Privacy Policy

This Privacy Policy explains how AMS Sphere handles personal data when someone visits the public portal, signs in to a workspace, launches an AMS application, or interacts with public-facing AMS forms and related support flows.

It applies to public website traffic, portal authentication, workspace launch flows, and the operational services required to keep those experiences secure, available, and auditable.

AMS Sphere may act in different privacy roles depending on the workflow.

For public website and portal platform operations, AMS Sphere generally acts as the service operator for the platform itself.

For workspace data, operational records, form submissions, documents, checklists, and business data entered by a customer organization, that customer organization is typically the data controller and AMS Sphere acts as a processor or sub-processor on its behalf.

Depending on the feature being used, AMS Sphere may process identification and contact data, authentication data, workspace membership data, device and session data, operational records, form responses, uploaded files, audit logs, and support-related metadata.

This can include names, email addresses, usernames, permissions, department assignments, sign-in timestamps, IP and browser information, application usage events, documents uploaded by users, and records created inside handling, passenger assistance, forms, or related modules.

We process data to deliver the platform, authenticate users, launch the correct workspace and applications, preserve system security, support business workflows, retain audit trails, investigate incidents, comply with legal obligations, and improve reliability.

We do not need all categories of data for every visitor. Processing depends on the product area being used and the permissions granted by the customer organization.

Where AMS Sphere acts as a controller for platform-level processing, the main legal bases are legitimate interests in operating and securing the service, performance of a contract, compliance with legal obligations, and consent where specifically required.

Where AMS Sphere acts as a processor, processing is carried out under the documented instructions of the relevant customer organization.

Personal data is only shared with authorized users, customer administrators, infrastructure providers, and service providers who need access to operate, secure, host, support, or lawfully maintain the platform.

Access is role-based and permission-controlled. Workspace content is not made public by default and is only exposed inside the scopes configured by the relevant organization.

AMS Sphere may use essential cookies, local storage, and similar technologies for session continuity, password reset flows, workspace selection, security controls, language and theme preferences, and client version handling.

We may also process operational telemetry, error logs, and technical diagnostics that help us detect failures, investigate abuse, and keep the service stable.

Retention depends on the type of record and the contractual or legal requirements attached to it. Authentication records, audit trails, operational records, and form submissions may be retained for different periods based on security, compliance, and business continuity needs.

When AMS Sphere acts as a processor, retention is primarily governed by the customer organization’s instructions and the platform configuration agreed with that customer.

If personal data is transferred outside the jurisdiction in which it was collected, AMS Sphere will use appropriate safeguards consistent with applicable law, such as contractual measures, technical protections, and provider-level compliance commitments.

AMS Sphere applies administrative, organizational, and technical safeguards designed to protect personal data against unauthorized access, misuse, loss, destruction, or disclosure. These controls include access management, auditability, environment separation, credential handling, and operational monitoring.

No online service can promise absolute security, but AMS Sphere is designed to minimize exposure and preserve traceability for sensitive actions.

Depending on applicable law and the role AMS Sphere is playing in the workflow, data subjects may have rights to access, rectify, erase, restrict, object to, or request portability of their personal data.

If the request concerns workspace or business records submitted on behalf of an organization, the fastest route is usually to contact that organization directly, because it is generally the controller for that content.

When a public AMS form is used, the submitted information is processed for the business purpose stated by that form. Access to those submissions is limited to the authorized organization users and workflows configured for that form, such as review, approval, internal review, audit, and export.

This policy may be updated from time to time to reflect platform changes, legal requirements, or operational improvements. The latest version published at this URL is the version that applies.

For privacy questions related to a specific workspace, operational record, or form submission, contact the organization that invited you to use AMS Sphere.

For platform-level privacy questions about AMS Sphere itself, contact AMS Sphere at admin@amssphere.com.