Privacy Policy

Effective date: April 19, 2026 Last updated: April 19, 2026

This Privacy Policy describes how Strategic AI Architects, LLC (“Strategic AI Architects,” “SAA,” “we,” “us,” or “our”) collects, uses, shares, and protects information in connection with our Ambrose software (“Service”), the websites at strategicaiarchitects.com and ambrose.strategicaiarchitects.com (“Sites”), our mobile, voice, and messaging integrations, and any related products (collectively, the “Offering”).

Ambrose is designed to run primarily on the user’s own machine. The architecture is “local-first”: most personal and Protected Health Information (PHI) processed through Ambrose never leaves the user’s computer in identifiable form. This Privacy Policy explains what data does leave, why, and what we do with it.

Not legal advice. This document is provided for informational purposes only and does not constitute legal advice. Strategic AI Architects, LLC is not your attorney. If you need legal advice on data privacy, HIPAA, GDPR, or any other regulatory matter, consult a licensed attorney.

1. Who we are


Legal entity	Strategic AI Architects, LLC
Address	(your registered business address)
Contact email	privacy@strategicaiarchitects.com
Data Protection Officer	dpo@strategicaiarchitects.com (for GDPR-related requests)

For users in the European Economic Area, United Kingdom, or Switzerland, Strategic AI Architects acts as a “data controller” with respect to information we collect directly from you, and as a “data processor” with respect to data you process through Ambrose on behalf of your own clients.

For users in the United States who handle Protected Health Information (“PHI”) under the Health Insurance Portability and Accountability Act (“HIPAA”), Strategic AI Architects may act as a Business Associate when expressly contracted to do so. Use of Ambrose to process PHI without an executed Business Associate Agreement (“BAA”) is governed by the user’s own compliance program; we do not warrant HIPAA compliance in the absence of a BAA.

2. Information we collect

2.1 Information you provide

Account information: name, email, phone number, business name, role.
Authentication credentials: password (stored as a bcrypt hash; we never see the plaintext), session tokens.
Billing information: processed by our payment provider (Stripe). We do not store full payment-card numbers on our systems.
Connected accounts: when you connect a third-party account (GoHighLevel, Google, Anthropic, Groq, OpenRouter, Retell, etc.), we receive identifiers and access tokens necessary to operate the integration.
Communications with us: support tickets, sales emails, survey responses.

2.2 Information you process through Ambrose

When you use Ambrose to process information about your own clients, prospects, or other data subjects, that data is handled primarily on your local machine. Ambrose includes a feature called the PHI Rail that automatically removes the 18 HIPAA Safe Harbor identifiers (and additional insurance-specific identifiers) from any payload before it is sent to a non-Business-Associate-covered AI provider. Real identities are restored only on the response, only on your machine, only at the user-facing render.

We may transiently process the following on your behalf during normal operation:

Message contents (text, attachments) inbound or outbound through connected channels (SMS, email, GoHighLevel conversations — including WhatsApp messages routed through your own GoHighLevel account).
AI prompts and responses, including pseudonymized representations of PHI.
Audit-log metadata (counts of identifier types redacted, hashes of prompts, mission identifiers, timestamps) — this metadata never contains the underlying PHI.
Operational telemetry (process health, error rates, latency).

2.3 Information we collect automatically

Device and connection data: IP address, browser type, operating system, language, time zone.
Usage data: features used, pages visited, sessions started, inference calls invoked, errors raised. Used to maintain the Service and improve product quality.
Cookies and similar technologies: strictly necessary cookies for session management; we do not use advertising or cross-site tracking cookies.

3. How we use information

We use information to:

Provide, operate, secure, and improve the Service;
Process payments and prevent fraud;
Authenticate users and detect abuse;
Communicate with you about the Service, including operational notices and (with your consent where required) marketing;
Respond to support requests;
Comply with legal obligations and enforce our Terms of Service;
Generate aggregated, de-identified analytics about Service performance.

We do not use the contents of messages, AI prompts, or PHI you process through Ambrose to train AI models for general-purpose use, and we do not permit our AI subprocessors to do so. See Section 5.

4. Legal bases for processing (EEA / UK / Switzerland)

Where the General Data Protection Regulation (“GDPR”) or UK GDPR applies, we rely on the following legal bases:

Contract performance — to provide the Service you requested.
Legitimate interests — to secure the Service, prevent fraud, communicate operationally, and improve the product.
Consent — for non-essential marketing communications and for any optional integrations you enable.
Legal obligation — to comply with applicable law (tax, audit, lawful requests).

You may withdraw consent at any time without affecting the lawfulness of prior processing.

We share information only as described below and never sell personal information.

5.1 Subprocessors

Category	Provider examples	Purpose
Cloud hosting	Amazon Web Services, RackNerd, Vercel	Application hosting, storage
Payment processing	Stripe	Subscription billing
Email delivery	Postmark, AWS SES	Transactional email
Authentication	Internal (no third-party identity broker by default)	Login, sessions
AI providers	Anthropic, AWS Bedrock, Groq, OpenRouter	Language model inference; payloads are scrubbed of PHI by the PHI Rail unless you explicitly enable BAA Mode and have a corresponding BAA in force with the provider
Voice platform	Retell AI	Real-time voice conversation infrastructure when you enable the Voice tier; subject to a Business Associate Agreement with Retell where PHI is in scope
CRM and messaging	GoHighLevel	When you connect a GHL account: message routing across the channels you have configured in GHL (SMS, email, Facebook, Instagram, WhatsApp Business, Google Business Messages)

A current list of subprocessors is maintained at strategicaiarchitects.com/subprocessors and updated as it changes.

With your direction. We share information when you instruct us to (e.g., enabling an integration, exporting data).
With business partners on your behalf. When you connect an account, we exchange data with that partner per their terms.
For legal reasons. We may disclose information when we have a good-faith belief it is required by law, court order, or to protect rights, safety, or the integrity of the Service.
In a business transfer. If Strategic AI Architects is involved in a merger, acquisition, or asset sale, your information may be transferred. We will notify you before your information is transferred and becomes subject to a different privacy policy.

We do not share message contents or AI prompt contents with any party other than the AI provider you have selected and any subprocessors strictly necessary to deliver the Service.

6. Messaging channels and WhatsApp

Ambrose does not receive WhatsApp webhooks directly and does not ingest inbound WhatsApp messages into its own infrastructure. Where users reply to or send WhatsApp messages to their own leads or clients, those messages are routed through the user’s connected GoHighLevel account (or another messaging provider the user has configured). GoHighLevel, not Strategic AI Architects, acts as the transport layer for those messages and is bound by its own terms and privacy policy.

Meta processes WhatsApp message content as the underlying transport provider under GoHighLevel’s (or your own direct) integration with Meta. Meta’s privacy policy applies to that processing. Strategic AI Architects does not have a Business Associate Agreement with Meta and does not represent that Meta’s WhatsApp service is HIPAA-compliant. You are responsible for evaluating whether your use of WhatsApp for any specific data category is appropriate under applicable law and your own compliance program.
No marketing without consent. Outbound marketing or promotional WhatsApp messages require recipient opt-in, and templated messages must be approved through Meta Business Manager. You are responsible for collecting and documenting consent.
Voice calls do not use WhatsApp. The Voice tier of Ambrose uses Retell AI for real-time voice; it does not transmit audio, transcripts, or any content through WhatsApp.

7. International data transfers

Strategic AI Architects is based in the United States. Personal information processed by us is hosted on servers located in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States.

For transfers from the European Economic Area, United Kingdom, or Switzerland, we rely on Standard Contractual Clauses approved by the European Commission and equivalent instruments where applicable. A copy is available on request.

8. Data retention

Data category	Retention
Account and authentication records	Duration of your account plus 90 days for billing/audit, then deleted
Billing records	7 years (US tax-record obligation)
Operational telemetry	90 days, then aggregated or deleted
Audit-log metadata (no PHI content)	6 years from creation, per HIPAA accounting-of-disclosures requirements (45 CFR § 164.528)
Message contents and AI prompts	Retained on your local machine according to your local Ambrose configuration; SAA does not retain a copy beyond transient processing
Pseudonym mapping vault (PHI Rail)	Retained on your local machine; SAA does not retain a copy
Support correspondence	3 years from last interaction

You can request deletion at any time per Section 10.

9. Security

We protect information using a combination of organizational and technical measures, including:

TLS 1.2 or higher for data in transit between systems we control.
Encryption at rest for stored credentials and tokens.
Bcrypt password hashing.
HMAC signature verification on all inbound webhooks (Stripe, Retell).
Per-user vault isolation on the local machine.
Default-deny access controls on the PHI Rail Business Associate Agreement allowlist.
Audit logging of every disclosure to non-BAA destinations, with prompt-content stored only as a SHA-256 fingerprint.
Regular review of subprocessor security posture.

No system is perfectly secure. If we become aware of a security incident affecting your information, we will notify you without undue delay and in any case as required by applicable law.

10. Your rights

Depending on your location, you may have the following rights with respect to information we hold about you:

Access — request a copy of your personal data.
Rectification — correct inaccurate data.
Deletion — request that we delete your data, subject to legal retention obligations.
Restriction — limit our processing of your data.
Portability — receive your data in a structured, commonly used, machine-readable format.
Objection — object to processing based on legitimate interests.
Withdrawal of consent — where processing is based on consent.
Lodge a complaint — with your local supervisory authority (EEA/UK/Swiss residents).

To exercise any of these rights, email privacy@strategicaiarchitects.com with the subject line “Privacy Request” and a description of what you would like us to do. We respond within 30 days; complex requests may take up to 90 days, and we will tell you if so.

Data deletion specifically

To request deletion of your account and all associated personal data:

Email privacy@strategicaiarchitects.com from the email address associated with your account, with the subject line “Delete my account.”
We will confirm receipt within 5 business days.
We will delete or anonymize your account, vault contents we hold, audit-log metadata older than the legal minimum, and connected-account tokens within 30 days of confirmation.
Information we are required by law to retain (billing records, etc.) will be retained for the period required and then deleted.

If you cannot access your account, you may also reach this URL directly: https://strategicaiarchitects.com/data-deletion

11. Children

Ambrose is intended for use by adult professionals. We do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, contact privacy@strategicaiarchitects.com and we will delete it.

12. California-specific disclosures

For California residents, the California Consumer Privacy Act (“CCPA”) and California Privacy Rights Act (“CPRA”) provide additional rights. We do not sell or share personal information for cross-context behavioral advertising. The categories of personal information we collect are listed in Section 2; the purposes in Section 3; the categories of recipients in Section 5. To exercise your CCPA/CPRA rights, follow the procedure in Section 10. We will not discriminate against you for exercising these rights.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we update the “Last updated” date at the top of this page. Material changes will be communicated by email or in-app notice at least 14 days before they take effect, except where the change is required by law to take effect sooner.

14. Contact


General privacy questions	privacy@strategicaiarchitects.com
Data Protection Officer (GDPR)	dpo@strategicaiarchitects.com
Security incidents	security@strategicaiarchitects.com
Mailing address	(your registered business address)