Privacy Policy

Effective October 30, 2026 · Version 1.13

How Amp collects, uses, and protects personal information, and the choices you have. Written in plain language and aligned with GDPR, UK GDPR, CCPA/CPRA, and PIPEDA.

1. Quick Summary

The short version:

Key Points

Amp is a service provider for employers. Most personal information in Amp belongs to our customer — the employer — and we process it on their instructions.
We also collect a small amount of personal information directly — about visitors to our website, sales contacts, operator accounts, and people applying for jobs at Amp.
We comply with GDPR, UK GDPR, CCPA/CPRA, PIPEDA, and other applicable privacy laws.
We do not sell personal information, and we do not “share” it for cross-context behavioural advertising.
We do not use customer data to train AI models. Our AI sub-processors contractually do not retain prompts for training.
We honour deletion and access requests within 30 days.
If you are a candidate of one of our customers, contact that employer directly to exercise your rights. For everything else, contact us at privacy@runamp.com.

2. Who We Are

Amp is the trading name of Q7 Systems, Inc. (doing business as “Amp”), based in Ontario, Canada. Amp provides an AI-powered platform that employers use to manage recruiting and hiring workflows. Our website is runamp.com.

Most of the personal information we handle belongs to our customers — the employers using Amp — and we process it on their behalf, on their documented instructions. The smaller set of personal information we hold ourselves (visitors to runamp.com, sales contacts, operator accounts, applicants for jobs at Amp, and vendor contacts) is the focus of much of this policy.

This policy does not cover third-party websites linked from our pages, or our customers’ own systems (such as the applicant tracking systems they use alongside Amp). If you are a candidate or employee whose data is processed in Amp by one of our customers, please also read your employer’s privacy notice — they are responsible for your data.

3. Information We Process

On behalf of our customers: identity and contact details, application and employment history, communications sent and received through the platform (including email and, where the customer has enabled it, text messages), mobile phone numbers and text-messaging consent records, calendar and scheduling data, recordings and transcripts of interviews and hiring-manager calls, files such as resumes and supporting documents, interaction records with our AI agents, and session metadata. We process this information only on the customer’s documented instructions, under our Data Processing Agreement with that customer.

Information we collect directly:

Website visitors — pages visited, referrer, approximate location, device and browser information, and anything you submit through our forms.
Sales prospects and business contacts — name, work email, phone, employer, role, and the history of our business relationship.
Operator users — authentication and account information, role, audit logs of administrative actions, and product telemetry needed to operate and secure the service.
Job applicants to Amp — application materials and information needed to evaluate the application.
Vendor and partner contacts — contact details and records of our business relationship.

4. Why We Process Personal Information

We process personal information to provide the Amp service to our customers; to authenticate, operate, secure, and improve our platform; to run our website and respond to inquiries; to conduct sales, marketing, and customer relationship management; to recruit our own employees; to comply with legal, tax, accounting, and audit obligations; and to establish, exercise, or defend legal claims. Google user data is the exception: we use it only as described in Section 7, and never for sales, marketing, or recruiting for Amp.

For each purpose, we rely on an appropriate legal basis under applicable privacy law — typically the performance of a contract, our legitimate interests, a legal obligation, or your consent where required.

5. How AI Is Used

Amp is an AI-powered product. Our customers use it to read and summarise candidate materials and recorded interviews, score against their own criteria, draft communications, and automate routine workflows.

A human at our customer is involved in any decision that meaningfully affects a candidate. Amp surfaces information and recommendations; the customer decides.
We do not use customer data to train foundation AI models. Our AI sub-processors are contractually configured so that prompts and outputs are not retained for training.
If you believe a decision was made about you based solely on automated processing, contact the employer to request human review.

6. Sub-Processors and Disclosures

We engage a small number of vetted sub-processors to operate Amp, including providers of cloud hosting, AI model inference, AI observability, communications delivery, and the calendar and ATS integrations that customers connect. Each is bound by contractual privacy and security obligations equivalent to our own.

A current list of sub-processors is available to customers and prospective customers on request at privacy@runamp.com.

We do not sell personal information, and we do not “share” personal information for cross-context behavioral advertising. We disclose personal information only when required by law, in response to valid legal process, to protect rights, property, or safety, or in connection with a business transfer, in which case the recipient will be bound by commitments equivalent to this policy. These disclosures do not apply to Google user data, which we disclose only as Section 7 allows.

7. Google User Data

When you connect your Google Calendar to Amp, we request access to your Google account email address (userinfo.email) and your calendar events (calendar.events). We use this access solely to provide interview scheduling — to identify the connected account, check your availability, and create, update, or cancel interview events on your calendar. We do not access unrelated calendar content beyond what is needed for these purposes.

Amp’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Limited Use. We use Google user data only to provide and improve the scheduling features you see in Amp. We do not use it for any other purpose, including sales, marketing, advertising, or recruiting for Amp itself, and we do not use it to create, train, or improve generalized AI/ML models. We transfer it to others only to provide or improve those features with your consent (for example, to our AI model provider when you ask Amp’s assistant to schedule, as described below), for security purposes, to comply with applicable law, or as part of a merger, acquisition, or sale of Amp’s assets after obtaining your explicit prior consent. We never sell or transfer it to advertising platforms, data brokers, or information resellers, and never use it for advertising or to decide credit-worthiness or lending. People at Amp do not read it unless you have agreed to let us view specific data, it is necessary for security purposes (for example, investigating a bug or abuse), it is required to comply with law, or it has been aggregated and anonymized for internal operations.

How AI interacts with Google user data. When you ask Amp’s assistant to schedule an interview, Amp works out open times from your calendar, and from the calendars of any panel interviewers who have connected theirs. It passes only the proposed times (start and end), which of any times you suggest yourself are already booked, and whether each calendar could be checked, to our AI model provider, so the assistant can show them to you for approval before anything is sent. Amp reads the titles of events on your calendar only to recognize interview-block holds you have set, and never sends event titles, descriptions, or attendee lists to any AI model. Google user data is never used, by us or by our providers, to create, train, or improve generalized or foundational AI/ML models.

We do not sell Google user data or use it for advertising. Amp does not store the calendar events it reads. OAuth tokens are stored encrypted, and they and the connected account’s email address are used only to operate the scheduling feature, retained only while your calendar is connected, and deleted when you disconnect the calendar or on request. The interview times Amp proposes and books become part of the interview record and follow your organization’s retention settings.

8. Zoom User Data

When someone on an employer’s hiring team connects their Zoom account to Amp, we request access to that account’s identity — the email address and the id of that Zoom user (user:read:user) — and to meetings on that account (meeting:write:meeting, meeting:update:meeting, meeting:delete:meeting). We use the identity to show which Zoom account is connected and to recognize it if the app is later removed from Zoom. We use the meetings access solely to run the calls Amp books: to create the Zoom meeting for an interview, or for a hiring-team call such as a briefing with a hiring manager, to update it when the call is rescheduled, and to delete it when the call is canceled. We do not use this access to read, change, or delete anything else in the account, or any meeting Amp did not create.

Everyone who connects a Zoom account also grants Amp permission to mint a meeting pass on that account (user:read:token), because Zoom grants the app’s whole set of permissions at once. Amp uses that permission only where its notetaker is available for Zoom calls and the employer has the notetaker turned on. At the moment the notetaker joins a call, Amp creates a short-lived, single-use pass that admits it to that one meeting. A recruiter can send the notetaker to a call Amp booked, or to one they paste a link to, including a meeting they created in Zoom themselves. Amp’s own notetaker service uses that pass only to join that meeting, and it never receives the Zoom access or refresh token. What the notetaker records, who it asks before recording, how long a recording is kept, and Amp’s AI writing notes from the transcript are covered in Section 10.

OAuth tokens are stored encrypted, and they and the connected account’s email address and user id are used only to operate this integration and retained only while the account is connected. They are deleted when the person disconnects Zoom in Amp, and Amp asks Zoom to revoke the connection at the same time. Removing the Amp app from your Zoom account has the same effect: Zoom notifies Amp and the connection is removed. Zoom user data is never used, by us or by our providers, to create, train, or improve generalized or foundational AI/ML models. We do not sell Zoom user data or use it for advertising.

9. Text Messages (SMS)

Where a customer enables text messaging, Amp sends hiring-related text messages to candidates on that customer’s behalf — interview invitations, confirmations, reminders, cancellation or reschedule notices, and privacy notifications. Every message identifies both Amp and the employer it is sent for, and says when a message is sent or answered by an AI agent rather than a person. We send these messages only to candidates who applied through the employer’s own job application, and each employer confirms to us that its application discloses this outreach and that consent is not a condition of applying for a job.

What we process: the candidate’s mobile phone number, the record of their agreement or opt-out (including its date and source), and the messages sent and received. As with other candidate information, we process this on the employer’s documented instructions.

Mobile information is used solely to deliver and respond to these messages. Mobile phone numbers and text-message content are not shared with third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent are not shared with any third parties. We disclose this information only to the vendors who deliver the messages — our communications platform provider and telephone carriers — consistent with Section 6.

To stop receiving texts, reply STOP — or QUIT, END, REVOKE, OPT OUT, CANCEL or UNSUBSCRIBE — to any message from that employer’s number; opting out of one employer’s messages does not affect another’s. Reply HELP for assistance, or contact help@runamp.com. Message frequency varies, and message and data rates may apply. Text-message records follow the retention rules in Section 11, except that we keep a record of an opt-out even if you ask us to delete your other information, so that we do not text you again. Full terms: our Text Message Terms.

10. Interview Recordings

Amp records interviews for an employer only when its hiring team chooses to and the candidate agrees. For video interviews, Amp’s notetaker asks in the meeting chat and records only if the candidate and any other guests agree; anyone can type STOP to end it. If a video interview isn’t recorded, we keep only the notetaker’s request and each person’s reply, as a record of their answer. For in-person interviews recorded on the recruiter’s phone, the recruiter asks aloud first, and the recording is deleted if the candidate declines. We keep the recording, a transcript, any meeting chat, and a record of the agreement. The same agreement covers Amp’s AI using the transcript to write notes for the hiring team, including how the answers relate to the job; Amp’s AI works only from the audio, and the hiring team makes the decisions (Section 5). Recordings and transcripts follow the employer’s retention setting for recordings, one year by default; the notes follow its setting for candidate records (Section 11). To ask for deletion or a copy, contact the employer (Section 14). Video interview recording notice. Amp can also record calls between the employer’s own staff, such as a briefing with a hiring manager, and write notes from them; the recordings and transcripts follow the employer’s retention setting for recordings, and the notes are kept with the job and deleted with it.

11. How Long We Keep Personal Information

For information we process on behalf of customers, retention is governed by each customer’s organization-level retention policy, with industry-typical defaults applied automatically and adjustable by the customer. When data exceeds its retention window, it is automatically anonymized or deleted.

For information we hold as a controller, we retain personal information only as long as necessary for the purposes set out above, including any applicable legal, accounting, or reporting requirements.

12. International Data Transfers

Amp is operated from Ontario, Canada, and hosts production customer data in Microsoft Azure data centers in the United States (US East regions), with geo-redundant backups held within the United States. Our sub-processors are located in the United States. When personal information about individuals in the EU/EEA, the UK, or Switzerland is transferred to or processed in the United States, we rely on Standard Contractual Clauses (and their UK and Swiss equivalents, where applicable), incorporated into our customer and data-processing agreements, together with supplementary measures including encryption in transit and at rest, role-based access controls, and audit logging. For personal information about individuals in Canada, we apply equivalent contractual safeguards consistent with PIPEDA.

13. How We Protect Personal Information

We apply technical and organizational measures appropriate to the sensitivity of the data, including encryption in transit and at rest, role-based access controls with least-privilege defaults, single sign-on for operator users, audit logging, vendor due diligence on every sub-processor, and ongoing security testing.

Amp holds a SOC 2 Type 2 report covering Security, Availability, and Confidentiality. Customers can request it from the Trust Center.

No system can be guaranteed completely secure. If we become aware of a personal-data breach, we will notify affected customers and — where required by law — affected individuals and supervisory authorities without undue delay.

14. Your Rights

Depending on where you live, you may have the right to:

Access the personal information we hold about you and obtain a copy
Correct inaccurate or incomplete information
Delete your personal information, subject to legal exceptions
Restrict or object to certain processing
Receive your information in a portable format
Withdraw consent where consent is the legal basis
Not be subject to decisions made solely by automated processing that have legal or similarly significant effects
Lodge a complaint with your local supervisory authority

How to exercise these rights:

If you are a candidate, applicant, or employee whose data is processed in Amp by one of our customers, please contact that customer directly. They are responsible for your personal information, and we will support them in honouring your request within 30 days of receipt. We do not unilaterally act on data that belongs to our customers.

If your personal information is held by Amp directly (website visitor, sales prospect, operator user, applicant to Amp, or vendor), contact us at privacy@runamp.com. We will respond within 30 days of receiving a verified request. We may need to verify your identity before fulfilling a request and will only ask for the minimum information needed to do so.

You may authorize an agent to make a request on your behalf. We do not discriminate against anyone who exercises their privacy rights, and we do not charge a fee for most requests.

15. Cookies and Similar Technologies

Cookies on runamp.com

We use a small number of cookies on runamp.com: a strictly necessary cookie that records your own consent choices, and analytics cookies set only if you accept the statistics category. Our analytics services are Google Analytics 4 (Google LLC), PostHog (PostHog, Inc., hosted in the United States), and Ahrefs Analytics (Ahrefs Pte. Ltd.); each is loaded only per the consent choices you make in our cookie banner, and of the three, PostHog and Google Analytics store cookies on your device; Ahrefs Analytics stores nothing. We separately use two measurements from Vercel, Inc., neither of which sets cookies or stores anything on your device, and neither of which is one of the categories you control in the cookie banner. Vercel Web Analytics counts page views in aggregate; it sends the page address and, when you arrive from another site, the referring page. Vercel Speed Insights measures how quickly pages load, how steady they are, and how quickly they respond when you tap or click — for example how long the biggest thing on the screen takes to appear, how much the layout moves while you are on the page, and how fast the page reacts to a tap. It sends those measurements with the page address, a description of the on-page element each one relates to — the element itself, never anything you type into it — and a general class for your network connection, such as “4g”. Both run on every page, and both make requests that carry the IP address and browser user-agent accompanying any web request. See our Cookie Policy for the full list of cookies and how to change your choices at any time. We do not use cookies for cross-site behavioural advertising. Where consent is required, we present a cookie banner and honour your choices, and we respect Global Privacy Control signals.

Cookies in the Amp application

The sign-in and sign-up pages store nothing on your device other than the load-balancing cookie described below, with one exception: if you sign in through your company’s single sign-on, we briefly write a cookie to check your browser will keep one, and delete it straight away. Without that check, sign-in would fail with no explanation.

We do measure how those pages are used, through PostHog, Inc. in the United States. Nothing is kept on your device to do it, so no identifier follows you between visits. PostHog receives the address of the page you are on, plus the network address (IP) and browser identification that accompany any web request. We do not record your screen before you sign in.

Cookies the application needs. 3 cookies keep the application working. One keeps you signed in. One stops another site forging requests against your account. One keeps your session on a single server so pages load consistently. Two are deleted when you close your browser. The sign-in cookie lasts 7 days, or 24 hours if your company uses single sign-on. You cannot turn these off. Without them you cannot sign in, and we cannot keep your account safe while you are.

What we measure once you are signed in. We count how features are used, and we record sessions in the product so we can see where something went wrong. Candidate names, contact details and application content are hidden before anything leaves your browser. This uses one cookie from PostHog, named ph_phc_…_posthog, which lasts 365 days. PostHog also keeps the same identifier and a few session markers in your browser’s own storage. Our pages load fonts from Google, which means Google receives your network address each time.

Your choices. Session recording is off until you allow it. We ask once, and you can change your mind at any time from the privacy choices in your account. Product analytics is on by default and can be switched off in the same place. The cookies above are not affected, because the product needs them to work.

If your browser blocks cookies. You will not be able to sign in. The sign-in cookie is how the application knows it is still you between pages.

16. Children’s Data

The Amp service is not intended for use by children under 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, contact privacy@runamp.com and we will delete it.

17. Changes to This Policy

We will update this policy as our practices change. The effective date at the top indicates the most recent revision. For material changes, we will provide additional notice through the website, the product, or by email to customers, as appropriate. Prior versions are available on request.

18. Contact

For privacy questions, to exercise your rights, or to request our current list of sub-processors:

Privacy Officer

privacy@runamp.com

Where we are required to appoint an EU or UK representative under GDPR or UK GDPR, their contact details will be published here.