1. Information we process and how we receive it
We may process the following information to provide the service.
- Account and contact information: email address, Amber Account/user identifiers, account status, role, and product entitlements
- Device and security information: app instance ID, device name and platform, trusted-device identifiers, push token, IP address, authentication/access/security logs, and last-seen time
- Service information: Console enrollment and connection identifiers/status, notification preferences, and operational metadata required for PTT channels, sessions, and authorization
- Collection methods: signup and login, device enrollment, Console connection, alerts and PTT use, and records automatically generated for security and service operation
2. Camera, microphone, Bluetooth, and local network
Amber MON may access the camera, microphone, Bluetooth, and local network after the user grants the relevant permission.
The camera is used to scan Console enrollment QR codes. Camera imagery used for scanning is not stored on our servers as user photos or videos.
The microphone is used for Push-to-Talk (PTT). PTT audio is transmitted in real time to provide the communication service, and the Amber PTT backend does not record or durably retain raw voice audio.
Bluetooth and local-network access are used for proximity verification, field Console connectivity, and related service functions, not for advertising tracking.
3. Purposes of processing
- Authenticate Amber Account users, maintain sessions, and verify product entitlements
- Enroll and connect Amber Console, display field status, synchronize alerts, and provide mobile functionality
- Authorize PTT participation, establish communication sessions, and provide real-time voice communication
- Register trusted devices, deliver push notifications, prevent abuse, and respond to security incidents
- Troubleshoot service issues, respond to support requests, and maintain reliable service operation
4. Retention
Account information is generally retained until account deletion or termination of the service relationship, subject to any longer period required by law.
Trusted-device and push-registration information may be retained until the device is revoked, the token becomes invalid, or the account is deleted.
Under the current Amber Account configuration, ordinary login-attempt records are pruned within up to two days; access sessions expire within up to eight hours; and mobile refresh sessions may remain valid for up to 365 days unless they are revoked or invalidated earlier.
Security audit records may be retained for the period reasonably necessary for incident response, service integrity, and legal obligations.
5. Sharing and advertising tracking
We do not sell personal information and do not provide personal information for third-party advertising or cross-service advertising tracking.
We do not disclose personal information to third parties except with consent or where disclosure is otherwise permitted or required by law.
6. Service providers
We may use infrastructure and platform providers as necessary to operate the service.
- Amazon Web Services (AWS): server/network infrastructure and transactional email delivery
- Apple: App Store distribution, Apple Push Notification service (APNs), and iOS platform functionality
- These providers process information under their applicable privacy/security terms and our service arrangements.
7. Your choices and account deletion
You may request access, correction, deletion, restriction of processing, or withdrawal of consent where applicable.
To request account deletion or exercise privacy rights, contact hi@amberlabs.kr. We may verify your identity before processing the request.
8. Deletion
When information is no longer required for the stated purpose and no legal retention requirement applies, we delete or securely dispose of it using methods intended to make recovery impracticable.
9. Security
- Encryption in transit and access controls
- One-way hashing of passwords and protection of authentication data
- Trusted-device and entitlement-based access controls
- Security event logging, reuse detection, and login-attempt protections
- Service-level data boundaries and least-privilege operation
10. Website and cookies
The amberlabs.kr corporate website currently does not use advertising networks or behaviorally targeted advertising cookies. Basic connection records may be generated for service operation and security.
11. Children
Amber MON is an enterprise industrial-service application and is not designed for children. If we learn that information from a child below the applicable legal age has been collected unintentionally, we will take appropriate action under applicable law.
12. Contact
Company: Amberlabs Inc.
Privacy and service inquiries: hi@amberlabs.kr
Location: Seoul, Republic of Korea
13. Changes to this policy
We may update this policy when service functionality, data practices, or applicable law changes. Material changes will be communicated through the service or this website as appropriate.