Who we are
Amabrik (amabrik.com) provides embeddable website widgets that site owners add to their own websites. Amabrik is operated by Vayalis (France, SIREN 987827649, Paris). Vayalis is the operator and acts as the data controller for the personal data described in this policy, except where we act as a processor on behalf of our customers (see Controller and processor roles).
This policy explains what personal data we collect, how we use it, the legal bases we rely on, who we share it with, and the rights you have. It is written to honor both the EU General Data Protection Regulation (GDPR) and applicable French data protection law.
What data we collect
Account data
When you create an Amabrik account we collect your email address, your name, and a password. The password is hashed (never stored in plain text) through Better Auth. You may optionally sign in with Google or GitHub instead of a password, and you may optionally enable two factor authentication. If you use social sign in, we receive basic profile details (such as your name and email) from that provider.
Billing data
Payments are handled by Stripe. Stripe processes your card details directly. Amabrik does not see or store full card numbers. We store only the identifiers Stripe gives us (customer and subscription identifiers) and your plan status.
Site and widget configuration
We store the configuration of your sites and widgets (settings, content, display rules, and similar) in a Turso (libSQL) database. If you connect a third party tool, we store the credentials needed to talk to it (such as an email provider API key or OAuth token). These integration credentials are encrypted at rest and are never exposed back to the browser.
Submissions captured by widgets
Widgets you embed can capture data from visitors of your site, for example an email address typed into a banner or a form submission. Amabrik does not retain these submissions. Each submission is forwarded to the tool you have connected (such as your email or CRM provider) and is held only transiently in memory for the moment needed to deliver it; it is not written to our database. The connected tool is where that data lives. For this end user data, you (the Amabrik customer) are the data controller and Amabrik acts as a data processor on your behalf. See Controller and processor roles.
Support data
When you contact us at contact@amabrik.com we receive your message and any details you choose to share, so we can respond and keep a record of the request.
How we use data
- To create and operate your account and authenticate you.
- To provide the service: store your sites and widgets, render them, and process submissions.
- To process payments, manage subscriptions, and prevent billing fraud.
- To forward widget submissions to the tools you choose to connect, without retaining them.
- To protect the service from abuse (for example rate limiting and spam prevention).
- To provide support and respond to your requests.
- To understand usage of our marketing site through aggregate analytics.
- To meet legal, accounting, and tax obligations.
Legal bases (GDPR)
We rely on the following legal bases for processing personal data:
- Performance of a contract. To create your account and provide the service you signed up for.
- Legitimate interests. To secure the service, prevent abuse and fraud, and understand aggregate site usage, balanced against your rights.
- Legal obligation. To keep billing and tax records and respond to lawful requests.
- Consent. Where required, for example analytics cookies on our marketing site. You can withdraw consent at any time.
Controller and processor roles
For your account, billing, and configuration data, Amabrik (Vayalis) is the data controller.
For submissions captured by your widgets (the personal data of your own site visitors), you are the data controller and Amabrik is the data processor. Our processing of that data is transient: we receive each submission, forward it to the tool you have connected, and discard it, following your instructions as expressed through your configuration. We do not retain a copy. You are responsible for having a lawful basis to collect that data and for giving your visitors the notices and choices the law requires.
Subprocessors
We use the following subprocessors to run Amabrik:
- Cloudflare. Workers, KV, CDN hosting, and edge configuration.
- Turso. Database for accounts and configuration. Widget submissions are not stored here.
- Vercel. Hosting for the dashboard application.
- Stripe. Payment processing.
- Resend. Transactional email, where used.
In addition, when you connect an email or CRM provider, that provider becomes a subprocessor for the submissions you choose to forward to it. The providers you can connect include Mailchimp, HubSpot, Google, Klaviyo, Brevo, MailerLite, ConvertKit, ActiveCampaign, Resend, and Loops. You choose which of these (if any) to connect.
Google user data
When you connect Google Sheets to Amabrik, we request only the Google Sheets and Drive file scopes needed to append your form submissions to the spreadsheet you choose. We do not request broad access to your Google account.
Amabrik's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, the Google data we access is used only to append submissions to the sheet you choose. We confirm that this data:
- is not sold to anyone;
- is not used for advertising;
- is not used to train generalized AI models; and
- is not used for any purpose other than appending your submissions to your chosen spreadsheet.
You can disconnect Google at any time from your Amabrik dashboard, and you can revoke Amabrik's access from your Google account permissions page.
Data retention
We keep account and configuration data for as long as your account is active. When you delete your account, we delete or anonymize the associated personal data, except where we must keep certain records (such as billing and tax records) to meet legal obligations. Widget submissions are not retained by Amabrik: they are forwarded to your connected tool and then discarded, so the connected tool is where they are kept and where you manage their retention.
Security
Passwords are hashed and never stored in plain text. Integration secrets (such as your email provider API keys and OAuth tokens) are encrypted at rest and are never exposed back to the browser. Data is transmitted over encrypted connections. The submit endpoint that receives widget submissions forwards them to your connected tool without retaining them; for abuse prevention it keeps only a hashed or truncated IP address, never the raw IP address, and we do not perform cross site tracking.
International transfers
Amabrik is operated from the EU, and our subprocessors may process data in other countries. Where personal data is transferred outside the European Economic Area, we rely on appropriate safeguards, such as adequacy decisions or the European Commission's Standard Contractual Clauses.
Your rights
Subject to applicable law, you have the right to access, correct, delete, and export your personal data, and to object to or restrict certain processing. You can delete your account and its data at any time. To exercise any of these rights, contact us at contact@amabrik.com. You also have the right to lodge a complaint with a supervisory authority (in France, the CNIL; in the EU, your local authority).
If you are a visitor of a site that uses an Amabrik widget and you want to exercise rights over a submission, please contact the operator of that site, who is the controller of that data. We will support them in responding to your request.
California privacy rights (CCPA and CPRA)
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you specific rights over your personal information. This section describes how those rights apply to Amabrik.
Categories of personal information we collect
- Identifiers, such as your name and email address, and account identifiers.
- Commercial information, such as your subscription plan, plan status, and the Stripe customer and subscription identifiers tied to your billing.
- Internet or network activity, such as aggregate usage of our marketing site and security signals like a hashed or truncated IP address used for abuse prevention.
- End user contact data submitted through widgets, such as an email address a visitor types into a banner or form. Amabrik does not retain this data: it is forwarded to the tool you have connected and then discarded.
We do not sell or share your personal information
Amabrik does not sell personal information and does not share personal information for cross context behavioral advertising, as those terms are defined under the CCPA and CPRA. We have not done so in the preceding twelve months. We do not use or disclose sensitive personal information for any purpose beyond providing the service you signed up for.
Your California rights
- Right to know what personal information we collect and how we use it.
- Right to access the personal information we hold about you.
- Right to delete your personal information, subject to legal exceptions.
- Right to correct inaccurate personal information.
- Right to opt out of the sale or sharing of personal information.
- Right to limit the use and disclosure of sensitive personal information.
- Right to non discrimination for exercising any of these rights.
How to exercise your rights
To exercise any of these rights, email us at contact@amabrik.com. We will verify your request before acting on it. You may use an authorized agent to submit a request on your behalf, in which case we may ask for proof that the agent is authorized and may still verify your identity directly.
Do Not Sell or Share My Personal Information
Because Amabrik does not sell or share personal information, there is no opt out action you need to take. If you still wish to send a request, contact us at contact@amabrik.com and we will honor it.
Other regional rights
Depending on where you live, your local privacy law may give you rights over your personal data. You can exercise any of the rights below by contacting us at contact@amabrik.com.
- United Kingdom. Under the UK GDPR you have rights similar to those under the EU GDPR, and you may complain to the Information Commissioner's Office (ICO).
- European Economic Area and Switzerland. Your GDPR and Swiss data protection rights are described in the sections above and under Your rights.
- Canada. Under PIPEDA you may access and correct your personal information and ask about how it is handled.
- Brazil. Under the LGPD you have rights to access, correct, delete, and obtain information about the processing of your personal data.
- Australia. Under the Privacy Act and the Australian Privacy Principles you may access and seek correction of your personal information.
Cookies
Our marketing site and dashboard use a small number of cookies, and the widgets we provide use first party browser storage on customer sites. For details, see our Cookie Policy.
Children
Amabrik is not directed to children and is not intended for anyone under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the date at the top of this page and, where appropriate, notify you. Your continued use of Amabrik after an update means you accept the revised policy.