Privacy Policy

1. Scope

This Privacy Policy explains how Vitaliti World, LLC handles information when you visit useambitio.com, create an account, or use Ambitio (the “Service”). By using the Service, you agree to this Policy.

2. Information we collect

We collect information in these categories:

• Account data. Name, email address, password (stored hashed), email verification status, and profile details you provide.
• Authentication data. If you sign in with Google or GitHub, we receive identifiers and basic profile information those providers share with us for login.
• Connected Google data (optional). If you connect Google Calendar, Google Tasks, or Google Analytics in Settings, we receive the Google user data described in section 3. These connections are separate from Sign in with Google and are off until you connect them.
• Venture content. Strategy answers, goals, targets (key results), reviews, notes, and other business content you enter into Ambitio.
• Files you upload. Documents or images you upload to the Service, stored in cloud object storage we operate.
• Usage and device data. Pages viewed, feature use, approximate location derived from IP, browser type, and similar diagnostics collected through cookies or similar technologies and our analytics tools.
• Communications. Messages you send us (for example to hello@useambitio.com), transactional email metadata needed to deliver login and verification messages, product reminder preference settings, and (only if you opt in) marketing nurture subscription status.

3. Google user data

You can use Ambitio without connecting a Google account beyond optional Sign in with Google. Calendar, Tasks, and Analytics access happen only after you start those connections in Settings and grant permission on Google's consent screen.

When you connect those services, we access:

• Sign-in (if you choose Google login). Name, email address, and basic profile used to create or match your Ambitio account. Login does not request Calendar, Tasks, or Analytics scopes.
• Google Calendar. The list of calendars you can write to, free/busy times on the calendar you map to a venture, and events Ambitio creates, updates, or cancels after you confirm a booking (including Meet links when that feature is on). If you turn on event-detail sharing in Settings, we also read event titles and times from that calendar so teammates can avoid conflicts with more than free/busy blocks.
• Google Tasks. Task lists and tasks, so you can export Actions from Ambitio and pull completion status back.
• Google Analytics. The Analytics accounts and properties you pick, plus metric values used as Connected data on Targets. We do not change your Analytics property settings.

How we use this data.Only to provide the features you connected: map a calendar and weekly hours, find shared free slots, book / reschedule / cancel meetings you confirm, export or complete Tasks, and attach Analytics numbers to Targets. Scheduling features (including the teammate agent) use availability and, if you enabled event details, those titles and times as context to propose meeting times. That context is processed on our infrastructure and by Google's Gemini models via Google Cloud so the Service can return those suggestions.

How we store this data. OAuth tokens are encrypted at rest. We store the Google account identifier and email label, which calendar you mapped, weekly free hours, and your event-detail preference. We query free/busy (and event details if enabled) as needed for scheduling; we do not keep a standing full copy of your calendar. Meeting records you confirm in Ambitio are stored as product data alongside other venture content.

How we share this data. We share it with the infrastructure that runs Ambitio (Google Cloud for hosting and Gemini inference) under instructions that limit use to providing the Service. We do not sell Google user data. We do not use it for advertising. We do not transfer it to other third parties except as needed to operate the Service, to comply with law, or with your direction (for example inviting teammates to a meeting you confirmed). Human access is limited to security, legal, or support cases, and support access requires a request from you except where we must act to protect the Service.

Limited use.Ambitio's use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements. We use that data to provide or improve user-facing features that are prominent in the requesting application. We do not use it to train foundation models that are unrelated to those features.

Disconnect. You can disconnect Calendar, Tasks, or Analytics in Ambitio Settings. That deletes our stored tokens for that connection. You can also revoke Ambitio in your Google Account permissions.

4. How we use information

We use information to:

• Provide, maintain, and improve the Service
• Authenticate you and secure accounts
• Run agent-assisted features (for example drafting strategy, goals, or targets) using your venture content as context
• Run scheduling features you connected, as described in section 3
• Send transactional email (verification, magic links, security)
• Send product reminder email about unfinished setup (on by default; you can turn these off in Notifications)
• Send marketing nurture email only after you explicitly opt in (off by default; one-click unsubscribe is always available)
• Understand product usage and diagnose issues
• Comply with law and enforce our Terms of Service

We do not sell your personal information. We do not use your venture content to train public foundation models for unrelated third parties. Auth/security email is separate from product reminders and marketing nurture and is not controlled by marketing opt-in.

5. AI features

Some Ambitio features send prompts and relevant venture context to large language model providers so the Service can generate suggestions. Ambitio uses Google's Gemini models via Google Cloud under our agreement with Google. Web research inside the product also uses Ambitio's Gemini. Google processes that content to return a response. If you connected Google Calendar and enabled event details, scheduling suggestions may include that calendar context as described in section 3. Do not put secrets, regulated health data, or other sensitive personal data into prompts or fields unless you are comfortable with that processing.

6. Sharing

We share information only as needed with:

• Infrastructure vendors that host the app, database, file storage, email delivery, and AI inference (for example Google Cloud and our email provider)
• Analytics providers (for example PostHog) that help us understand how the product is used
• Auth and connected-account providers you choose (Google, GitHub) for sign-in or optional Calendar, Tasks, and Analytics connections
• Professional advisors, or authorities, when required by law or to protect rights and safety

Vendors process data under instructions that limit use to providing their services to us.

7. Cookies and similar technologies

We use necessary cookies for sessions and authentication. We may also use analytics cookies or local storage to measure product usage. You can control cookies through your browser settings; blocking necessary cookies may prevent login from working.

8. Retention

We keep account and venture data while your account is active and for a reasonable period afterward if needed for backups, disputes, or legal obligations. Connected Google tokens are kept until you disconnect that integration or delete your account. You may request deletion as described below. Diagnostic logs may be retained for a shorter operational window.

9. Security

We use industry-standard measures such as encrypted transport (HTTPS), hashed passwords, encrypted OAuth tokens at rest, and access-controlled cloud infrastructure. No method of transmission or storage is completely secure; use a strong unique password and keep account access limited to people you trust.

10. Your choices and rights

Depending on where you live, you may have rights to access, correct, export, or delete personal information, or to object to certain processing. To make a request, email hello@useambitio.com. We may need to verify your identity before fulfilling a request. You can update some account details in the product, including disconnecting Google Calendar, Tasks, and Analytics in Settings.

11. Children

Ambitio is for business use by adults. We do not knowingly collect personal information from children under 16. If you believe a child has provided us data, contact us and we will delete it.

12. International transfers

We operate primarily from the United States. If you access the Service from elsewhere, your information may be processed in the U.S. and other countries where our vendors operate.

13. Changes

We may update this Policy as the product evolves. We will post the revised version with a new effective date. Material changes may also be communicated by email or in-product notice when appropriate.

14. Contact

Vitaliti World, LLC
Email: hello@useambitio.com