Privacy Policy

Effective September 9, 2026 · Version 1.5

How Amp collects, uses, and protects personal information, and the choices you have. Written in plain language and aligned with GDPR, UK GDPR, CCPA/CPRA, and PIPEDA.

1. Quick Summary

The short version:

Key Points

Amp is a service provider for employers. Most personal information in Amp belongs to our customer — the employer — and we process it on their instructions.
We also collect a small amount of personal information directly — about visitors to our website, sales contacts, operator accounts, and people applying for jobs at Amp.
We comply with GDPR, UK GDPR, CCPA/CPRA, PIPEDA, and other applicable privacy laws.
We do not sell personal information, and we do not “share” it for cross-context behavioural advertising.
We do not use customer data to train AI models. Our AI sub-processors contractually do not retain prompts for training.
We honour deletion and access requests within 30 days.
If you are a candidate of one of our customers, contact that employer directly to exercise your rights. For everything else, contact us at privacy@runamp.com.

2. Who We Are

Amp is the trading name of Q7 Systems, Inc. (doing business as “Amp”), based in Ontario, Canada. Amp provides an AI-powered platform that employers use to manage recruiting and hiring workflows. Our website is runamp.com.

Most of the personal information we handle belongs to our customers — the employers using Amp — and we process it on their behalf, on their documented instructions. The smaller set of personal information we hold ourselves (visitors to runamp.com, sales contacts, operator accounts, applicants for jobs at Amp, and vendor contacts) is the focus of much of this policy.

This policy does not cover third-party websites linked from our pages, or our customers’ own systems (such as the applicant tracking systems they use alongside Amp). If you are a candidate or employee whose data is processed in Amp by one of our customers, please also read your employer’s privacy notice — they are responsible for your data.

3. Information We Process

On behalf of our customers: identity and contact details, application and employment history, communications sent and received through the platform (including email and, where the customer has enabled it, text messages), mobile phone numbers and text-messaging consent records, calendar and scheduling data, files such as resumes and supporting documents, interaction records with our AI agents, and session metadata. We process this information only on the customer’s documented instructions, under our Data Processing Agreement with that customer.

Information we collect directly:

Website visitors — pages visited, referrer, approximate location, device and browser information, and anything you submit through our forms.
Sales prospects and business contacts — name, work email, phone, employer, role, and the history of our business relationship.
Operator users — authentication and account information, role, audit logs of administrative actions, and product telemetry needed to operate and secure the service.
Job applicants to Amp — application materials and information needed to evaluate the application.
Vendor and partner contacts — contact details and records of our business relationship.

4. Why We Process Personal Information

We process personal information to provide the Amp service to our customers; to authenticate, operate, secure, and improve our platform; to run our website and respond to inquiries; to conduct sales, marketing, and customer relationship management; to recruit our own employees; to comply with legal, tax, accounting, and audit obligations; and to establish, exercise, or defend legal claims.

For each purpose, we rely on an appropriate legal basis under applicable privacy law — typically the performance of a contract, our legitimate interests, a legal obligation, or your consent where required.

5. How AI Is Used

Amp is an AI-powered product. Our customers use it to read and summarise candidate materials, score against their own criteria, draft communications, and automate routine workflows.

A human at our customer is involved in any decision that meaningfully affects a candidate. Amp surfaces information and recommendations; the customer decides.
We do not use customer data to train foundation AI models. Our AI sub-processors are contractually configured so that prompts and outputs are not retained for training.
If you believe a decision was made about you based solely on automated processing, contact the employer to request human review.

6. Sub-Processors and Disclosures

We engage a small number of vetted sub-processors to operate Amp, including providers of cloud hosting, AI model inference, AI observability, communications delivery, and the calendar and ATS integrations that customers connect. Each is bound by contractual privacy and security obligations equivalent to our own.

A current list of sub-processors is available to customers and prospective customers on request at privacy@runamp.com.

We do not sell personal information, and we do not “share” personal information for cross-context behavioural advertising. We disclose personal information only when required by law, in response to valid legal process, to protect rights, property, or safety, or in connection with a business transfer — in which case the recipient will be bound by commitments equivalent to this policy.

7. Google User Data

When you connect your Google Calendar to Amp, we request access to your Google account email address (userinfo.email) and your calendar events (calendar.events). We use this access solely to provide interview scheduling — to identify the connected account, check your availability, and create or update interview events on your calendar. We do not access unrelated calendar content beyond what is needed for these purposes.

Amp’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell Google user data, do not use it for advertising, and do not use it to train generalized or AI/ML models. Google Calendar data and OAuth tokens are stored encrypted, used only to operate the scheduling feature, retained only while your calendar is connected, and deleted when you disconnect the calendar or on request.

8. Text Messages (SMS)

Where a customer enables text messaging, Amp sends hiring-related text messages to candidates on that customer’s behalf — interview invitations, confirmations, reminders, cancellation or reschedule notices, and privacy notifications. Every message identifies both Amp and the employer it is sent for, and says when a message is sent or answered by an AI agent rather than a person. We send these messages only to candidates who applied through the employer’s own job application, and each employer confirms to us that its application discloses this outreach and that consent is not a condition of applying for a job.

What we process: the candidate’s mobile phone number, the record of their agreement or opt-out (including its date and source), and the messages sent and received. As with other candidate information, we process this on the employer’s documented instructions.

Mobile information is used solely to deliver and respond to these messages. Mobile phone numbers and text-message content are not shared with third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent are not shared with any third parties. We disclose this information only to the vendors who deliver the messages — our communications platform provider and telephone carriers — consistent with Section 6.

To stop receiving texts, reply STOP — or QUIT, END, REVOKE, OPT OUT, CANCEL or UNSUBSCRIBE — to any message from that employer’s number; opting out of one employer’s messages does not affect another’s. Reply HELP for assistance, or contact help@runamp.com. Message frequency varies, and message and data rates may apply. Text-message records follow the retention rules in Section 9, except that we keep a record of an opt-out even if you ask us to delete your other information, so that we do not text you again. Full terms: our Text Message Terms.

9. How Long We Keep Personal Information

For information we process on behalf of customers, retention is governed by each customer’s organization-level retention policy, with industry-typical defaults applied automatically and adjustable by the customer. When data exceeds its retention window, it is automatically anonymized or deleted.

For information we hold as a controller, we retain personal information only as long as necessary for the purposes set out above, including any applicable legal, accounting, or reporting requirements.

10. International Data Transfers

Amp is operated from Ontario, Canada, and hosts production customer data in Microsoft Azure data centers in the United States (US East regions), with geo-redundant backups held within the United States. Our sub-processors are located in the United States. When personal information about individuals in the EU/EEA, the UK, or Switzerland is transferred to or processed in the United States, we rely on Standard Contractual Clauses (and their UK and Swiss equivalents, where applicable), incorporated into our customer and data-processing agreements, together with supplementary measures including encryption in transit and at rest, role-based access controls, and audit logging. For personal information about individuals in Canada, we apply equivalent contractual safeguards consistent with PIPEDA.

11. How We Protect Personal Information

We apply technical and organizational measures appropriate to the sensitivity of the data, including encryption in transit and at rest, role-based access controls with least-privilege defaults, single sign-on for operator users, audit logging, vendor due diligence on every sub-processor, and ongoing security testing.

We are pursuing SOC 2, and we will make the resulting report available to customers under NDA once issued.

No system can be guaranteed completely secure. If we become aware of a personal-data breach, we will notify affected customers and — where required by law — affected individuals and supervisory authorities without undue delay.

12. Your Rights

Depending on where you live, you may have the right to:

Access the personal information we hold about you and obtain a copy
Correct inaccurate or incomplete information
Delete your personal information, subject to legal exceptions
Restrict or object to certain processing
Receive your information in a portable format
Withdraw consent where consent is the legal basis
Not be subject to decisions made solely by automated processing that have legal or similarly significant effects
Lodge a complaint with your local supervisory authority

How to exercise these rights:

If you are a candidate, applicant, or employee whose data is processed in Amp by one of our customers, please contact that customer directly. They are responsible for your personal information, and we will support them in honouring your request within 30 days of receipt. We do not unilaterally act on data that belongs to our customers.

If your personal information is held by Amp directly (website visitor, sales prospect, operator user, applicant to Amp, or vendor), contact us at privacy@runamp.com. We will respond within 30 days of receiving a verified request. We may need to verify your identity before fulfilling a request and will only ask for the minimum information needed to do so.

You may authorize an agent to make a request on your behalf. We do not discriminate against anyone who exercises their privacy rights, and we do not charge a fee for most requests.

13. Cookies and Similar Technologies

We use a small number of cookies on runamp.com: a strictly necessary cookie that records your own consent choices, and an analytics cookie set only if you accept the statistics category. Our analytics services are Google Analytics 4 (Google LLC), PostHog (PostHog, Inc., hosted in the United States), and Ahrefs Analytics (Ahrefs Pte. Ltd.); each is loaded only per the consent choices you make in our cookie banner, and of the three only PostHog currently stores anything on your device. We separately use two measurements from Vercel, Inc., neither of which sets cookies or stores anything on your device, and neither of which is one of the categories you control in the cookie banner. Vercel Web Analytics counts page views in aggregate; it sends the page address and, when you arrive from another site, the referring page. Vercel Speed Insights measures how quickly pages load, how steady they are, and how quickly they respond when you tap or click — for example how long the biggest thing on the screen takes to appear, how much the layout moves while you are on the page, and how fast the page reacts to a tap. It sends those measurements with the page address, a description of the on-page element each one relates to — the element itself, never anything you type into it — and a general class for your network connection, such as “4g”. Both run on every page, and both make requests that carry the IP address and browser user-agent accompanying any web request. See our Cookie Policy for the full list of cookies and how to change your choices at any time. We do not use cookies for cross-site behavioural advertising. Where consent is required, we present a cookie banner and honour your choices, and we respect Global Privacy Control signals.

14. Children’s Data

The Amp service is not intended for use by children under 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, contact privacy@runamp.com and we will delete it.

15. Changes to This Policy

We will update this policy as our practices change. The effective date at the top indicates the most recent revision. For material changes, we will provide additional notice through the website, the product, or by email to customers, as appropriate. Prior versions are available on request.

16. Contact

For privacy questions, to exercise your rights, or to request our current list of sub-processors:

Privacy Officer

privacy@runamp.com

Where we are required to appoint an EU or UK representative under GDPR or UK GDPR, their contact details will be published here.