Privacy policy

1.Who this policy covers

This policy explains how Amplify ("we", "us") handles personal information on this website and in the Amplify employee benefit program.

It applies to visitors to this website, to employees who enroll in Amplify through their employer, and to people at employers we are speaking with. It does not apply to any third party site we link to, or to your employer’s own handling of your information, which is governed by their policies.

You can reach us about anything in this policy at info@amplifybenefit.com, or by post at 26 Washington Street, Floor 3, Morristown, NJ 07960.

2.What is live today, and what is not

Amplify has not launched. Today the only personal information we handle is what you choose to send us through the contact form on this website, what our servers record automatically when you load a page, and the anonymous visit statistics described in section 12.

The sections below that describe the card, the account and the benefit describe how the program will work once it launches. They take effect for you when you enroll, not before. We will not start applying a materially different practice to information we have already collected without telling you first and, where the law requires it, asking you.

We say this plainly because a privacy policy that describes a system nobody has built yet, without saying so, is not accurate.

3.Information we collect

Information you give us. The contact form on this site asks for your name and email address, and optionally your organization, your role, the size of your company and a message. You choose what to put in it. When the program launches, enrollment will also require the information needed to open an account and verify your identity, which federal law requires of financial accounts: legal name, residential address, date of birth, a government identification number and a phone number.

Information from your employer. If your employer offers Amplify, we receive what is needed to confirm you are eligible and to administer the benefit: your name, work email, employment status, your enrollment election and, where the employer runs contributions through payroll, the amount.

Information created when you use the card. Load amounts and dates, transaction amounts and dates, the merchant and its category, whether a transaction was approved or declined and why, your balance, and the benefit earned.

We do not store your card number. The full card number is held by the card issuer and its processor. Amplify works with a token that stands in for it and never receives, stores or transmits the number itself.

Information from service providers. Identity verification and fraud services, the issuing bank, and the card network return results to us: whether identity was confirmed, risk signals, and transaction data.

Information collected automatically on this website. The servers that host this site record the standard request log: IP address, browser user agent, the page requested, the referring page and a timestamp. We also measure visits with Umami, an analytics tool we host ourselves: it records which pages are viewed, the referring site, the browser, device type, operating system, screen size and language, and an approximate location (country, region and city) worked out from the IP address. It does not set cookies, does not store your IP address, and does not follow you to other websites. When you send the contact form, it also records the page you arrived on, the site that referred you and any campaign tags in the link, so we know how you found us.

As of the date of this policy this site sets no cookies, writes nothing to browser storage, and runs no advertising or third party tracking tags. The fonts and images come from our own servers. If any of that changes we will update this section before the change goes live.

4.Why we use it

We use personal information to:

• run the program: open and maintain your account, apply loads, and calculate and post the benefit;
• decide in real time whether a purchase is authorized, which requires checking the merchant and its category against the program rules;
• verify identity and prevent fraud, money laundering and abuse;
• meet legal obligations, including identity verification, sanctions screening, tax reporting and record retention;
• answer your questions and provide support;
• send you service messages about your account, and, only if you ask for them, updates about the program;
• understand how the program is used in aggregate so we can improve it;
• establish, exercise or defend legal claims, and enforce our terms.

We do not use your information to build advertising profiles, and we do not use automated decision making that produces legal or similarly significant effects about you, other than the automated approve or decline decision on a card transaction, which is based on the merchant and category rules and on your available balance.

5.Who we share it with

Service providers. Companies that do work for us under contract, limited to what they need to do that work and barred from using it for anything else: the issuing bank and its processor, identity verification and fraud vendors, cloud hosting, customer support tooling, email delivery, and professional advisers.

Your employer. Your employer receives what it needs to administer the benefit and its own payroll: whether you enrolled, your election, and any payroll amount. Your employer does not receive your transaction history, the merchants you shop at, or your balances. Anything we report to an employer about program usage is aggregated across their enrolled employees and is not attributable to an individual.

The issuing bank, the card network and merchants. Processing a card transaction necessarily sends information to the bank that issued the card, to the card network, and to the merchant and its own processor.

Legal and safety. We disclose information where the law requires it, in response to lawful requests from public authorities, and where we reasonably believe it is necessary to investigate fraud or to protect the rights, property or safety of any person.

Business transfers. If Amplify is involved in a merger, acquisition, financing or sale of assets, information may transfer as part of that transaction. We will require the recipient to honor this policy or give you notice and a choice.

At your direction. Anywhere else you ask us to send it.

The contact form on this website sends your submission to our own intake service, which stores it and passes it to the tools we use to manage enquiries: our customer relationship management system and Google Workspace (a spreadsheet of enquiries and email to our team). Google acts as our service provider for this and does not use the content for its own purposes.

6.We do not sell your information

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by California and other state privacy laws. We have not done so in the twelve months before the date of this policy. We do not use or disclose sensitive personal information for purposes other than those permitted without a right to limit.

7.Financial privacy

Once the program launches, most of what we hold about an enrolled employee will be nonpublic personal information under the Gramm-Leach-Bliley Act. You will receive a separate financial privacy notice at enrollment, and annually where required, describing what is collected, who it is shared with, and any right you have to opt out of certain sharing. That notice governs where it differs from this one.

Information covered by the Gramm-Leach-Bliley Act is exempt from some state privacy laws, including parts of the California Consumer Privacy Act. Where that exemption applies, the rights in section 10 may not. It does not affect information collected through this website.

8.How long we keep it

We keep personal information for as long as we need it for the purposes in section 4, and then for as long as we are required to keep it. Financial records are typically subject to a retention period of at least five years after an account closes. Contact form submissions are kept for as long as we are in contact with you about the program and then deleted.

The schedule we follow:

• Contact form submissions and sales conversations: for as long as we are in discussion with you or your organization, then deleted within 24 months of our last contact, unless you become a customer.
• Marketing contact preferences: until you unsubscribe. After that we keep only your email address on a suppression list, so we do not contact you again.
• Website request logs: up to 90 days, unless needed longer to investigate a security incident.
• Website visit statistics: kept in aggregate; they contain no IP address or cookie identifier.
• Account, card and transaction records (once the program launches): for the life of the account and at least five years after it closes, as federal recordkeeping rules for financial accounts require.
• Identity verification records: five years after the account closes, as the federal Customer Identification Program rule requires.
• Tax records: seven years after the tax year they relate to.
• Support conversations: three years after the conversation ends.

Where a law, a legal hold or an open dispute requires us to keep something longer, we keep it for as long as that requires and then delete it. Deleted information may remain in backups for up to 30 days before it is overwritten.

9.How we protect it

We apply administrative, technical and physical safeguards appropriate to the sensitivity of the information, restrict access to people who need it to do their job, and require our service providers to do the same by contract.

In particular:

• Encryption. This website and our services use encrypted connections (TLS 1.2 or later). Once the program launches, account and transaction information will also be encrypted at rest.
• Card numbers. We never receive, store or transmit your full card number (section 3). It stays with the issuing bank and its processor, which are subject to the card industry's data security standard.
• Access. Access to personal information is limited to the people who need it for their role. Access to program systems will require multi-factor authentication and will be logged.
• Monitoring and testing. We monitor our systems for unusual activity, keep software up to date, and have the program tested by independent security specialists before enrollment opens and regularly after.
• Service providers. We assess the security of providers that handle personal information before we use them, and bind them by contract to protect it.
• Incidents. We maintain an incident response plan. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires.

No method of transmission or storage is completely secure, and we do not claim otherwise. If you think you have found a security issue, email info@amplifybenefit.com.

10.Your choices and your rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you and get a copy of it;
• correct information that is wrong;
• delete information, subject to the records we are required to keep;
• receive it in a portable format;
• opt out of sale, of sharing for cross-context behavioral advertising, and of profiling with legal or similarly significant effects (we do none of these, so there is nothing to opt out of);
• limit the use of sensitive personal information;
• appeal a decision we make about a request;
• not be discriminated against for exercising any of these rights.

To exercise any of them, email info@amplifybenefit.com. We will ask for enough information to confirm who you are, which for an account holder means matching what we already hold rather than asking for anything new. An authorized agent may submit a request with written permission from you. We respond within 45 days and will tell you if we need a further 45. If we decline, we will say why, and you may appeal by replying to our response.

California residents may also request the categories of personal information disclosed to third parties for their direct marketing purposes under California Civil Code section 1798.83. We do not disclose information for that purpose.

Nevada residents may submit a request not to sell covered information. We do not sell it.

This policy covers United States residents. Amplify is not offered outside the United States, and we do not target this website to people in the European Economic Area or the United Kingdom.

11.Children

Amplify is an employment benefit and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, email info@amplifybenefit.com and we will delete it.

12.Cookies and tracking

This website sets no cookies and uses no advertising or cross-site tracking technology. The only measurement is the self-hosted, cookieless visit statistics described in section 3, which do not identify you or follow you to other sites.

If your browser sends a Do Not Track signal, your visit is not recorded in those statistics. Because we do not sell or share personal information for advertising, a Global Privacy Control signal has nothing further to opt you out of, and we treat it as a request not to do so.

If we ever add a cookie or an analytics tool, this section will say so before it goes live, and we will provide whatever controls the law requires.

13.Changes to this policy

We will post any change on this page and update the date at the top. If a change materially affects how we use information we already hold, we will give notice by email to enrolled employees before it takes effect.

14.How to reach us

Email info@amplifybenefit.com, or write to Amplify at 26 Washington Street, Floor 3, Morristown, NJ 07960.