browser type, plus the report we make. Section 9 says what a report holds and who can see it. When anyone opens a report we record how it was read: the sections seen, scroll depth, clicks, time on the page, the referrer, the device, the browser, the language, the time zone, the city and a hashed IP, with no cookie.
When you have an account
- Account: your email, your name if you give one, a hashed password or your sign-in link, your time zone, the theme, date range and Actions filters you last picked, which Amaware emails you want for each brand, your role on each workspace, the people you invite and when they joined.
- Workspace: your brand details and voice, your prompts, your competitors, the engines you chose, every engine answer we captured with the pages it cited, your recommendations and briefs, your articles with every saved version and who saved each one, your covers, your Knowledge pages, files and text, your statuses, your traffic numbers, and the settings you set. When you use Videos, the videos your AI made or you uploaded for your approval, and the edits you wrote on them, until you delete them or the workspace.
- Your clients: when you look after brands for clients, the email addresses of the people you name for each one, the monthly report and the approval emails you send them with your note, when each went and to whom, and which address approved an article. Those people get no account. They get only the mail you send, a reply goes to you, and removing an address ends its approval links at once.
- Billing: your Stripe customer and subscription ids, plan, status, billing email and the dates that matter. Stripe holds your card. We never see or store the number.
- Connections: for each site or account you connect, the tokens or application password needed to act on it, stored encrypted, plus the property, blog, collection or author you picked.
- Agents: your API keys as hashes, the AI assistants you connected, and a log of every call: the tool, whether it worked, how long it took, the credits it used, the client and its version, and short input values up to 80 characters, with anything that looks like a secret removed. A feature request your assistant files keeps its words, the last hour of its calls and who made the key.
- Credits: a ledger of every credit earned, spent and refunded, and what for.
- Support and admin: your emails to us, and a log of every time a member of our team opened your workspace to help you, which is read-only and recorded. Our team can also read the chats you have with Amaware in the app, to see what people ask and to fix answers that fail. Reading is all they can do there.
- Emails we send you: which ones, when, and the stop links you used.
If we contact you first
Section 10 describes what we hold about the people we reach out to on LinkedIn and by email.
3. Where it comes from
- You, when you sign up, fill a form, connect an account, add Knowledge, type in the app, or write to us.
- Your browser and your devices, through the requests they make and the scripts in section 8.
- The accounts you connect: Google Search Console, Google Analytics, Bing Webmaster Tools and your publishing platform, each within what you allowed.
- Public web pages: your website, your competitors' websites and the pages an engine cited, which we read to build briefs, check facts and find competitors.
- AI engines and data providers: what ChatGPT, Gemini, Google AI Overviews, Google AI Mode, Perplexity and the other engines answered, and search-volume and keyword data from our data providers.
- LinkedIn and the tools we use for outreach, for the people we contact, as section 10 says.
- Google Meet and Google Calendar, for calls with our team, as section 10 says.
- Stripe, which tells us when a payment, a trial or a plan changes.
4. Why we use it, and the legal basis
| What for | Basis where one is required |
|---|---|
| Running your workspace: capturing answers, ranking recommendations, writing and checking articles, publishing to your site, reading your traffic, serving the API and MCP, sending the emails the Service sends. | Performing our contract with you. |
| Billing, trials, credits, taxes and records. | Our contract, and our legal duties for tax and accounting. |
| Keeping the Service secure: rate limits, bot checks, abuse detection, logs, alerts to our team when something breaks. | Our legitimate interest in a service that stays up and safe. |
| Support: reading your emails, opening your workspace to help, answering a rights request. | Our contract, and our legal duties. |
| Understanding how the sites and the app are used, in aggregate, and improving the Service. | Our legitimate interest, and your consent for analytics cookies where the law asks for it. |
| Making a free check report for a business, and showing it to the person who asked and to the business. | Our legitimate interest in showing businesses what AI says about them, and the requester's request. |
| Telling you about Amaware: the digest, product news, a follow-up after a free check, a reply to your interest. | Our legitimate interest in marketing to businesses, with a stop link in every email, and your consent where the law asks for it. |
| Identifying which businesses visit amaware.ai and following up with them. | Our legitimate interest in business-to-business marketing, in the United States only, with an opt-out. |
| Reaching out to people whose work makes Amaware relevant to them. | Our legitimate interest in business-to-business marketing, with an easy way to say no. |
| Recording and transcribing the calls we host with you, and adding the transcript and notes to your contact in our CRM. | Your consent when you stay on the call after Google's notice shows, and our legitimate interest in an accurate record of what we talked about. Ask and we turn recording off. |
| Defending a claim, enforcing the Terms, or meeting a legal demand. | Our legitimate interest, and our legal duties. |
We do not make decisions about you by automated means that have a legal or similarly significant effect on you. We do not use your data to train AI models, and we do not sell it.
5. What the AI models see
The Service uses AI models from companies we do not own. Each sees only what its task needs:
- Anthropic runs the models that suggest prompts, write briefs and articles, check facts, check your blog's template against your Knowledge, describe a cover image, and read scanned files and photos you add to Knowledge. For those tasks it receives your brand profile, the relevant Knowledge excerpts with their dates, the text of pages we read, the article being written or checked, and the file being read. For the people we contact on LinkedIn, it also drafts our replies from the conversation (section 10). Once a day it also reads a text timeline of what visitors did on amaware.ai the day before, the pages, clicks and scrolls of section 8 and never anything typed, and writes a short digest for our team. When you turn on Web in the chat, Anthropic's web tools run the chat's searches and read the pages it cites. The search provider and the sites it reads see those requests and nothing about your account.
- Our data provider captures what ChatGPT, Gemini, Google AI Overviews and Google AI Mode answer, and asks Perplexity on our behalf. It receives the prompt text, your brand name and your and your competitors' domains, and keywords. Never your account details.
- Perplexity, OpenAI and Google receive the prompt text alone when you turn on an engine that is asked through its own API; Perplexity receives it from our data provider.
- kie.ai makes cover images from a scene description built from the article's title, description and headings, and from what you typed when you asked for a new cover.
- Google's Gemini writes notes on the calls we host on Google Meet, inside our own Google Workspace. It receives what is said on the call and the slides anyone presents.
We send this data under each provider's business terms, which say the provider does not use it to train its models. We do not use it to train any model either. The models can be wrong, and the Terms explain that a person on your account reads every article before it goes live.
7. Google and Microsoft account data
When you connect Google Search Console we ask for read access to your properties and the right to submit sitemaps and inspect the pages we published. When you connect Google Analytics we ask for read-only access to the properties you choose, and we read the visits, sources and pages behind your site so the Traffic page can show you what each article brought. We store what we read, never your Google password, and we never write to Google Analytics. You can disconnect in Settings or at myaccount.google.com, and the stored data is deleted with the workspace.
Amaware's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In plain words: data from your Google account is used only to show you your own numbers and to submit your own pages, it is never sold, never used for advertising, never used to train models, and never read by a person at Amaware except to help you when you ask, to keep the Service secure, or when the law requires it. Bing Webmaster Tools data is handled the same way under Microsoft's terms.
9. Free checks and reports
A free check takes a business domain and an email. We read the business's home page and a few pages on the same site, ask the engines about it and about the competitors they name, and make a report of what was said. A report shows the business name, its site, the competitors the engines named, the answers, the pages cited and counts. It does not show the email that asked for it. The report lives at a link on check.amaware.ai that anyone with the link can open. It is not listed by search engines. A report opens without an email. If you type one to get a copy, we keep it with the opens of that report: when, how long, how far down, from where, and on what kind of device. A person on our team uses it to follow up about the report and about showing up in AI search, and the business the report is about may be told who read it. The business may be shown its report, including by us when we reach out.
A report is about a business, and the engines' answers are theirs, not ours. If a report names your business and you want it edited or removed, email hello@amaware.ai and we remove it. Anyone with the link can add or remove a competitor or leave a note, and each edit is stored with a hashed IP. The hidden workspace behind a report that nobody claims is deleted after 60 days. The report itself, the email that asked for it and the record of how it was read stay until we remove them, which you can ask for at any time.
10. Sales conversations and calls
We contact people whose work makes Amaware relevant to them, mostly on LinkedIn and sometimes by email. For those people we hold what their public profile says, such as name, title, company, website and the LinkedIn address, the messages between us, the stage of the conversation, our notes, and, where we ran a free check on their business, the report and whether they read it. A report link we send you carries a short code that tells us who we sent it to, so we can see when it's opened and how long it's read. Anyone you forward it to opens the same link, and we can't tell the two of you apart. We get this from LinkedIn, from the tools we use to send and read messages, from public websites and from what you tell us. Clay builds our list of people to contact from public profiles and company websites. When Leadpipe names someone who visited amaware.ai, we keep what it returns with that visit: the name, title, company, LinkedIn address, email addresses and phone numbers. MoltSets tells us whether it knows the same person and may add a work email or a mobile number, MillionVerifier checks each address, and we may contact them. MoltSets finds a work email and, where we ask for one, a mobile number from a LinkedIn address, and we add them to our CRM. When someone types a work email to get a copy of a report and we have no name for it, MoltSets can tell us the name, title and LinkedIn profile behind that address, and we keep those with the contact. MoltSets also gives us lists of people whose work makes Amaware relevant to them, from its database of public profiles: a name, title, company, place, a work email and the LinkedIn address, which we keep as a list of people to contact. Before we write to someone on a list, Apify may read their public LinkedIn profile so we have their current title and company, and we keep what it found. TheirStack tells us which companies posted a job asking for AI search, with the job title, the sentences from the post that matched and, when the post shows one, the recruiter's name and LinkedIn address; we keep those with the company and find the people to write to as above. Each of our sellers connects their own LinkedIn account through Unipile, and we read their messages with the people we contact. We also read the email between our team's @amaware.ai mailboxes and you, and mail sent through Instantly, into the same conversation record, and only once you are someone we contact. Mail and messages with anyone else are not read or stored. When someone on our team emails you from Amaware, the email has a tiny image in it. When your mail app loads that image, we record an open. We keep when it loaded and whether it looked like a person or an automatic check. We don't keep your IP address or which device you used. When you write to us, a model from Anthropic drafts our reply from the conversation and, where we ran one, the report about your business. A person reads every draft before anything is sent.
Our sales CRM is HubSpot. We add you when you ask for a free check or a demo, or when you type your email to get a copy of one of our reports. If we reached out to you first, you go in once we have your email. HubSpot holds your email, and your name, company, title and LinkedIn address when we know them. It also keeps notes on how our reports about your business were read: who read them, from where, on what device and for how long. If we only know you from LinkedIn, you are not in it, but your company may be. We delete what HubSpot holds about you within 30 days of your request, or of a no.
Say "no" or "stop" in a reply, or email hello@amaware.ai, and we stop and delete what we hold within 30 days, keeping only a record that you asked us not to contact you.
Calls with our team
When our team hosts a call with you on Google Meet, Meet records and transcribes it in our own Google Workspace. Gemini, Google's AI, writes notes on it. Meet tells everyone who joins that the call is recorded. If you'd rather not be recorded, say so before or during the call and we turn recording off. The transcript shows who said what and when. We keep it with Gemini's notes and a link to the recording. We also add the transcript and notes to your contact in our CRM, HubSpot. Email hello@amaware.ai and we delete the recording, the transcript, the notes, the meeting invite and the copy in HubSpot within 30 days.
11. Data you bring in about other people
Some of what you put into the Service can contain personal data about other people: a customer named in a Knowledge document, a testimonial, the visitors behind your Google Analytics numbers, a person named in an article, your own team's emails. For that data you are the controller and we are your processor, and these terms apply, which together with the Terms of service are our data processing agreement. We sign a separate addendum on request, including the European Commission's standard contractual clauses and the UK addendum where you need them.
- We process that data only to provide the Service as the Terms describe and as you instruct through the app, the API and your assistants. We tell you if an instruction would break the law.
- The people on our team who can see it are bound to confidentiality. Our processors are the companies in section 6, and we give at least 14 days' notice of a new one that would handle workspace data.
- We protect it with the measures in section 13, help you answer a person's request about it, and help with an impact assessment where the law requires one and the information is not already here.
- If we learn of a breach affecting it, we tell you without undue delay and within 72 hours of confirming it, with what we know and what we are doing.
- When the workspace is deleted, or you ask, we delete it as section 12 says, except what the law makes us keep.
- We give you the information you reasonably need to show the processing is lawful, and we allow an audit, at your cost and on reasonable notice, where a written answer does not satisfy a regulator.
- You promise that you have the right to share that data with us and to have it processed this way, and that you keep sensitive data out of the Service as the Terms ask.
12. How long we keep it
| Data | Kept |
|---|---|
| Account, workspace, answers, recommendations, articles and their versions, Knowledge text, connections, traffic, credit ledger, agent call log | While the workspace exists. Deleting a workspace removes them from our live systems at once, and from backups within 30 days. There is no undo. |
| Chats with Amaware in the app: your messages, its answers, the steps it ran and your ratings | While the workspace exists, or until you delete the chat. A deleted chat keeps only the steps it ran, what they cost and your thumbs up or down. After 90 days we keep the words and delete the data Amaware read to answer. |
| A file you add to Knowledge | The original is deleted as soon as it has been read. The text we extracted stays with the workspace. |
| Cover images | Public files on our storage. Removed within 30 days of the workspace being deleted or of your request. |
| An account with no workspace left | Deleted within 30 days of your request. |
| Free check requests, reports, how they were read and the emails of the people who read them | Until removed on request. The hidden workspace behind an unclaimed report goes after 60 days. |
| Demo requests, emails and support | While the conversation is live and for up to three years after, so we can pick it up again. |
| Call recordings, transcripts, notes and the meeting invite | Up to three years after the call, then deleted. |
| Outreach records | While the conversation matters to either side. Deleted within 30 days of a no. |
| People in our sales CRM, HubSpot | While the conversation matters to either side. Deleted within 30 days of your request, or of a no. |
| Billing records | Seven years, or as long as tax and accounting law requires. |
| Rate-limit counters | One to 31 days. |
| Crawler and bot visit logs on our sites, and the alerts our team receives | 180 days. |
| Recordings of how our pages and the app were used (the page, clicks, mouse and scrolling) | 90 days, then deleted. The IP address on a visit is removed after 30 days. The visit's summary (pages, time, a text timeline), the visitor id and the name or email we joined to it: one year, or until you ask. |
| Google Analytics | Up to 14 months, on Google's side. |
| Logs at our hosting provider | As Vercel keeps them, measured in days. |
We keep data longer when a law, a dispute or a legal hold requires it, and we may keep de-identified or aggregated data, from which nobody can be identified, for as long as it is useful.
13. Security
Traffic is encrypted in transit and data is encrypted at rest. The database enforces row-level access so a workspace can only be read by its members, and the browser never talks to the database directly. The tokens and passwords of the accounts you connect are sealed with a key held outside the database and opened only inside the code that uses them. Secrets live outside the code. Public forms are rate-limited and bot-checked. Every member of our team who can open a workspace does so read-only and every view is logged. We review the code for security before it ships, and we keep a list of every table and who may read it.
No service is perfectly secure, and we cannot promise that ours is. If we learn of a breach that affects you, we tell you promptly, and within the time the law gives, with what we know. Tell us at hello@amaware.ai if you find a weakness. We read every report.
14. Where it is stored
We are in the United States and our systems are there: the database and files in the United States, the hosting and the model providers in the United States, with content delivery at the edge nearest the visitor. The recordings, transcripts and notes of calls with our team sit in our Google Workspace, and Google stores those in its own data centers, some outside the United States. If you use the Service from outside the United States, your data is transferred to and processed in the United States, where privacy law differs from your own. For people in the European Economic Area, the United Kingdom and Switzerland, we rely on the European Commission's standard contractual clauses, the UK addendum and the Swiss amendments for those transfers, and on the processor terms in section 11 with our own providers. Ask us for a copy.
15. Your rights
Wherever you are, you can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, ask us to stop using it for marketing, or ask what we do with it. Email hello@amaware.ai. We may ask you to confirm you are who you say you are, usually by replying from the email on the account or the report, and we answer within 30 days, or tell you why we need longer. An authorized agent may ask for you with proof that you asked them to. We never treat you worse for exercising a right. If you disagree with our answer, reply and say so, and a different person reviews it within 45 days.
If you are in the European Economic Area, the United Kingdom or Switzerland
You have the rights of access, rectification, erasure, restriction, portability and objection under the GDPR and the UK GDPR, the right to withdraw consent where we rely on it, and the right to object at any time to processing based on our legitimate interests, including marketing, which we then stop unless we have compelling grounds. You may complain to your data protection authority, and we would rather hear from you first. We have not appointed a representative in the EU or the UK because we do not target those markets and the processing is occasional.
If you are in California
Under the California Consumer Privacy Act you have the right to know what we collect, use and disclose, to delete, to correct, to limit the use of sensitive personal information, to opt out of sale or sharing, and not to be discriminated against. In the past twelve months we collected these categories: identifiers such as name, email and a hashed IP; commercial information such as your plan and the reports you ran; internet activity such as the pages you read, how you read a report and how you used our pages (clicks, mouse movement and scrolling); rough location at the level of a city; professional information such as your title and company; and inferences a vendor draws about which business a visitor belongs to. We also collect audio, electronic and visual information, such as the recording and transcript of a call with us. We collected them from the sources in section 3, used them for the purposes in section 4, and disclosed them to the companies in section 6 for the purposes shown. We do not sell personal information for money. Allowing RB2B, Leadpipe and their partners to recognize you on amaware.ai may count as "sharing" or a "sale" under California law, and you can opt out by sending the Global Privacy Control signal, by the link in section 8, or by email. We do not knowingly sell or share the personal information of anyone under 16. We do not use sensitive personal information to infer characteristics about you.
If you are in Colorado, Virginia, Connecticut, Texas, Oregon or another US state with a privacy law
You have the rights to access, correct, delete and take your data, to opt out of targeted advertising, the sale of personal data and profiling with significant effects, and to appeal our decision. We honour the Global Privacy Control as an opt-out signal. The appeal is the review described above, and if it does not satisfy you, you may contact your state's Attorney General.
16. Children
The Service is for businesses and for adults. We do not knowingly collect personal data from anyone under 18, and we delete it if we learn we have.
17. Changes
We may update this policy. When a change matters, we email account owners before it takes effect and post the new version here with its date. Earlier versions are available on request.
18. Contact
Questions, requests and complaints go to hello@amaware.ai. A person at Amaware reads every email and writes back. Amaware is run by REmomentum LLC in Colorado, USA.