This Privacy Policy explains what personal data Amber Toon collects, why we collect it, and what your rights are. It is written to comply with the EU General Data Protection Regulation (GDPR) and applies to everyone who uses the Service, regardless of where you live.
1. Data controller
The data controller for personal data processed via Amber Toon is:
Simarai, MB J. Janonio g. 12A-1, LT-92252 Klaipėda, Lithuania Company code: 307591676 | VAT: LT100019762213
For all privacy questions or requests, contact contact@ambertoon.com.
2. What data we collect
We collect the following categories of personal data:
- Account data — your email address.
- Reading and usage data — which series and episodes you open, your reading progress and position, your streak, and the time you spend on each screen.
- Subscription data — your subscription status, plan, renewal date, and payment-processor identifiers (customer ID, subscription ID). We do not store your card number; that information is held only by our payment processor.
- Analytics — anonymous session-level data captured by PostHog. PostHog runs in cookieless mode (memory-only session); see Section 8.
- Advertising and conversion data — when you interact with our site, we share certain events (e.g. page view, email submission, paywall view, checkout initiation, purchase) with Meta Platforms via the Meta Pixel and the Conversions API. Data shared includes a hashed version of your email address (SHA-256), your IP address, browser user-agent, and event metadata such as the page URL and event timestamp. See Section 4 (Processors) and Section 8 (Cookies and tracking technologies) for details.
- Email delivery data — open and click data from transactional emails we send via Resend (e.g. the magic-link sign-in email and other account emails).
3. Lawful basis for processing (GDPR Article 6)
We process your personal data on the following lawful bases:
- Performance of a contract (Art. 6(1)(b)) — for account data, subscription data, and reading and usage data. We need these to deliver the Service you have subscribed to.
- Legitimate interest (Art. 6(1)(f)) — for cookieless analytics, email-delivery diagnostics, advertising measurement (Meta Pixel and Conversions API), and the prevention of fraud. Our legitimate interest is in operating, securing, growing, and improving the Service. We have balanced this interest against your rights and concluded that the processing is proportionate; you may object at any time (see Section 6).
- Consent (Art. 6(1)(a)) — for any future marketing emails and, where required by law in your jurisdiction, for non-essential cookies and advertising tracking. We currently send no marketing email; if we begin to do so, we will request your explicit opt-in first. You can withdraw consent at any time without affecting the lawfulness of past processing.
4. Third-party processors
We rely on third-party providers to operate the Service. These providers fall into the following categories: hosting and content delivery, authentication and database, payment processing, transactional email, product analytics, and advertising and conversion measurement. Each provider is bound by a Data Processing Agreement that meets GDPR Article 28 requirements, and personal data is processed only for the purposes described in this policy.
A current list of named processors and their locations is available on request — email contact@ambertoon.com.
5. Data retention
- Account data, subscription data, and reading and usage data — retained for as long as your subscription is active, plus thirty (30) days after cancellation, to allow for re-activation. After that we delete or anonymize.
- Legal and financial records (invoices, billing history) — retained for seven (7) years as required by Lithuanian tax law (Republic of Lithuania Law on Tax Administration).
- Analytics data — retained for twelve (12) months, then automatically deleted by PostHog.
6. Your rights under GDPR
You have the following rights with respect to your personal data:
- Right of access — you can request a copy of the personal data we hold about you. Email contact@ambertoon.com.
- Right to rectification — if any data we hold about you is inaccurate, you can update it via your account settings or by email.
- Right to erasure — you can request deletion of your data, subject to the legal retention requirements set out in Section 5. Email contact@ambertoon.com.
- Right to data portability — you can request a structured, machine-readable export of your data. Email contact@ambertoon.com.
- Right to restrict or object to processing — you can ask us to pause processing or object to processing carried out on the basis of legitimate interest.
- Right to withdraw consent — applicable to any consent-based processing. You can withdraw consent at any time without affecting the lawfulness of past processing.
- Right to lodge a complaint — you can lodge a complaint with the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija — VDAI) at https://vdai.lrv.lt/, or with the data protection authority in your country of residence.
We respond to verified rights requests within thirty (30) days, as required by GDPR.
7. International data transfers
Some of our processors are based outside the European Economic Area (notably the United States). Where personal data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, additional supplementary measures, to ensure your data continues to receive a level of protection equivalent to that guaranteed under EU law.
8. Cookies and similar technologies
We use a small number of cookies and similar technologies, grouped as follows:
- Strictly necessary — authentication cookies set when you are signed in; a locale preference cookie. These are required for the Service to function and are exempt from consent requirements.
- Product analytics — PostHog runs in cookieless mode (memory-only session); sessions are discarded when you close the tab. No persistent tracking cookies are set by PostHog.
- Advertising and conversion measurement — the Meta Pixel sets cookies (
_fbp, and_fbcif you arrived via a Meta ad click) on your device for advertising attribution and audience-building. The Conversions API mirrors selected events from our server.
If you are accessing Amber Toon from the EU, EEA, or UK and you would like us to stop sharing your activity with Meta for advertising purposes, please email contact@ambertoon.com and we will exclude your data from advertising processing. We will also configure browser-side consent before launching paid advertising campaigns in those jurisdictions; until then, you can use your browser's tracking-protection settings or an ad-blocker to opt out at the network level.
9. Age requirement
Amber Toon is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided personal data to us, please contact contact@ambertoon.com immediately and we will delete the data.
10. Security
We protect your personal data using:
- TLS encryption for data in transit.
- Encryption at rest at the database level.
- Access controls that restrict your data to your own authenticated session.
- Backend credentials stored as encrypted environment variables.
We never store payment-card information; that data is held only by our payment processor.
No system is perfectly secure, and we cannot guarantee absolute security. If you become aware of a security incident affecting your data, please contact contact@ambertoon.com.
11. Updates to this Policy
We may update this Privacy Policy from time to time. If we make a material change, we will notify you by email at least fourteen (14) days before the change takes effect, and we will update the "Last updated" date at the top of this page.
12. Contact
For all privacy-related questions, requests, or complaints, email us at contact@ambertoon.com. We will respond as quickly as we can and within the legally required timeframes.