Privacy Policy

Last updated: October 5, 2026

Overview

Ambrogio is a personal marketing and growth assistant operated by BlackBear S.r.l. (registered office: Via Adeodato Ressi 12, 20125 Milan (MI), Italy; VAT IT14810280967), the data controller for your data. This policy explains what data Ambrogio processes, why, and how it is protected. Ambrogio currently operates in private beta for a small number of users. Our Terms of Service govern your use of the Service.

Data we collect

  • Account information — name and email address, via our authentication provider (Clerk), when you are invited and sign in.
  • Brand and content data — what you give Ambrogio to do its job: brand details, voice guidelines, notes, the drafts it generates and what you approve, edit or skip.
  • WhatsApp messages— messages you send to and receive from Ambrogio's WhatsApp number, used solely to deliver briefs and process requests you initiate (e.g. pasting a thread for a comment draft).
  • Connected channel data — content and engagement signals from platforms you connect (LinkedIn, Reddit), and posts and metrics you record yourself (for example for X), used to generate briefs and drafts and to track performance. Access tokens for connected channels are stored encrypted.
  • Analytics — only if you accept analytics cookies: aggregate page-view data about visits to the Ambrogio website, collected by Vercel Analytics and Cloudflare Web Analytics. See Cookies below.
  • Technical data — standard server and security logs (such as IP address and request details) kept by our hosting and infrastructure providers to run and protect the Service.

How we use data and our legal bases

Data is used to operate Ambrogio for the account it belongs to: generating briefs, drafting content, tracking performance, and delivering notifications. We do not sell personal data or share it with third parties for advertising purposes. Our legal bases under the GDPR are:

  • performance of our agreement with you (providing the Service you were invited to);
  • your consent (analytics cookies, which you can withdraw at any time);
  • our legitimate interest in keeping the Service secure and working;
  • compliance with legal obligations, where they apply.

How AI is used

Ambrogio uses AI (Anthropic's Claude models) to write briefs and drafts. To do that, the relevant parts of your content, your brand context and the signals gathered for a brief are sent to Anthropic. Anthropic processes them to return a result and, under its commercial terms, does not use them to train its models. AI drafts are suggestions: nothing is published to a connected channel until you have reviewed and approved it.

Cookies and similar technologies

Ambrogio uses two kinds of cookies and similar storage. A banner asks for your choice on your first visit, and you can change it at any time.

Essential (always on, no consent needed)

  • Sign-in session (Clerk) — keeps you signed in and the account secure. Set only when you sign in or use the dashboard, and removed when you sign out or the session expires.
  • Your cookie choice — saved in your browser's local storage (key ambrogio-cookie-consent) so we remember your decision. It stays on your device, is not sent to us, and expires after 12 months or when this policy changes, at which point we ask again.

Analytics (off until you accept)

  • Vercel Analytics (Vercel Inc.) and Cloudflare Web Analytics (Cloudflare, Inc.) — measure aggregate page views to show us which pages are read. According to their providers they are designed to work without advertising cookies or cross-site profiling.
  • Neither is loaded until you choose “Accept” (or turn Analytics on in Settings). If you choose “Reject”, or do nothing, they are never loaded and Ambrogio works exactly the same.

We use no advertising or marketing cookies. To change your choice at any time, use the link here or in the footer of any page. Withdrawing consent reloads the page so analytics stop immediately. You can also clear this site's data in your browser settings.

Who processes your data

We share data only with the service providers below, each acting on our behalf to perform the function described, plus the platforms you choose to connect. We do not sell your data.

  • Clerk — authentication, accounts and sign-in sessions.
  • Neon — managed Postgres database where your data is stored.
  • Vercel — application hosting and serverless infrastructure; and, only with your analytics consent, Vercel Analytics.
  • Cloudflare — Cloudflare Web Analytics, only with your analytics consent.
  • Anthropic — AI processing to generate briefs and drafts.
  • Postmark — delivery of transactional email, such as invitations.
  • Meta Platforms (WhatsApp Cloud API)— delivery of WhatsApp briefs and messages, under WhatsApp's own terms.
  • Tavily— web search used to find recent content and signals relevant to a brand's topics when preparing a brief.
  • GitHub — reading merged pull requests of a repository configured for a brand, as a source of real shipped work for its briefs.
  • LinkedIn and Reddit — the platforms you connect: Ambrogio reads signals and, only for drafts you have approved, publishes on your behalf through their APIs, under their own terms and privacy policies. X is not connected through an API: you publish there yourself.
  • PostHog, Vercel and Cloudflare analytics accounts — where a workspace connects them, Ambrogio reads aggregate website metrics from their APIs to report acquisition performance. This is read-only reporting; Ambrogio does not embed PostHog tracking on its own website.
  • Legal requirements — authorities, where required by applicable law.

International transfers

Some providers above (for example Vercel, Anthropic, Clerk, Postmark, Cloudflare and Meta) are based in or operate from the United States. Where personal data is transferred outside the European Economic Area, we rely on the safeguards available under the GDPR, such as an adequacy decision (including the EU-US Data Privacy Framework) or Standard Contractual Clauses. You can ask us for details at hello@blackbear.so.

Data storage and security

Data is stored in a managed Postgres database (Neon) and processed via Vercel's hosting infrastructure. Access tokens for connected channels are encrypted at rest. We take reasonable technical measures to protect data against unauthorized access.

Retention

We keep your data while your account is active. When you ask us to delete your account, we delete your account data, except where the law requires us to keep it. Cookie-choice storage is described above.

Your rights and choices

Under the GDPR you can ask us for access to your data, to correct it, to delete it, to restrict or object to processing, and to receive it in a portable format, and you can withdraw consent at any time. You can also disconnect any connected channel, or stop WhatsApp notifications, at any time. To exercise these rights, write to us at the address below. You also have the right to lodge a complaint with a data protection authority; in Italy this is the Garante per la protezione dei dati personali.

Children

Ambrogio is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy. We will change the “Last updated” date and, for material changes, tell you by email or in the Service. If a change affects cookies, we will ask for your choice again.

Contact

Questions about this policy or your data can be sent to hello@blackbear.so.
BlackBear S.r.l. · Via Adeodato Ressi 12, 20125 Milan (MI), Italy · VAT/Tax ID IT14810280967