Privacy Policy
Last Updated: July 10, 2026
This Privacy Policy ("Policy") explains how Amber News and our affiliates (together, "Amber News", "we", "our", or "us") process Personal Data (defined below) of individuals who access or use our Services or otherwise engage with Amber News.
This Policy also explains your rights and choices about how we use your Personal Data, including how you may be able to access or update certain information about you. Where processing is based on consent, and to the extent permitted by law, by using the Services or otherwise engaging with Amber News, you consent to the use of your Personal Data as described in this Policy.
1. Definitions; Scope
Definitions
In this Policy, "Personal Data" means any information relating to an identified or identifiable individual, such as an individual's name, address, telephone number, or email address. In certain jurisdictions, this may also be referred to as "Personal Information." In Jamaica, the term "personal information" is defined in and governed by the Data Protection Act, 2020, and Amber News processes such information as a data controller in accordance with that Act. Other capitalised terms not defined herein shall have the meanings ascribed to them in our Terms of Service, available at ambernews.ai/terms ("Terms of Service").
"Platforms" means the products and services we make available to you, including our websites, mobile sites, mobile applications, radio and live television streaming, our AI assistant "Amby", emails, and any other technology or service you use to access our news content and features. "Services" means the news, media, and related content and functionality we provide through the Platforms.
"User" means an individual who accesses or uses our Platforms, whether as a registered account holder or as a guest. "Content" means the text, comments, search queries, messages, and other information you submit to or through the Platforms, including any queries or messages you provide to our AI assistant "Amby".
Scope
This Policy applies where Amber News acts as a data controller under applicable laws in respect of Personal Data processed through our Platforms, including when you visit our websites and apps, register for an account, use our AI assistant "Amby", or otherwise engage with our news and media Services. It applies to visitors, registered users, and guests of the Platforms.
2. Categories of Personal Data We Collect
Personal Data You Provide to Us
Account & Contact Details. When you register for an account on our Platforms, we collect the information you provide, which may include your first name, last name, username, email address, and phone number, together with the password you create. You may also choose to register or sign in using a third-party login such as your Google account, in which case we receive basic profile information from that provider. You can browse much of our content as a guest without creating an account, in which case we do not collect account registration details.
User Content & Communications. When you interact with our Platforms, we collect the content you submit, such as comments you post, search queries you enter, feedback you send, and questions or messages you provide to our AI assistant "Amby". Such content may include Personal Data and is processed in accordance with this Policy.
AI Assistant (Amby) Interactions. When you use our AI assistant "Amby", we process the questions, prompts, and other content you submit (by text or voice) and the responses generated for you, together with any Personal Data contained in those interactions, in order to provide and improve the assistant.
Cookies and Similar Technologies. We collect information about your interactions with our Platforms using cookies and similar technologies, as described in the "Your Cookie Choices" section below.
Feedback and Communications. If you contact us directly, express interest in using our Services, or otherwise provide us with feedback, we collect Personal Data including your name, email address, the contents of any message or attachments you send to us, and other information you choose to provide. When we send you emails, we may track whether you open them to learn how to deliver a better customer experience and improve our Services.
Other Information You Provide. We may collect other information you provide to us, such as when you participate in a beta programme, interact with us at events, or otherwise engage with Amber News online or offline. Some of these engagements may have additional terms.
Personal Data We May Otherwise Collect From You and/or Your Device
Information from Cookies and Similar Technologies. We and our third-party partners may collect information about you using cookies, pixel tags, SDKs, or similar technologies ("Cookies"). See the "Your Cookie Choices" section of this Policy and our Cookie Policy (available at ambernews.ai/cookie-policy) for further detail. Categories of information we may collect using cookies include:
- Location Information. When you use our Services, we infer your general location information, for example by using your internet protocol (IP) address. In some jurisdictions, we will ask for your permission before doing so.
- Device Information. We receive information about the device and software you use to access our Services, including IP address, web browser type, operating system version, device identifiers, and related technical attributes.
- Usage Information. We receive information about your interactions with our Services, the content you view, the actions you take, the features with which you interact, and the dates and times of your visits.
Personal Data We Collect from Third Parties
Information from Service Providers. We may receive information about you from third-party service providers that are authorised to share your Personal Data with us, including in connection with verification, data enrichment, or Know Your Customer and Anti-Money Laundering checks where applicable.
Information from Social and Login Providers. Where you register or sign in using a third-party account such as Google, we receive basic profile information from that provider in accordance with your settings on that service. In some cases, we need to collect your Personal Data to provide you with our Services. In these cases, if you choose not to provide the requested Personal Data, you may not be able to use our Services. We will tell you if providing Personal Data is required by law or under a contract and the consequences of failing to provide it, if applicable.
Personal Data and the Amby AI Assistant
Amber News provides an AI assistant, "Amby", that lets you ask questions and interact with our news content by text or voice. When you use Amby, we process the queries, prompts, and any content you submit, and generate responses for you. Where you interact by voice, we process the audio you provide in order to understand your request and, where applicable, generate a spoken response. We use these interactions to operate and improve the assistant and do not use them to infer characteristics about you beyond what is necessary to provide the feature.
Where you interact with Amby by voice, we process the audio only for as long as needed to understand and respond to your request. We do not use these interactions to identify you or to infer characteristics about you beyond what is necessary to provide the feature.
Content Moderation and Account Suspension
Amber News does not undertake to review all Content and expressly disclaims any duty or obligation to monitor or review it. However, to maintain the integrity and security of the Services, and for fraud prevention purposes, Amber News reserves the right to review Content, including comments and interactions with Amby. In certain circumstances, Amber News may share such Content, which may include Personal Data, with third parties to support content moderation and safety initiatives. Users found to have engaged in activity that violates our Acceptable Use Policy may be subject to termination or suspension under the applicable Terms of Service.
3. Purposes of Processing Personal Data and Legal Basis
Purpose and Legal Basis
The table below describes the purposes for which we process your Personal Data when acting as a data controller or data fiduciary, and the legal bases for such processing. When we rely on legitimate interest as the legal grounds to process your Personal Data, you have the right to object to that processing as set out in Section 8 ("Your Rights"). Please note that where the legal bases specified are not applicable in your country, we will rely on consent or other available grounds to process your Personal Data.
| Purpose | Description of Processing Activity | Legal Ground for Processing |
|---|---|---|
| Providing the Services | To operate, maintain, and provide the features and functionality of the Amber News platform as requested by you and outlined in our Terms of Service. | Necessary to enter into or perform our contract with you. |
| Providing the Amby AI Assistant | To process the queries and content you submit to our AI assistant "Amby" and generate responses, in order to provide the assistant feature. | Necessary to enter into or perform our contract with you. |
| Managing Registration & Sign-In | To create and manage your account, authenticate you (including via third-party login such as Google), and enable secure sign-in to the Platforms. | Necessary to enter into or perform our contract with you. |
| Storing Your Content | To store the content you submit, such as comments, feedback, and interactions with our AI assistant "Amby", into subprocessors cloud infrastructure so that we can provide the Services. | Necessary for our legitimate interest in operating the Services and, where applicable, based on your consent. |
| Personalizing the Experience | To tailor your experience on the platform, including saving preferences and suggesting content, configurations, or features relevant to your usage. | Necessary for our legitimate interest in optimizing user experience. (Or Consent, where explicitly requested.) |
| Platform Communications & Support | To communicate operational updates, respond to inquiries, provide technical support, diagnose system errors, and deliver customer service. | Necessary to fulfill support obligations and for our legitimate interest in maintaining customer relationships. |
| Marketing Communications | To send prospective and current users promotional materials, newsletters, and information about new products or features that may be of interest. | Provided explicitly by you. (Or Legitimate Interest for existing customers, subject to applicable anti-spam laws allowing soft opt-ins.) |
| Managing Newsletters & Subscriptions | To manage your newsletter and content subscription preferences and deliver the updates you have chosen to receive. | Based on your consent and our legitimate interest in managing your communication preferences. |
| Analytics and Usage Tracking | To analyze trends, monitor platform performance, understand how the Services are utilized, and inform the development of new features and products. | Necessary for our legitimate interest in conducting business intelligence and improving our technology. |
| Data Aggregation & Anonymization | To generate de-identified, anonymized, or aggregated datasets for research, product improvement, and statistical analysis. We will not attempt to re-identify this data unless required by law. | Necessary for our legitimate interest in enhancing AI models and platform capabilities without compromising individual privacy. |
| Legal and Administrative Compliance | To enforce our Terms of Service, defend our legal rights, address administrative disputes, and respond to lawful requests from law enforcement or regulatory bodies. | Necessary to comply with statutory requirements and protect our legal rights. |
We only rely on our legitimate interests to process your Personal Data when we determine that these interests are not overridden by your rights and interests. When we use your information because we have a legitimate interest to do so, you may have the right to object to that use.
4. Data Recipients
Your Personal Data may be shared with:
Affiliates. We may share any Personal Data we receive with our current or future affiliates for any of the purposes described in this Privacy Policy.
Vendors and Service Providers. We may share your Personal Data with third-party vendors and service providers who provide services such as website and application hosting, cloud infrastructure, data storage, AI and language model services that power our "Amby" assistant, web application firewall and security services, analytics, customer support, and email and newsletter delivery. A current list of our service providers and sub-processors is maintained at ambernews.ai/subprocessors.
Analytics and Measurement Providers. We use third-party analytics providers to understand how our Platforms are used and to measure and improve our content and Services. These providers may process usage information, device information, and identifiers, as described in our Cookie Policy. The list of active analytics providers may vary and will be reflected in our sub-processors list at ambernews.ai/subprocessors.
Web Security Providers. We use Cloudflare, Inc. to provide web application firewall (WAF) services and DDoS mitigation. Cloudflare may process limited metadata such as IP addresses, request headers, and traffic patterns in connection with protecting our web-facing services. Cloudflare does not access or store the content you view or submit on our Platforms.
Social Media and Login Providers. When you register or sign in using a third-party account such as Google, or interact with our official pages and share buttons on platforms such as YouTube, Facebook, Instagram, X, LinkedIn, TikTok, and Threads, those providers may process your information in accordance with their own privacy policies.
Advertising Partners. We may work with advertising partners who help us display and measure advertising on our Platforms. These partners may process usage and device information and identifiers to deliver and measure advertising, as described in the "Your Cookie Choices" section and our Cookie Policy.
As Required by Law and Similar Disclosures. We may access, preserve, and disclose your Personal Data to law enforcement agencies, regulatory bodies, and public authorities or pursuant to legal proceedings if we believe doing so is required or appropriate to: (a) comply with law enforcement requests and legal process, such as a court order or subpoena; or (b) protect your, our, or others' rights, property, or safety.
Merger, Sale, or Other Asset Transfers. We may disclose your Personal Data to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction or reorganisation, such as a merger, acquisition, or sale of assets.
Other Data Recipients. We may also disclose your information to other third parties where we have received your consent to do so.
5. International Data Transfers
We maintain hosting and server locations primarily in the United States. This means we may transfer your Personal Data outside your country, state, or province of residence, depending on your location at that time. Regardless of your location, Personal Data may be transferred to the United States for storage and processing.
The data will be transferred for the time required to fulfil the purpose for which it is processed. It may be shared with our service providers and affiliates for the purposes listed in Section 3. In such cases, Amber News is the controller of the data, and the service providers are processors or sub-processors, as the case may be.
Depending on where you reside, we apply appropriate protections when we transfer your Personal Data outside of your country of residence. These protections may include:
- Transferring Personal Data to countries which have been found to provide adequate protection by the competent authorities;
- Using contractual protections, such as Standard Contractual Clauses approved by the European Commission, for the transfer of Personal Data;
- For residents of India, complying with the requirements of the Digital Personal Data Protection Act, 2023 and rules made thereunder regarding cross-border data transfers;
- For residents of Jamaica, complying with the requirements of the Data Protection Act, 2020 regarding international transfers;
- For residents of South Africa, complying with the requirements of the Protection of Personal Information Act ("POPIA") and, where applicable, obtaining authorisation from the Information Regulator of South Africa for cross-border transfers in accordance with Section 72 of POPIA; or
- Obtaining your express consent.
For more information about how we transfer Personal Data, or to obtain a copy of the contractual safeguards we use for such transfers to the extent applicable laws afford such right, please contact us using the details in the "Contact Us" section below.
Please note that the data protection laws in the locations where we transfer or process data may differ from those in your area. While the data is in another jurisdiction, it may be accessed by the courts, law enforcement, and national security authorities of that jurisdiction.
6. Data Retention
We take measures to delete your Personal Data or keep it in a form that does not permit identifying you when this information is no longer necessary for the purposes for which we process it, unless we are required or permitted by law to keep this information for a longer period. When determining the specific retention period, we consider various factors, such as the type of service provided to you, the nature and length of our relationship with you, and mandatory retention periods provided by law and any relevant statute of limitations.
The following table summarises the principal retention periods that apply to Personal Data processed in connection with our Services, including the periods applied by our key sub-processors:
| Data Category | Retained By | Retention Period |
|---|---|---|
| Account & Profile Data (name, username, email, phone, password, comments, feedback, subscriptions) | Amazon AWS | 30 days of inactivity and full deletion happens post 30 days. |
| Call Audio Processing (speech-to-text inference) | ElevenLabs Inc. | Data permanently erased upon account or data deletion. Backups retained for up to 50 days, then automatically erased. Zero Retention Mode available for enterprise (no data held after job completion). |
| Synthesised Voice Outputs (text-to-speech inference) | ElevenLabs Inc. | Data permanently erased upon account or data deletion. Backups retained for up to 50 days, then automatically erased. Zero Retention Mode available for enterprise (no data held after job completion). |
| Email Notifications (email addresses, delivery metadata, OTP) | Mailgun Technologies, Inc. | Up to 3 days (message bodies) / up to 30 days (event logs). Message bodies are securely purged after 3 days. Email event logs and delivery metadata are retained for up to 30 days for deliverability tracking and diagnostics. |
| Access Logs | Amazon AWS | Duration of the active agreement + up to 3 years. Retained for the lifetime of the account relationship. Following account closure or termination, data is securely retained for up to 3 years for legal, auditing, and compliance purposes, unless a shorter deletion period is legally mandated or specifically requested by the customer. |
| Web Security Metadata (IP addresses, request headers, traffic patterns) | Cloudflare, Inc. (WAF) | Logs retained for up to 72 hours for real-time threat detection. Enterprise logs may be retained for up to 30 days. Cloudflare does not store application-layer content. |
The retention periods above are indicative and, where a specific sub-processor or period has not yet been confirmed, will be finalised and updated in this Policy. Where the Platform supports it, you may be able to manage or delete certain data, such as your account and comments, through your account settings.
When you submit a deletion request under Section 8, we will delete or anonymise your Personal Data held within Amber News's own systems within a commercially reasonable period, subject to any legal obligations to retain certain records. When you submit a deletion request, we will use commercially reasonable efforts to delete or anonymise your Personal Data held within our own systems, subject to any legal obligations to retain certain records. With respect to Personal Data held by our sub-processors, we will forward your deletion request to the relevant provider in accordance with the applicable Data Processing Agreement. Please note that the ability to action deletion requests may be subject to the sub-processor's own data retention obligations, technical limitations, and contractual terms. We cannot guarantee the deletion of data held across all third-party sub-processors within a specific timeframe.
8. Your Rights
Data Subject Rights
Depending on where you are located or reside, you may have certain rights regarding the Personal Data we maintain about you and certain choices about what Personal Data we collect from you, how we use it, and how we communicate with you. Such rights may include the rights to:
- Access Your Personal Data. Receive confirmation of processing and request access to the Personal Data we maintain about you. Where provided by applicable law, you may request that we include a description of the purpose of the processing of your Personal Data, third parties with which your data has been shared, and information regarding the safeguards for international data transfer.
- Correct Your Personal Data. Request to update and correct inaccuracies in your Personal Data.
- Delete Your Personal Data. Request that Amber News delete the Personal Data we maintain about you, including your account and the content associated with your account. Where provided by applicable law, you may request that your Personal Data be anonymised rather than deleted.
- Restrict or Object to Processing of Your Personal Data. Restrict or object to the processing of your Personal Data, where applicable.
- Request Portability of Your Personal Data. Request to transfer your Personal Data to another authorised organisation.
- Withdraw Consent. You may withdraw any consent you previously provided to us regarding the processing of your Personal Data at any time. We will apply your preferences going forward, and this will not affect the lawfulness of processing that occurred before you withdrew your consent.
- Unsubscribe from Marketing Communications. You may unsubscribe from receiving marketing communications at any time by following the unsubscribe instructions in the relevant communication or by contacting us as described in Section 13. Please be aware that, if you opt out, you will continue to receive administrative messages from us regarding our Services.
- Anonymisation. To the extent provided by law, you may ask to have your Personal Data anonymised rather than deleted. Where anonymisation is not feasible, we will inform you of the reasons.
- Right to Information About Shared Entities. To the extent provided by law, you may have the right to be informed about the entities with which we share your Personal Data.
You may exercise these rights, as applicable, by contacting us using the details set out in Section 13 ("Contact Us"). Before fulfilling your request, we may ask you to provide reasonable information to verify your identity and/or residence. Please note that applicable law may provide for exceptions and limitations to each of these rights.
In addition to the rights listed above, you may also have the right to lodge a complaint with a supervisory authority, including in your country of residence, place of work, or where an incident took place.
Residents of India
If you are a Data Principal residing in India, in addition to the rights in Section 8.1, you have the following additional rights under the Digital Personal Data Protection Act, 2023 ("DPDPA"):
- Right to Nominate. You have the right to nominate any individual who will exercise the rights available to you in case of your death or incapacity. Nominations may be submitted to us at the contact address in Section 13.
- Right to Know. You have the right to know what Personal Data is being processed about you, the identity of all Data Fiduciaries and Data Processors who have processed it, and the grounds for each processing activity.
- Right to Grievance Redressal. You have the right to contact us about how we process your Personal Data, our obligations in relation to such Personal Data, and your rights regarding such data. You may exercise this right by contacting us as described in Section 13. If your grievance is not resolved to your satisfaction, you may approach the Data Protection Board of India once constituted.
Amber News acknowledges its obligations as a Data Fiduciary under the DPDPA 2023 and will comply with all rules and regulations issued thereunder, including those relating to the Consent Manager framework upon its operationalisation.
Residents of Jamaica
If you are a data subject residing in Jamaica, in addition to the rights in Section 8.1, you have the following additional rights under the Data Protection Act, 2020:
- Right of Subject Access. Receive confirmation that Personal Data about you is being processed, and obtain a description of the data held, the purposes of processing, and information about third parties to whom it has been or may be disclosed.
- Right to Prevent Processing Likely to Cause Damage or Distress. Submit a written notice requiring Amber News to cease, or not to begin, processing your Personal Data for specified reasons where that processing is likely to cause you substantial unwarranted damage or distress.
- Right to Prevent Automated Decision-Making. Request human review of decisions made solely by automated means where those decisions significantly affect you.
- Right to Rectification, Blocking, Erasure, or Destruction. Request that inaccurate Personal Data be corrected, blocked, erased, or destroyed, and that third parties to whom the data was disclosed be notified accordingly.
Amber News is committed to compliance with the Data Protection Act, 2020 of Jamaica and the oversight of the Office of the Information Commissioner (OIC).
Residents of South Africa
If you are a Data Subject residing in South Africa, in addition to the rights described in Section 8.1, you have the following rights under the Protection of Personal Information Act, 4 of 2013 ("POPIA"). Amber News acts as the Responsible Party in respect of your Personal Information processed under this Policy.
- Right of Access (Section 23). You have the right to request confirmation of whether we hold Personal Information about you, and to access that information, including the identity of third parties who have had access to it.
- Right to Correction or Deletion (Section 24). You have the right to request correction of inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained Personal Information. Where correction is not appropriate, you may request deletion or destruction of that information.
- Right to Object to Processing (Section 11(3)). Where we process your Personal Information based on our legitimate interests, you have the right to object to such processing on reasonable grounds relating to your particular situation. You also have the right to object at any time to the processing of your Personal Information for the purposes of direct marketing.
- Right to Complain to the Information Regulator (Section 74). If you believe that Amber News has processed your Personal Information in violation of POPIA, you have the right to submit a complaint to the Information Regulator of South Africa.
Residents of the EEA, Switzerland, and the United Kingdom
If you are located in the European Economic Area, Switzerland, or the United Kingdom, you have the full suite of rights under the General Data Protection Regulation (GDPR) and UK GDPR respectively, including all rights described in Section 8.1. You also have the right to lodge a complaint with your local data protection supervisory authority. In the United Kingdom, the relevant authority is the Information Commissioner's Office (ICO).
9. Third Parties
Our Services may contain links to other websites, products, or services that we do not own or operate. We are not responsible for the privacy practices of these third parties. Please be aware that this Privacy Policy does not apply to your activities on these third-party services or any information you disclose to these third parties. We encourage you to read their privacy policies before providing any information to them.
Where our Services interact with third-party platforms or service providers (including our telecommunications and cloud service providers), such providers operate under their own terms of service and privacy policies. Amber News is not responsible for the independent data practices of those providers. For details on the sub-processors we engage and their applicable data retention periods, please refer to our Sub-Processor List.
10. Security
We implement reasonable and appropriate technical and organisational measures to secure and protect your Personal Data against unauthorised access, disclosure, alteration, or destruction. These measures include encryption of data in transit and at rest, access controls, audit logging, and regular security assessments. An up-to-date description of our security controls is available at Security Controls.
As no electronic transmission or storage of information can be entirely secure, we cannot make absolute guarantees as to the security or privacy of your information, to the extent permitted by applicable law. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected individuals, within the timeframes prescribed by applicable law. For Data Subjects in South Africa, this includes notifying the Information Regulator of South Africa and the affected Data Subjects (unless their identity cannot be established) as soon as reasonably possible after becoming aware of the compromise, in accordance with Section 22 of POPIA. Note that POPIA imposes no minimum harm threshold — any reasonable grounds to believe that Personal Information has been accessed or acquired by an unauthorised person triggers the notification obligation to both the Information Regulator and affected Data Subjects.
11. Children's Privacy
Our Services are not intended for or directed at children under the age of 18, and Amber News does not knowingly collect, store, or process Personal Data from children under the age of 18. If we become aware that we have collected Personal Data from a child under 18 without appropriate consent, we will take reasonable steps to delete that information in accordance with applicable law. If you believe that a child under 18 has provided us with Personal Data, please contact us at the address in Section 13.
12. Updates to this Policy
We may periodically update this Policy to reflect changes in our data processing practices, legal obligations, or the Services. If there are significant changes, we will notify you as required by law, for example, by sending an email to the address associated with your account, or by displaying a notice on our Platform, at least fourteen (14) days before the change takes effect. Continued use of the Services following such notice constitutes acceptance of the revised Policy, to the extent permitted by applicable law.
13. Contact Us
For any questions regarding this Policy or our processing of your Personal Data, please contact our Data Protection Officer or Privacy Team at:
Amber News (Amber Group), 5th Floor, 13 Haining Road, Kingston, Jamaica. Email (General / DPO): [email protected]
You may exercise your rights by emailing us at the applicable address above. Please include the right you would like to exercise in the subject line (e.g., "Right of Access Request") and note the country or region in which you reside. Before fulfilling your request, we may ask you to provide reasonable information to verify your identity and/or residence.