Privacy

Privacy Policy

Last updated: 2 November 2026 · Version 1.0

AffiliateManagersAI Ltd is being incorporated in Cyprus. Until incorporation and opening of its bank account AMAI does not take any payments.

This is the full English version of this Policy. The English version is the binding version. Русская версия выше.

1. Who is responsible

1.1 The controller of the personal data described in this Policy is AffiliateManagersAI Ltd, a private company being incorporated in the Republic of Cyprus, trading as AMAI, Limassol, Cyprus. Its registration number and registered office will be added to this page on incorporation. Until the company is incorporated, the founders of AMAI, Artem Tytarenko and Mark Vlasov, act on its behalf.

1.2 For all privacy matters write to amai@amai.team (subject: Privacy).

1.3 AMAI has not appointed a Data Protection Officer. Privacy questions are handled by the founders at the address above.

1.4 AMAI is established in the European Union (Cyprus), so it does not need a representative under Article 27 GDPR.

2. What this Policy covers

2.1 This Policy explains how AMAI processes personal data as a controller when you:

• visit amai.team (the "Website") and use its forms;
• use the AMAI web app as an account holder or as a user invited by a customer (a "Customer User");
• are a billing contact, a prospective customer or a business contact of AMAI;
• contact us, including to exercise your rights or to report illegal content.

2.2 AMAI is a business-to-business service for affiliate managers and teams in iGaming: a web app for managers and a Telegram Mini App, the Partner Hub, for their partners. Our customers are businesses, including independent managers acting as a business. AMAI does not offer or process gambling, bets or player payments and never contacts players.

2.3 This Policy does not cover:

• Partner data that customers manage in AMAI. When a customer uses AMAI to manage its partners, leads and conversations, the customer is the controller and AMAI processes the data on its behalf under the DPA. If you are a partner or prospective partner of a customer, please read that customer's privacy notice and our Partner Notice.
• The Partner Hub. It has its own Partner Hub Privacy Policy.
• Third-party services you use together with AMAI, such as Telegram, which process data under their own policies.

3. Website: hosting and forms

3.1 Hosting. The Website is hosted by Netlify (United States). When you open a page, Netlify processes technical data of the request, such as your IP address, browser type and the page requested, to deliver the Website and protect it. Legal basis: our legitimate interest in operating a secure website (Article 6(1)(f) GDPR).

3.2 Forms. The demo booking form, partnership and contact requests, the waitlist and Founders Club requests are processed with Netlify Forms. Depending on the form, we receive: your name; your contact (Telegram handle or email); your company; the role you chose on the site (solo manager, manager in a team or team lead); team size; the chosen plan and billing period (Founders Club and waitlist); the chosen call time; the topic or your message; the page language; the part of the page you used; the referrer and UTM tag (waitlist); the page address and the time of sending. Netlify stores the request, filters spam and may record technical data of the request, such as your IP address and browser type. Requests reach us by email in our Google Workspace mailbox. If you gave us a Telegram handle, we may reply to you there.

3.3 Why and on what basis. To reply to you, run the demo, reserve a Founders Club place and prepare an offer. Legal bases: steps taken at your request before a possible contract (Article 6(1)(b) GDPR) and our legitimate interest in answering inbound requests (Article 6(1)(f)). We do not send newsletters without your consent.

3.4 Spam protection. The Website accepts no more than 3 requests an hour from one browser. To apply this limit it keeps the times of your requests in your browser (section 5). They are not sent to us.

4. Website analytics, only with your consent

4.1 To understand which parts of the Website are useful, we use PostHog in the PostHog EU cloud, but only if you click "Accept" in the analytics banner. Without your consent PostHog is not loaded at all.

4.2 After you accept, the Website loads the PostHog script from eu-assets.i.posthog.com and sends data to eu.i.posthog.com. PostHog records: page views and leaving a page; clicks and other interactions on the page (autocapture); heatmaps; session recordings, in which all input fields are masked; site events such as the role you chose, the sections you opened and page loading speed; your device type (mobile, tablet or desktop) and the page language. As with any web request, PostHog receives technical data such as your IP address and browser type.

4.3 PostHog runs with in-memory persistence: it sets no cookies and stores nothing in your browser. Its identifier lives only in the open page, so visits are not linked once you close the tab.

4.4 Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time with the button below; withdrawal does not affect processing before it. Your choice is stored in your browser under the key amai_analytics_consent. If the site is open in another tab, analytics stops there too.

4.5 There are no advertising trackers on the Website, and Google Analytics is not used.

5. What the Website stores in your browser

5.1 The Website itself sets no cookies. It uses your browser's local storage (localStorage) and session storage (sessionStorage) only for the entries below. This data stays on your device; we do not receive it.

5.2 Local storage entries stay until you clear the site data in your browser. The session storage entry is deleted when you close the tab.

5.3 Other resources. The Website loads its fonts, images and scripts from amai.team. The only third-party resources are PostHog's, and only after you accept analytics. Links to Telegram, LinkedIn and Google Calendar (to add a booked call to your calendar) open those services only when you click them. Those services then process data under their own policies.

6. AMAI platform users

6.1 Data:

• account data: name, work email, role, company and workspace, language, time zone, user ID, authentication data and session records;
• Telegram connection data, if you connect your own Telegram account: your Telegram account ID, username and display name, the phone number used to log in to Telegram, the API ID and API hash you enter, and the authorised session that Telegram issues, which we store encrypted;
• activity and audit data: actions you take in the Service (for example approving and sending a message, changing the control mode of a partner room, exporting or erasing data), with time stamps;
• AI usage data: which AI features you used and how much, to apply fair-use safeguards;
• support data: your communications with us.

6.2 Purposes and legal bases:

• to create and administer your account, authenticate you and provide the Service: contract, where you are our contracting party (for example an independent affiliate manager); legitimate interest of AMAI and the customer, where you use the Service as an employee or contractor of a customer;
• to operate the Telegram connection as you and your organisation configure it (sending messages you approve or that are sent within your organisation's policy, and showing conversations with partners and leads): contract or legitimate interest as above. We do not use your Telegram account for any other purpose, and you can disconnect it at any time;
• to keep the Service secure, prevent fraud, spam and misuse, enforce daily limits and our Acceptable Use Policy, and protect users' Telegram accounts from restrictions: legitimate interest;
• to keep an audit trail of key actions: legitimate interest in accountability and in establishing facts in a dispute;
• to send service messages (security alerts, changes to terms, invoices, outage notices): contract and legitimate interest;
• to improve the Service using aggregated, de-identified usage statistics that do not contain message content: legitimate interest;
• to comply with the law and respond to lawful requests from authorities: legal obligation.

6.3 You need to provide your name, work email and company to open an account. Other data is optional unless a feature you choose requires it (for example, the Telegram connection requires your Telegram login).

6.4 We do not ask for special categories of personal data or data about criminal convictions; please do not enter them in the Service. The Service must not be used to process data about players.

7. Billing, business contacts and requests

7.1 Billing contacts (once payments start): name, billing email, company name, address, VAT or tax number, invoices, payment status and payment history. Card details are collected and processed by the payment provider named at checkout; AMAI does not store full card numbers. Legal bases: contract and legal obligation (accounting and tax).

7.2 Prospective customers and business contacts: name, employer, role, work email or phone, professional profile URL, Telegram handle where you gave it to us for business contact, and notes of our conversations. Sources: you (for example at a conference, in a meeting or via a form); colleagues or business partners who refer you; event organisers that share attendee lists with your agreement; and professional networks where you present yourself in a business capacity. Legal basis: legitimate interest in developing our business with professional counterparts. Before we send electronic direct marketing to an individual, we obtain consent where the law requires it (including Article 13 of Directive 2002/58/EC as implemented in Cyprus by Law 112(I)/2004), and we do not send messages that merely ask for consent. Every marketing message identifies AMAI and lets you opt out free of charge. If we obtained your data from someone other than you, we tell you within one month, or at the latest in our first communication with you (Article 14 GDPR).

7.3 People who contact us: your contact details, the content of your request and our reply, to answer questions and to handle privacy requests, abuse reports and notices under the Digital Services Act. Legal bases: legitimate interest and legal obligation.

7.4 Newsletters: only with your consent, or to existing customer contacts about similar services where the law permits. You can unsubscribe at any time.

8. AI in the Service

8.1 AI features use models provided by OpenAI to draft messages, write replies to partners within the customer's policy, translate texts and understand messages in partner rooms where the partner has consented.

8.2 The AI receives only the data needed for the task. The ordinary Telegram correspondence of connected accounts is not used as AI input. Messages in a partner room are processed by AI only after the partner's consent to the service.

8.3 Data from the Service is not used to train AI models.

8.4 The customer sets the autonomy level and the policy, and the AI replies only within that policy. Approval of the first message to each new partner is switched on by default, and an emergency stop is available on all plans. We do not take decisions that produce legal or similarly significant effects concerning you solely by automated means (Article 22 GDPR).

8.5 Partners are told in the Partner Hub that replies may be written by an AI assistant.

9. Who receives personal data

9.1 Service providers acting as our processors, under contracts that require them to protect the data:

• website hosting and forms: Netlify (United States);
• website analytics, only with your consent: PostHog (EU cloud);
• business email and support mailbox: Google Workspace;
• AI processing: OpenAI;
• platform hosting (servers, database, backups, file storage) and other service providers: listed in Annex 3 of the DPA, published before the paid launch; the list is available on request.

9.2 Payment providers: once payments start, the provider named at checkout or on the invoice. For some purposes (such as fraud prevention) it may act as an independent controller.

9.3 Telegram: an independent controller when you use Telegram features of the Service.

9.4 Professional advisers (lawyers, accountants, auditors) under confidentiality duties; banks and insurers where necessary.

9.5 Authorities, courts and law-enforcement bodies where we are legally required to disclose data, or where disclosure is necessary to establish, exercise or defend legal claims. We disclose only what is legally required.

9.6 A buyer, investor or successor in a financing, merger, acquisition or sale of all or part of our business, under confidentiality and only to the extent necessary.

9.7 We do not sell personal data and do not share it for advertising.

10. International transfers

10.1 Some providers, or their affiliates, may process data outside the European Economic Area, in particular in the United States (Netlify, Google, OpenAI and PostHog support access).

10.2 We transfer personal data outside the EEA only where:

• the European Commission has decided that the recipient country, or the recipient, ensures an adequate level of protection, including recipients certified under the EU-U.S. Data Privacy Framework; or
• we have signed the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) with the recipient, supported by a transfer impact assessment and, where needed, additional safeguards such as encryption.

10.3 You can request a copy of the safeguards we use by writing to amai@amai.team (commercial terms may be redacted).

11. How long we keep personal data

12. Your rights

12.1 Under the GDPR you have the right to:

• access your personal data and receive a copy;
• rectify inaccurate or incomplete data;
• erase your data in the cases set out in Article 17 GDPR;
• restrict processing in the cases set out in Article 18 GDPR;
• data portability for data you provided to us, processed by automated means on the basis of consent or contract;
• object at any time, on grounds relating to your particular situation, to processing based on legitimate interests, and to object at any time and without giving reasons to processing for direct marketing, after which we stop that processing;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
• not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

12.2 How to exercise your rights: write to amai@amai.team or use the tools in your account settings. We may ask for information to confirm your identity. We answer within one month; where requests are complex or numerous, we may extend this by up to two further months and will tell you why. Exercising your rights is free unless a request is manifestly unfounded or excessive.

12.3 If your request concerns data that we process for a customer (section 2.3), we will forward it to the customer and help it respond.

13. Complaints

13.1 If you are not satisfied with how we handle your data, please contact us first at amai@amai.team. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement.

13.2 Our lead supervisory authority is the Commissioner for Personal Data Protection of the Republic of Cyprus (dataprotection.gov.cy).

14. Security

14.1 We protect personal data with technical and organisational measures appropriate to the risk: encryption in transit (TLS); encrypted storage of Telegram sessions; encryption of partner room files with a separate key; role-based access control; separation of customer workspaces; an audit trail of key actions; backups kept for 14 days, with a recovery point objective of up to 30 minutes and a recovery time objective of up to 3 hours; and confidentiality obligations for everyone with access.

14.2 No system is completely secure. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Commissioner within 72 hours of becoming aware of it and, where the risk is high, inform you without undue delay.

15. Children

The Service is intended for business users aged 18 or over. We do not knowingly collect data about children. If you believe a child has provided us with personal data, contact amai@amai.team and we will delete it.

16. Changes and language

16.1 We may update this Policy. We will publish the new version on this page with its date and, for material changes, notify account holders by email or in the Service before the change takes effect. Previous versions are available on request.

16.2 This Policy is published in Russian and English. The English version is the binding version.

17. Contact

AffiliateManagersAI Ltd (AMAI), Limassol, Cyprus. Email: amai@amai.team.